Technology

In fact, knowing that the only thing Proton was able to hand over was the credit card identifier is pretty solid proof that they in fact cannot access (and thus provide access to) your email account and its contents.

If full anonimity is the goal then stick to crypto or cash payments, because credit card always leaves a trail and not a single email provider is above the law in that regard.

This case is entirely the fault of the user's bad opsec.

Yeah, it's the distinction between "anonymous" and "private".

In this case, wouldn't rolling your own email server make it even easier to find you, since they'll just have to look up who registered the domain you used for your email address?

They litterally gave information they were legally required to

E2EE stops them from being forced to turn over the emails themselves

Except it doesn't, E2EE in browser is pointless, they send your browser the code that does the dycription, they can just as easily send your browser code that does decyption & uploads the contents to themselves.

Yes doing actual E2EE emails is harder because both ends need to use an email client and configure it to do encryption, but for amost all scenarios protonmail is no more technically secure than any other webmail provider.

I think offering per-user encryption that makes it harder for the company to data mine your emails is good, I just wish people would stop believing companies selling you "secure solutions".

In this case defendtheatlantaforest would have been more secure if they used any free email provider and GPG, yet there's a cult-of-produce around protonmail as if it's offering you a level of security that it can't.

Furthermore, you can pay with bitcoin or even cash (sent to their HQ by mail). That way they'd have even less on you.

Sounds just like Proton in the article:

Proton AG clarified they shared no data directly with the FBI — technically accurate but missing the point.

Could've paid with crypto, choose not to.

Europe bullied them out of their tax haven status a decade or so back. Germany and others made them hand over tax scofflaw account details. It was in the papers don't remember the year.

If I remember correctly, payment data is required to be logged for 10 years.

Edit: This varies from jurisdiction to jurisdiction, but it's normally 5-10 years.

I'm pretty sure proton offers a crypto payment of some form. Which would mean if this person had used that instead of a credit card, theoretically there wouldn't be anything to subpoena.

Either way, email isn't exactly safe.

There is no safe jurisdiction.

When was that? They took in the Nazi gold.

Even some commercial less well known mail providers are sometimes blocked by big players like gmail and outlook for anti-spam reasons.