Proton Mail Discloses User Data Leading to Arrest in Spain

drdiddlybadger , 1 month ago

So key tip here is don't set a fuckin non friendly service as a recovery email on protonmail lmao

reagansrottencorpse , 1 month ago

The requests were made under the guise of anti-terrorism laws, despite the primary activities of the Democratic Tsunami involving protests and roadblocks, which raises questions about the proportionality and justification of such measures.

BrikoX OP , 1 month ago

Since Proton complied, it means there was enough there for Swiss courts to agree. All requests are subject to Switzerland laws.

hellfire103 , 1 month ago

*sigh*

Maybe I'd better start self-hosting...

BrikoX OP , 1 month ago

If you do, make sure you are savvy enough to lock down access and your network is secure. Misconfigured networks are one of the biggest vectors for data breaches.

hellfire103 , 1 month ago

I'll probably stick OpenBSD on an old laptop. The FSF have some recommended software I can try.

If I can get a few friends and family onto Gemini, I could also use Misfin.

fluckx , 1 month ago

Self hosting email is a rabbit hole I'd rather not go down. :(

BrikoX OP , 1 month ago

They always complied with legal court orders, as all companies do. It just highlights the fundamental issue with email as a protocol.

lemmy_in , 1 month ago

This has nothing to do with email as a protocol. The court order discussed in the article asked for the recovery email address of an account. No actual email data was transferred.

meldrik , 1 month ago

I wonder what the authorities could use the recovery email for? Did they gain access to the Protonmail through the recovery email?

BrikoX OP , 1 month ago

Recovery email was tied to Apple, so they asked Apple to private the data they needed. No email content was shared at any point from Proton.

Beaver , 1 month ago

Man. Apple is really terrible here.

BrikoX OP , 1 month ago

I'm aware. But some user data and metadata required for email protocol to function that can't be encrypted is the fundamental issue. No provider can solve this issue, no matter how private and secure they are.

In this specific case, the user was a dumbass and linked another email that was tied to Apple. My point was more about email being flawed by design and a need for an alternative protocol if we want true privacy.

Grangle1 , 1 month ago

It's just a general rule of thumb: privacy and security companies can work well against outside attacks but can only do so much against a government/court order, so don't expect any of them, not even Mullvad, to go to jail for you. Encryption, anonymization and no logging are the most anyone can expect/hope for from a company, which still puts companies like Proton or even Tutanota leagues ahead of the spyware that is Gmail, Yahoo or Microsoft when it comes to email. The end user needs to do the rest themselves.