No company is going to legally go to bat for you for $10/mo. I love how Proton nonchalantly calls out the user's dumb move in the article:
Proton provides privacy by default and not anonymity by default because anonymity requires certain user actions to ensure proper OpSec, such as not adding your Apple account as an optional recovery method. Note, Proton does not require adding a recovery address as this information can in theory be turned over under Swiss court order...
At any point in the process, does it warn you about setting up recovery with personal email addresses?
Feels like with as much as Proton advertises nowadays as a privacy protecting service, they need to be taking into consideration that a lot of their customers now are going to be average users who don't know anything about proper OpSec. They should be much clearer about what things they can't protect you from.
It shouldn't be in a press release like this, they should be explaining the difference between privacy and anonymity to the customer. It's not like their marketing team isn't aware of the fact most people don't know any better.
It's in their best interests, too, because it doesn't matter how many times you say "we provide privacy not anonymity", the headlines are a bad look.
It is worth noting though, that Proton doesn't allow you to use certain domains for recovery addresses. Admittedly this was awhile ago and maybe things have changed there but when I first joined Proton they wouldn't allow me to set a duck.com or simplelogin.com or addy.io address as a recovery email.
Obviously using an apple ID is stupid but Proton could make more of an effort too.
They are actually quite aggressive about blocking disposable emails, most free services don't work. I have used protonmail a few times for semi-disposable accounts that used disposable emails to sign up, and some of them were banned later.
No, only the ones on Proton. If you send or receive an email from outside, it's unencrypted there.
But still, it's little to no difference for law enforcement. They will get the real address and whichever little info Proton or the other provider has on you.
Oh, nice! Where was the VPN server, if you remember? Also heard of it being possible on a real Android device, but not on an Android VM so even harder to fake.
It's best for anonymity to not use one at all. Proton provides a recovery key to allow access to your account if you manage to lock yourself out. Keep that key somewhere safe/secure.
Thing is, Protonmail has been telling people this from the very beginning. It's like it gets rediscovered every year or so when somebody else gets busted.
Proton does require a recovery email address if you sign up to a mail forwarding service or similar, right after creating the account. In that case the account remains locked if you don’t, so that’s just a lie
Still, it wasn’t optional for me, so I’m pretty annoyed that they’re saying it.
You can remove the mail after but indeed, I won’t trust proton with not keeping that info. The mail has to be entered in the recovery email field, and then sends mail to the recovery email when you have unread mail. So it’s not a one-time mail sent with a code.
It looks more like multiple companies were needed to pin the individual. I don't expect any company to not comply with legal requests. My understanding is this is why it's important to know what information a company retains.
For my own use, I have used Proton just to mitigate being a source of ad info and to get better service. I'm not interesting enough to overthrow anything.
