ProtonMail - not so private eh?

Just another one which proves that "no logs" doesnt exist. (This is to the guys using VPNs "without logs")

We all knew this already. VPNs maybe protect you against corposcum, and only when there's no legal claim backing their whining. And that's only so long as netflow deanonymization by corposcum isn't used to serve as due cause for legal bullshit.

I dont think VPNs are worth using anyway, the paid ones log you, the free ones log and sell.

>>50705 Why would anyone assume a service is safe if it obeys the law?

>then scrubs of claims >scrubs I like how this is framed as some sort of smoking gun. If you realized you could no longer support a claim that you used to make and were being called out for it by others, would the logical move be to leave the claim up so people can call you out on hypocrisy or to take it down?

Also logs may very well not have existed at some point as they claimed. They were compelled by law enforcement to start logging. Thus the problem is not whether or not an organization is genuinely logging or not, whether their word can be trusted. The problem is the current triviality of logging and whether one can be compelled by law to do so.

>>50710 Indeed. You can not trust anyone, you kind of deserve getting caught if you use corporate services for criminal purposes. "B-but Whatsapp said it uses E2EE, how come I got caught being a drug lord?" lulz.

>>50705 >email >not private No soykaf. We've known this for decades. I'm surprised they didn't provide the entire inbox.

>>50713 >"B-but Whatsapp said it uses E2EE, how come I got caught being a drug lord?" lulz. Kek. I saw a dumb article recently where "security researchers" described how they wanted to implement a mechanism to detect and and report CP """without""" compromising E2EE but *somehow* they realized it is impossible. N*rmal people won't even notice something's not right because they don't understand the essence of encryption or how software works.

>>50711 You need to think this through, friend. >Claims to not keep logs >Gives up logs >Removes claim That means its initial claim was a lie. They would have to have kept logs prior to this event. Do you understand?

Protonmail is a fuarrrking lie , they close me randomly an account because "swiss investigation blablalba" and I lose data and I cant appeal or something... there are other GOOD alternative?

>>50718 >They would have to have kept logs prior to this event. Do you understand? Can you prove that? They claim to have been compelled to start logging for this particular user. Do you understand the difference?

>>50720 There really isn't, the best thing anyone could recommend is use the onion address and pgp.

Modern encryption is a scam anyways.

>>50705 >glowniggermail gives your IP address to every third world police or court without hesitation Always has been. Pic is from April 2017 you know how to read cyrillic, don't you? Obviously, it was a kidnapper, far worse crime than say, being an eco-activist, but ask yourself a question: when a tool does not protect kidnappers, is it safe to use for eco-activists, yourself? We take the whole loop back to Clipper chip controversy.

>>50720 >there are other GOOD alternative? https://digdeeper.neocities.org/ghost/email.html I remember some other articles having some retarded stuff but they look good overall.

>>50718 Let's be a bit more accurate. They said they don't keep logs by "default". They were then asked to start keeping logs. They started keeping logs. Then they gave those logs.

>>50705 >>50718 >>50726 >Important clarifications regarding arrest of climate activist >Posted on September 6, 2021 >Under no circumstances can our encryption be bypassed, meaning emails, attachments, calendars, files, etc. cannot be compromised by legal orders. >ProtonMail does not give data to foreign governments; that’s illegal under Article 271 of the Swiss Criminal code. We only comply with legally binding orders from Swiss authorities. >Swiss authorities will only approve requests which meet Swiss legal standards (the only law that matters is Swiss law) >Transparency with our user community is extremely important to us. Since 2015, we have published a transparency report publicizing how we handle Swiss law enforcement requests: https://protonmail.com/blog/transparency-report/ >Under Swiss law, it is obligatory for a user to be notified if a third party makes a request for their private data and such data is to be used in a criminal proceeding. More information can be found here. >Under current Swiss law, email and VPN are treated differently, and ProtonVPN cannot be compelled to log user data. >Due to Proton’s strict privacy, we do not know the identity of our users, and at no point were we aware that the targeted users were climate activists. We only know that the order for data from the Swiss government came through channels typically reserved for serious crimes. >There was no legal possibility to resist or fight this particular request.

>>50740 https://protonmail.com/blog/climate-activist-arrest/

>>50740 What are you trying to say? still trying to defend them? THEY LITERALLY GAVE OUT LOGS.

The truth is, the moment the feds knock on your provider's door because they suspect that a certain criminal is using their services, it's either help the feds or shut down the provider's operations. "No logs" is a lie. they have to keep logs or the police will shut them down. No sane VPN company would risk getting accused and going to jail of something they didn't do.

I'm confused here. It sounds like what happened is they gave over encrypted data of an email address not an IP log.

ProtonMail was never private. VPNs are not private. Because VPN providers have servers in privacy-invasive countries such as the US and China, they cannot respect your privacy. The jurisdiction of the server's location overrides that of the provider's location, so if, say, Mullvad had servers in China, then in accordance with Chinese law, they must keep logs for however long the chinese want them to and share it with them, for those servers located in china, and the same applies for any other country. What i'm saying is Mullvad and IVPN are compromised and cannot be trusted. There is nothing you can do to protect your privacy. Give it up.

>>50751 >There is nothing you can do to protect your privacy. Give it up. This is just dumb though. You certainly can protect your privacy. It's not like there exist a binary switch that says "Privacy off/on". Although imo, email by default suck ass when it comes to privacy and should only be used for things you are fine with someone possibly knowing. Obviously that there's a leak and people can find out you bought a new pair of speakers is not that much of a deal. Passwords shouldn't be send through it though.

>>50751 i mean you could use e2e crypto (popular and easy to setup since the 2000s) and onion routing, but whatever

>tfw i've been calling it protonmeme all these years >tfw i gave up even using it for throwaways after i realized it blocks tor 500 years ago >tfw you idiots thought some corpo websh1t is realiable, ever

for clarification, it doesn't actually block tor, it's just impossible to use with tor, unless you have a way of anonymously receiving SMS (and no, most people don't. most of those public sites are probably blocked/throttled like with all SMS sign ups)

>>50753 There isn't any reason to. I don't have anything to hide, and do you know why? Because there isn't anything left for me to hide. Everything is already out there. All of my personal information, the websites I visited, are already exposed, and using crypto and tor isn't going to hide that.

>>50756 >Claims Proton blocks Tor >Meanwhile Proton has an Onion service

>>50705 Was literally the first thing I switched to when I began actually giving a soykaf about my online privacy. I'm regretting that more and more, but it's a lesson learned the hard way I suppose. I know I could've fallen for an even worse meme like Brave, but still...

>>50761 >ignores what was actually said and posts stupid fuarrrking bullshit even facebook has an onion and it's pure virtue signalling, you still need a phone to sign up, and thus zero anonymity

>>50760 >im gonna post all my future conversations in the clear because my self has been compromised because i used some websh1t 50 years ago peak cope defeatism

>>50762 same here anon. its a shame, but sometimes we have to learn this stuff the hard way. hopefully their no logging claim was accurate and truthful in the past, but no way to verify unless there is a leak at some point, so best thing we can do is just stop using the service. lesson here is to trust nothing unless you can audit it yourself, if you can maybe its trustworthy, if you cant then avoid at all costs

>>50763 Except you don't, I signed up with a disposable email address.

>>50761 the onion service that redirects to the clearnet domain? back to reddit, retard.

>>50772 fuarrrk are you even talking about? It (Proton's Onion) doesn't do such a redirect

>>50771 there is a variable (time of day, IP address, who knows) that decides whether you get the "provide an email to sign up to email" option (which is still retarded and corpo tier) it's amazing how you completely ignore the pic in >>50758 like a true robot are you done with your sperg bullsh!t yet? >AHHHH I HAVE TO ARGUE >>50772 is not me, btw. inb4

>>50775 >it's amazing how you completely ignore the pic in >>50758 like a true robot They hadn't referenced my post, and I tend to disregard images. Looking at it now, I see nothing more than proof they didn't cycle through enough circuits to get one that doesn't do that bullshit. >are you done with your sperg bullsh!t yet? No. >>>50772 is not me, btw. inb4 Good to know.

>>50775 "provide an email to sign up to email" Lucky made my accounts before that dumb soykaf happen, not made a protonmail since then. Proton VPN is equally dog soykaf.

>>50758 >unless you have a way of anonymously receiving SMS (and no, most people don't. most of those public sites are probably blocked/throttled like with all SMS sign ups) How to receive SMS anonymously without those receive-SMS sites?

>>50751 What if someone set up servers on some old oil rig?

I used to use ProtonVPN Whenever a n00b asks "what is the most secure XXX?" I always see someone suggest self hosting. My main concern with self hosting is advertising my IP publicly, giving attackers a single reliable point where they can do port-scans, DDOS, or geo-location. What is the solution to this? Is self hosting a meme?

>>50807 Simply setup wireguard for yourself, and if that's not enough use ssh for port-forwarding to your servers (login with keys only). That gives you at least two layers that need to fail at the same time for a breach to occur. It also takes care of port-scans since you're only offering the ssh daemon over wireguard. Can't exactly do much about DDOS, because even though wireguard discards invalid requests early & fast... just flooding the residential address with pings can probably be enough. For geolocation, you seem to be intent on using the wrong tool for the wrong job. VPNs are most useful as access control tools, not privacy networks. Current commercial VPN offerings for "privacy" are at best useful only for soykaf like torrenting if that. You'll get better results from Tor or I2P, though this comes with the debatable drawback that clearnet torrenting is not an option. Note that for ssh, it might be advisable to configure and enable connection multiplexing depending on what you're doing. >>50815 Self-hosting is a legitimate option, so long as you're intending to do it for stuff where it makes sense.

>>50807 They can do the same thing even if you don't host anything. You're likely being port-scanned right now. As for DDOS-ing, you're not important. So it won't happen if you just host a VPN for yourself. >advertising my IP publicly You're not advertising anything. I don't think you know what "hosting" means. You're just setting up a service and opening a port. You're not spamming your IP to other computers on the internet. Nobody will know that you're hosting anything until they test you for open ports and responses. >always see someone suggest self hosting This is generally a good idea but you need to be aware of the benefits and limits. Email is a completely unencrypted protocol so if you're hosting your own email, but are sending/receiving emails to/from other domains then those email contents are completely transparent to the domain hosts. For example, I email you from protonmail/gmail, Proton/Google will see the contents of the email and most metadata. So you hosting your own email is (almost) pointless. If you want to secure your communication with someone you can use encryption/PGP. But using encryption on email is not standard and requires both parties to accept such form of communication. VPNs are another thing. If you want a VPN, as in a way to connect any remote device onto your LAN then host your own. This way no matter where you are, you can connect your phone/laptop onto your home network and access everything there, like servers and such, while hiding your browsing history from your mobile provider or public WiFi. People used to do this to play LAN games remotely, assuming they didn't use Hamachi VPN. If you want a proxy, as in a way to hide your IP from sites and browsing history from ISP then hosting your own VPN makes no sense because you're just connecting back onto your home router. Either use a VPN as a proxy provider, or use Tor.

>>50708 Then how do lainons stay so secure? VPNs fuarrrk you over, Tor fuarrrks you over, what does lain do?

>>50826 They don't. Security does not exist.

>>50828 Ah, the token defeatist has arrived.

>>50829 No it is the attitude of any sane security researcher.

>>50830 Security researchers don't fall into binary thinking about something they know has a lot more nuance.

>>50831 Speaking of nuance maybe ask "how do lainions stay so secure [from something]?".

>>50778 buy from the people spammers get their sms auth'd accounts from. idk what you call them but voip vendors like that are a pretty common fixture on seo forums and many take crypto.

>>50826 compartmentalize and layer security. also understand that nothing will be secure from everyone. a VPN is useful to me because it keepa information about my piracy secure from ISP snooping. it does not keep it secure from a LE subpoena, but it doesnt need to because things that need to be secure from that use different technologies.

>>50832 I'm not the lainon who originally asked the question, but yes, that is the way to go.

>Just another one which proves that "no logs" doesnt exist. (This is to the guys using VPNs "without logs") They do indeed not keep logs by default, but they can't deny a request from law enforcement to do so on legal terms.

>>50751 >There is nothing you can do to protect your privacy. Give it up. Uneducated fool. You can already protect it with strategic use of existing tools, and that doesn't even take into account soon-to-be tools: https://arxiv.org/abs/1703.00536 Total resistance to global passive adversary- achieved. Sender/receiver unobservability, sender/receiver unlinkability, impossible to do online/offline correlation for inter-network comms. Combined with Nym (https://nymtech.net/nym-whitepaper.pdf)'s crypto incentives, glowniggers have jack soykaf.

>>50826 >Tor fuarrrks you over Hi, please read about Tor here-->https://svn-archive.torproject.org/svn/projects/design-paper/tor-design.pdf Attempt to fully comprehend your tools before posting. But anyway, some people have long used a variety of techniques with their own bots to perfectly anonymize their own traffic, but this is not feasible and requires you write your own solution. As anonymous No.50865 posted above, there are emerging tools (Loopix) for dealing with these adversaries. Otherwise, you can use Tor/I2P, private, cookie-protected onion services (adversary can't do traffic-shaping against this), perhaps use more nodes for a standard circuit, keep traffic 'indistinct' from other traffic in the network, physically indirect yourself with public or ""public"" WiFi, you name it. You have to look out for protocol leaks for whatever you're doing this whole time, of course, but it's a lot harder to have privacy if you have ethics, at least until implementations of Loopix like Nym are publicly available.

>>50866 It is also worth noting that perfection is the enemy of the good- Tor may not be able to stop certain attackers from doing confirmation attacks 100% of the time, for example, but any increase in privacy is a net gain. Think of privacy as something which can be increased/decreased, not something which is switched on/off.

>>50720 The standard I2P client has an email service that lets you send emails to clearnet addresses as well. Though, that's still run by someone that's not you. If you want email privacy, run your own email server, from physical hardware located in your home, and only ever send encrypted mails. Problem there is that this makes it impossible to communicate with normal people. That being said, when you're planning something that attracts the party van, don't use email. Use tox, use retroshare, and do so over I2P or Tor. >>50867 It pays to have an adversary in mind when you plan your privacy strategy. I use paid VPNs as a first barrier against doxing, against script kiddies, and against corpos coming after me for torrenting. It's worked 100% for that so far. For stuff that'd get the interest of feds, you have to go much deeper. If it's the NSA or CIA you're worried about... good luck, computer security has just become a full-time job.

>>50865 How does Gnunet's design compare to Loopix?

>>50705 The so-called VPN they run under same brand is actually operated by datamining company Tesonet: https://web.archive.org/web/20180827154827/http://vpnscam.com/tesonet-data-mining-company-owns-nordvpn-protonmail-protonvpn/

>>50824 >You're not spamming your IP to other computers on the internet. Nobody will know that you're hosting anything until they test you for open ports and responses. Given that the context of this thread is e-mail, won't you be advertising said IP publicly to anyone who knows or finds your domain?

Always funny how like 70% percent of people's complaints about these sorts of services are actually about the unfulfilled fantasy version of what they'd like a private email service to be instead of any existing reality. Yeah, no soykaf, a legitimate company will start keeping logs if legally required to, what a surprise. They're not about to go to jail for you.

>>50721 It's just a logic problem. See below >>50739 Is this pilpul...? In order to provide logs you must have logs to provide. So, at one point, one way or another, they lied. I'm not trying to be confrontational about it -- despite asking if "this is pilpul...?" -- I just want you to think about it and really comprehend what is being said. Let me create a scenario to make this easier: >Company A begins. >January 01, 2021 >Company A makes sure to disable all logging No logs are being kept - Company A >January 06, 2021 >Company A is informed by Federal Agency B to keep logs >Company A begins to keep logs >Company A does not update or change the stated information that logs are NOT being kept >January 12, 2021 >Company A gives up logs to Federal Agency B >Company A removes the claim If you do not understand by now, I have no more interest in discussing this with you.

>>51339 Every computer program produces some sort of metadata logging by default. It is cheaper in terms of technician labor, as well as counting storage capacity expenditures, to not remove said logs than to find out all ways to clean them up or not keep at all. There is no way to prove what data a computer you have no root access to stores or shares with other computers without your prior solicitation. Therefore assume every remote computer to store as much data it can extract from interaction with you through the constraints of any given communication channel.

Now protonmail even asks for completion of hcaptchas upon login. fuarrrk this totally cyberhumped piece of bait software

>>50756 The easiest way to tell a "privacy-focused" trash is trash is to see if it uses recaptcha or fonts/css/js cdn assets that also come from privacy violators like google for assets is just asking for zero privacy (asset request sends user agent and IP to such servers, while you can use vpn or proxies it will be harder when site use recaptcha and similarly cloudflare anti ddos while also the fact is these sites automatically will lock you out and ask for your phone numbers as authentication which is a mess since phones are easily breachable with imsi catchers and diy fake imsi your neighbor could even do so they can recover your account). I think none of these online mail services are trustable, you have to trust the country where the service is located, the host provider, the country and the author. You can bypass a few of these as being the author yourself or even hosting your own email server in your country setting up tamper resistance or setting it up your home while you have direct knowledge of any warrant canaries over your own servers and even the ability to choose your encryption of choice as we all know these "http mail servers" can do oopsies like accidentally duplicating a request or stuff like breaching their certs by casually having it be mitm'd by a local ISP server that is "trusted by CAs" or by a casual anti ddos service MiTMing you or using "JS" for encryption (big lmao) and that's just the tip of the iceberg.

>>51343 they keep logs and "delete" the logs but how secure is deletion really? they don't state how they do it, do they wipe the header of encrypted drive or do they use standard "erasing" method which actually sucsk nothing is stopping from sending poorly deleted data and maybe the compromised management hiring oopsies to do whack jobs like writing faulty program to delete it insecurely and then sending the drives to a recycling/refurbishing company which is some intel agency or maybe they even use compromised encryption methods and just assume "if the drive is lost it's as good as data is deleted because they don't have a key" or whatever, the more people there is in a company too the less secure it is so the best method is really being your own email provider but seriously just stop using emails. I've yet to see email providers that use pop3s and use ramdrives and actually state the vagueties like how they specifically store their information, their encryption methods, or overall how data is being juggled inside and pointing out how the "standards" are actually bad. Nope, none it means they are all just dead cetaceans waiting to be pushed back the ocean.

>>51949 Another thing to add is the SSDs are poor when it comes to data wiping or shredding as data can still be sitting untouched on some cell layer (just the first chip has wipe data maybe), even SSHD included (which is not recommended for encryption) and it's either of these two which are used by most modern servers in the planet, also the fact that they probably do not even do encryption as to avoid unnecessary overhead maybe they do but is there any reason for them to encrypt logs? I mean they could potentially sell it through some laundering tactics, no one would know.