Tutanota was (at least) compromised from the moment that they were ordered by German courts to spy on anyone that they were ordered to. Including skipping encryption upon email arrival. Why the hell they are suggested in the privacy space after that just proves how retarded most privacy bros are.
Why, what else could have they done with laws? Protonmail and literally every other provider on the clearnet is also susceptible to this. The only thing they can do is have lawyers to find what the absolute most minimum they are required to do and only do that, but that’s all.
Proton can be legally ordered to start recording the IP address of a specific user. That’s why they recommend that you always connect through their Onion site.
Other than that and if that’s possible, I think it may also be possible to legally order Proton to keep the unencrypted form of incoming emails for a specific user, but Proton did not said it in the article, and Swiss laws might protect them against that. It’s certainly possible technically, and good to be aware of it, I think.
Sorry but I can’t open the second link, as it actively resists it. I suspect though that the problem with Tutanota was not their encryption, but their legal system, which required them to keep a copy of the incoming emails.
Also, don’t mistake me, I’m all for protonmail, and I mean this. But did you know they only encrypt the email contents? Metadata like title, sender recipient and other things in the mail header don’t get encrypted.
you’re right about the IP thing. that’s a good clarification rather than just “spy”. i suppose it’s less dire than Tutanota not encrypting incoming mails if you use tor and vpn by default.
yeah basically it more or less proves that swiss privacy is a bit stronger in this case vs Germany.
on the proton encryption, i did know about this but does that apply to proton-to-proton, proton-to-NonProton, or both? if you have details on this let me know.
either way the fact that they dont makes me feel that proton is a similar honeypot to signal and telegram, where they make a compromise with the five eyes, to give them metadata even if actual contents are safe. metadata can be much more powerful than contents often times
in general email is just the worst protocol when it comes to privacy. sadly.
on the proton encryption, i did know about this but does that apply to proton-to-proton, proton-to-NonProton, or both? if you have details on this let me know.
As I know it applies to both. Formerly they were asking (among other things) about the titles of your latest emails for account recovery. (after I have put all the links here I realized that these don’t give a details on whether this also applies to inter-proton messages…)
either way the fact that they dont makes me feel that proton is a similar honeypot to signal and telegram, where they make a compromise with the five eyes, to give them metadata even if actual contents are safe. metadata can be much more powerful than contents often times
Yeah, might as well be. But if it is, I’m afraid we won’t get to know for a few decades, if ever. And I think it’s still better than the alternatives… the alternative email providers, that is.
If it comforts you, in their reddit comment I linked they mention (in 2019…) that there’s a proposal they support for openpgp to be able to have an encrypted subject line.
I found out also that Tutanota is essentially the same, except that they do E2EE subject lines between tutanota users, but I am guessing that is because they don’t use PGP unlike Proton. In which case, Proton is in the right in this case because they are increasing E2EE interoperability beyond just their own users. So, my comment about honeypotting was really uncalled for I think, and I apologize for that.
The OpenPGP proposal is interesting, but I couldn’t find anything on it. All I found was this below, which explains that email headers can’t be/aren’t encrypted, and subject is one of those, so that’s why. I have no clue what Proton was talking about, or where they got that info
The plan was to have criminals use the storefront — an online end-to-end encryption service called Tutanota — to allow authorities to collect intelligence about them.
If I have cameras… I really don’t mind supplying the footage if police ask. But I really would like that they ask. And I REALLY don’t want them to have footage that they don’t ask for and don’t obtain a warrant for.
How does this Fusus get access to private security camera feeds? I would assume companies and citizens will have to opt in to the sharing? www.fusus.com
This is why I refuse to own Ring cameras. Any company that has a program at all to share with the police is a nope from me. I don’t care if they say it’s opt in, it won’t be.
I wonder how disastrously bad things will need to get before it finally breaks through into public consciousness that maybe putting surveillance cameras everywhere was a bad idea. I expect we’ll find out in a couple of decades.
I’m really unsure of how this will play out. Gen Z seems to be way more okay with stuff like this and I think it’s just a general mindset shift that I don’t really see changing. Gen Z tends to constantly share their location with every acquaintance, on snapchat, etc all the time.
As much as stuff like this freaks me out and seems many steps too far, younger generations don’t, so I feel this is going to get worse over time, not better.
The real issue is that people have become so soft, so INCREDIBLY dependant on convenience, that they have given up all control. Having autonomy/privacy/ownership over your own environment is just too much work. It’s easier to just let someone else handle the surveillance system for you. What could go wrong?
This issue of complacency plagues just about everything, from cloud computing and banking to transportation and housing.
cbc.ca
Hot