Protonmail's ties to the CIA?

Not too far back on quadchan there was a copypasta of links doing its rounds citing supposed evidence of CIA involvement with Protonmail. It had quite a few links to various news articles by the likes of the verge, motherboard, wired etc. Those types of outlets, over the years and described how each one gave a little piece of the overall puzzle, illustrating how Protonmail was created with funding by the CIA and all that. I'd thought I'd saved the post as a text file to research its claims at a later date, but that turns out to have either been a false memory based in intention rather than action, or I deleted it in dumb stupor. I'm hoping some of my fellow lainons might know a.) what I'm talking about, and b.) the location of some of those links or c.) the ability to debunk any/all of the claims against protonmail if they are in-fact nothing but hot air. If none of the above are feasible, then consider this a crowd-source research thread on Protonmail's potential involvement or lack-thereof with LE

>>13820 Ok, I'll start. https://news.ycombinator.com/item?id=8755492 It's not much, but this Ycombinator post seems to offer a brief summary of Protonmail's design flaws. Something like this could help make a case for it being a honeypot contingent on the flaws being intentional. Given the nature of said flaws, that would seem to be the simplest explanation given the knowledge required for building such a site in the first place would make the chance these flaws were incidental incredibly unlikely. But it's no hard evidence, only something that might loosely indicate. It sets the board for making whether it's a honeypot a realistic explanation, but not much more than that.

Of all the entities I would like to keep out of my email, the US intelligence community is at the bottom of the list. Protonmail is exceptionally secure and private compared to most othe options, even if Agent Fud can read it, which I seriously doubt anyway.

>>13820 Assume any email provider that you don't host has a five eyes or similar back door. If you want to actually hide from the spooks then you shouldn't be trusting a hosted solution to encrypt your data and not access it. Main advantage of services like Protonmail is that they're not harvesting your data on the scale of big names like gmail or outlook while having a slightly lower chance of handing over your data.

It's probably safe to assume the CIA can read your emails regardless of provider lol

>>13828 Nice attempt at obscurity, department of homeland security

>>13828 >Of all the entities I would like to keep out of my email, the US intelligence community is at the bottom of the list. Given that I live in a Five eyes country, the US intelligence community is at the top of mine.

If it is any comfort to Proton users, if it is true the CIA funded it, it is probably because they want to use it or are currently using it. And they aren’t going to use a service they have not vetted.

>>13848 >Nice attempt at obscurity, department of homeland security I have no (zero, zip, nada) connection of any kind to any intelligence, law enforcement, government, corporate, or ideological organization anywhere in the world. But you'll believe whatever satisfies you, and that's fine with me. Best regards.

>>13820 Found this on Reddit: 1.Protonmail Behaves like a CIA/NSA “Honeypot” Protonmail has an Onion domain that allows users to visit their site using the TOR browser.  Protonmail even has an SSL cert for that onion address even though it’s completely unnecessary. When a user makes a new account with Protonmail on TOR they are re-directed from Protonmail’s “.onion” to “.com” address.  This breaks your secure encrypted connection to their onion address, enabling your identification.  There are absolutely no technical reasons for this feature.  In fact, the only other websites that operate like this are suspected NSA/CIA Honeypots. This is a huge security issue that was either created because Protonmail is managed by Particle physicists who do not understand computer security OR they have been forced to operate their website in a similar way as CIA/NSA honeypots. Both possibilities are serious concerns. Protonmail Does Not Provide “End to End Encryption” Professor Nadim Kobeissi mathematically proved that Protonmail does not provide End to End Encryption. Meaning, Protonmail has the ability to decrypt their own user’s data.  When this was shown to be true, Protonmail users were outraged they had been lied to.  Protonmail was forced to issue a public statement.   Their statement begins like you would expect it would..  by soykafting on the security researcher that revealed their dishonesty.   Then they continued to say:  “We lied to our users because other email companies did”.   No apologies.  They can decrypt any of their user’s data be sending them scripts that allow them to do so.  However they advertise that they can not.  Protonmail’s admission proves they offer the same security that Gmail offers.  Both Gmail and Protonmail offer encryption that they can decrypt whenever they want. Protonmail’s Was Created Under CIA/NSA Oversight Gmail & Protonmail were both created in CIA/NSA funded departments with their oversight.  Protonmail has tried to hide this part of their history. We wrote a whole article about it here. 4.Protonmail is Part Owned by CRV and the Swiss Government After a successful crowdfunding campaign with promises to “remain independent” Protonmail sold equity ownership to CRV and FONGIT.    At the time of the equity sale a CRV founder, Mr Ted Ditersmith, was working for the US State Department closely with President Obama.  His position as a delegate required close contact with CIA & NSA administration.  Mr. Ted Ditersmith had also witnessed the Edward Snowden revelations and made statements that he planned to use his corporate knowledge to “fight terrorism”.   FONGIT is a Non Profit organization that is financed by the Swiss Government. Protonmail staff member, Antonio Gambardella, also works for the Swiss Government. CRV, In-Q-Tel & the CIA The CIA openly operates a front company, In-Q-Tel, whose stated purpose is to invest in tech companies on behalf of the CIA. In-Q-Tel has stated they have a specific interest in the information contained in e-mails and encrypted communication. In-Q-Tel has been shown to be the bridge between the CIA and Gmail.  An analysis of staff members reveals CRV & In-Q-Tel connections.  The US media confirms these connections when they interview CRV so that they can understand In-Q-Tel.  Additionally, The mastermind, cryptographer & back end developer that created Protonmail, Wei Sun, now works for Google. Protonmail Follows CIA Email format & Metadata Requirements Leaked documents at Wikileaks show that the CIA requires emails to be stored as an EML filetype.  There are several ways to store emails, and Protonmail has selected the format that the CIA requires.  Protonmail offers no protection for users’ metadata and has officially stated that they turn metadata over to Law Enforcement.  Edward Snowden revealed that the US government cares least about the content of emails.  Mr. Snowden revealed the US Law Enforcement cares most about who a person is talking to, the dates & times of the emails, and the subject of the email.  Subject and metadata encryption are not difficult to provide.  However, Protonmail refuses to offer any protection on data that is most valuable to the CIA & FBI and they store it as plain text (No encryption). Edward Snowden stated the NSA “isn’t able to compromise the encryption algorithms underlying these technologies. Instead, it circumvents or undermines them by forcing companies to cooperate in other ways.  Protonmail has refused to protect the information the NSA wants, this is a concern. Swiss MLAT Law Could Give the NSA Full Access Protonmail’s Servers Reside In Switzerland, a country with an MLAT treaty that could allow the NSA to continue it’s the mission of recording “nearly everything” about a person’s internet communication.  Any doubts the MLAT treaty applies are removed when you take into account that Protonmail is part-owned by FONGIT, a Swiss Government-financed company.  Protonmail has also recently revised its Privacy Policy to include wording and requirements from the MLAT treaty.  Their actions show they are capitulating with the MLAT treaty.  Revisions include a change to their privacy policy allowing them to track your location while you use their service in some situations. Protonmail Uses Radware for DNS/DDOS Protection Privacy companies like Protonmail are required to use a DNS/DDOS service because of the frequent attacks against their service.  Protonmail uses a company called Radware for this purpose.  Radware is a low-quality service that has failed to provide adequate protection.  Protonmail has been taken offline, sometimes by teenage kids, because they insist on using a sub-par service.  It’s worth noting that Radware’s international office is a few miles away from the headquarters of the most powerful Intelligence agency on earth, The Isreali Mossad.  Radware can gain complete access to all Protonmail user’s accounts in two ways.  They could inject a few lines of code that would reveal all users log in username and passwords, thus allowing them to log in as if they are that user.  They could also be given users usernames & passwords by Protonmail.  Remember Protonmail has admitted they can access all user’s accounts and decrypt their data.  Additionally, it has been reported that Radware has direct connections to the Israeli Defense Force. Protonmail Developers Do Not Use Protonmail Protonmail’s developers are in a position to know the real security offered by Protonmail.   And Protonmail’s developers do not use Protonmail.   If you were served food by a cook who refused to eat the food, would that be a cause of concern to you?  This is the same situation.  Protonmail developers do not use Protonmail, there are likely good reasons for this. Protonmail engages in illegal cyberwarfare In 2017 Protonmail seems to have used illegal cyber warfare capabilities to unlawfully break into a suspects server.    You can see the tweet they posted and read about it here. They soon deleted the tweet and said: “We cannot confirm nor deny if anything happened.”  In 2013 the European Union parliament voted to make hacking a crime that carried a prison sentence of 2 years.  “Hacking back” is also illegal under Swiss law.  Based on Protonmail’s admissions only, they conducted an illegal hack. Protonmail has a history of Dishonesty.  From Protonmail’s creation lied to their users.  Starting when they crowdfunded $550k to “remain Independent”, a promise they broke almost immediately by selling equity ownership to a US corporation with ties to President Obama and John Podesta. In our opinion Protonmail is not an email solution you would use if you want privacy or security.  Your emails are probably going to end up in a US data center right next to your Gmail emails.

>>13820 And I think I found the thread OP was looking for. Paste incoming: SOME OF THESE MIGHT BE OUT OF CONTEXT SO READ THE FIRST POST FIRST Section 2 Here is a PDF made by Professor Nadim Kobeissi mathematically proving that Protonmail does not provide End to End Encryption. Meaning, Protonmail has the ability to decrypt their own user’s data. https://eprint.iacr.org/2018/1121.pdf When this was shown to be true, Protonmail users were outraged they had been lied to. Protonmail was forced to issue a public statement https://protonmail.com/blog/cryptographic-architecture-response/ Section 3 Protonmails MIT creation & CIA/NSA Oversight https://privacy-watchdog.io/protonmails-creation-with-cia-nsa/ Section 4 Protonmail is Part Owned by CRV and the Swiss Government https://protonmail.com/blog/protonmail-has-raised-2m-usd-to-protect-online-privacy/ Section 5 CRV, In-Q-Tel & the CIA https://www.nytimes.com/2001/12/30/business/suddenly-uncle-sam-wants-to-bankroll-you.html https://medium.com/insurge-intelligence/how-the-cia-made-google-e836451a959e Section 6 Protonmail Follows CIA Email format & Metadata Requirements (EML) https://mashable.com/2013/09/05/snowden-nsa-break-internet-encryption/ https://protonmail.com/support/knowledge-base/whats-the-difference-between-eml-and-mbox/ Section 8 Swiss MLAT Law Could Give the NSA Full Access https://protonmail.com/support/knowledge-base/protonmail-israel-radware/ https://techcrunch.com/2018/09/06/protonmail-names-one-of-the-attackers-behind-a-major-ddos-this-summer/?guccounter=1&guce_referrer=aHR0cHM6Ly9ndWNlLnRlY2hjcnVuY2guY29tLw&guce_referrer_sig=AQAAAAIHfdRWmAqol2sq4i_JmRrI4T8ja3ZBVsuIGYyeGI0UHV40udjiiuP_AS2pMNPT1lhaaFbvG3AfJdyLOIqw7H1G2F1bIlxalAhL1_iNph1I9cbBu4_odGUdzNV8kU5MvGbsQmkmRsiLWfndySdQhpoy3tXPxt1SolFvCmGuwnpd Section 9 Protonmail Developers Do Not Use Protonmail https://privacy-watchdog.io/protonmail-devs-do-not-use-protonmail/ Section 10 Protonmail engages in illegal cyberwarfare can see the tweet they posted and read about it here. They soon deleted the tweet and said: “We cannot confirm nor deny if anything happened.” In 2013 the European Union parliament voted to make hacking a crime that carried a prison sentence of 2 years. “Hacking back” is also illegal under Swiss law. Based on Protonmail’s admissions only, they conducted an illegal hack. https://www.vice.com/en/article/qvvke7/email-provider-protonmail-says-it-hacked-back-then-walks-claim-back

>>13890 >Privacy-Watchdog Oh God I remember that clown. I though the site died out when he stopped posting in Sep of 2019 and only archives of it remained. He's not trustworthy. https://archive.is/privacy-watchdog.io

>>13847 so the only safe alternative to any e-mail provider is running your own personal e-mail?

>>13946 Even then, all your emails & metadata get collected by whatever provider the other party is using

>>13890 Well, I read through the links, but I don't think there's much of any hard evidence to link Protonmail to the NSA. Regardless, I would say that it's probably best to just host your own. Either that or use i2p email with gpg like a non-retard.

>>13946 The safe alternative is that on top of PGP encrypting your emails and hoping that whoever you are communicating with is also doing the same. Even then they'll be able to do some level of metadata analysis from just monitoring packets on the internet, it still has to travel from your server to theirs.

>>13820 >Protonmail's ties to the CIA Why does it matter? If your security depends on profit seeking strangers not acting against you then you're doing it wrong.

Come on. protonmail is the most obvious honeypot there is, they do the SAME bullshit as all the gl0boh0mo mail providers. >randomly derezzed with no reason if i'm impossible to track/use a vpn a lot >randomly derezzed just for using a vpn fuarrrk these guys, my rule of thumb is, if it's norman accessible and shiled regularly then it's a honeypot/not safe

https://nitter.snopyta.org/ProtonVPN/status/1323344136242679808 >Trusting Google's VPN would be like trusting a VPN from the NSA. idk what to think

From digdeeper.neocities.org: "The most popular "private" E-mail provider, and often the first choice of a person getting away from the three giants. But does that mean it is in fact quality? Let's start with the sign-up process - if you're signing up through Tor or a VPN, ProtonMail requires SMS confirmation: And if you try to receive confirmation through a RiseUp E-mail, it says this: So, SMS is the only option (unless you want to donate, which would reveal your personal information of course); therefore their claim that ProtonMail does not require any personally identifiable information to register is a shameless lie. Update: a contact told me that Proton now includes the option to solve a recaptcha (still an evil) for confirmation; however, the option disappears while using a VPN. They must really want that damn phone number if you are using anonymizers! And the claim that you can sign up without personal data is still false. The way their "end to end" encryption works is by generating the encryption keys while you sign up - using your already existing keys is not allowed and ProtonMail must store the generated private key (archive) for PGP to work. Since the whole encryption process is done by JavaScript in the browser, nothing prevents them from sending you backdoored JS; the encrypted messages can also only be sent to other ProtonMail users, unless using the paid account (update: actually, a friend has told me that the latter isn't true anymore, though you have to upload the recipients' public PGP keys to ProtonMail if you want to use them). According to researchers, ProtonMail's encryption contains serious shortcomings. At the end of this report, I also link to an article detailing the issues with in-browser encryption in general. Mail clients are not supported except, again, through a paid feature called "Protonmail Bridge". But let's move past the fluff and see which data does ProtonMail actually store and for how long. Quoting from their privacy policy (archive): We employ a local installation of Matomo, an open source analytics tool. Analytics are anonymized whenever possible and stored locally (and not on the cloud). So when you visit their website, this Matomo spies on you. But what data does it actually collect? From Matomo's website (archive): All standard statistics reports: top keywords and search engines, websites, social media websites, top page URLs, page titles, user countries, providers, operating system, browser marketshare, screen resolution, desktop VS mobile, engagement (time on site, pages per visit, repeated visits), top campaigns, custom variables, top entry/exit pages, downloaded files, and many more, classified into four main analytics report categories – Visitors, Actions, Referrers, Goals/Ecommerce (30+ reports) So that's the website. What about the e-mail service? we have access to the following email metadata: sender and recipient email addresses, the IP address incoming messages originated from, message subject, and message sent and received times. [...] We also have access to the following records of account activity: number of messages sent, amount of storage space used, total number of messages, last login time. Great, even more metadata than Tutanota (if you trust Tutanota's claims that they collect as little metadata as they say they do). And then there's this gem: When a ProtonMail account is closed, data is immediately deleted from production servers. Active accounts will have data retained indefinitely. Deleted emails are also permanently deleted from production servers. Deleted data may be retained in our backups for up to 14 days. Read that again! Indefinite retention of data by the "private" ProtonMail! And 14 days for deleted data - enough for "them" to get you. At least there's disk encryption...UPDATE August 28; a direct admission they do store IP logs forever in certain cases - and your IP address may be retained permanently if you are engaged in activities that breach our terms and conditions. Their TOS says this: You agree to not use this Service for any unlawful or prohibited activities. You also agree to not disrupt the ProtonMail networks and servers, which can cover pretty much anything. If you read their transparency report (archive), you will see quite a lot of requests for their data from governments all around the world. ProtonMail pretends to "require a Swiss court order" to cooperate - but you see that they often do that before receiving it - so don't expect that to protect you. One particularly egregious example is from May 2018, where they disabled an account because of terrorist allegiances - and we all know that's not just a convenient excuse these days, right? The new transparency report shows they've complied with 336 government data requests in 2018 alone - including 76 foreign ones. Oh, and since August 28, they finally admit to direct surveillance - In addition to the items listed in our privacy policy, in extreme criminal cases, ProtonMail may also be obligated to monitor the IP addresses which are being used to access the ProtonMail accounts which are engaged in criminal activities. And you will never be told you're being watched. So, what we have here is a provider that does not support mail clients, requires personal info to sign up while claiming otherwise, spies on you on their website, stores your e-mail metadata (and IP in certain cases) forever and immediately gives it up whenever government knocks on the door and shouts "terrorism!". Its encryption is also lacking according to researchers, and cannot be used for non-ProtonMail accounts without paying. And then - after all that - it claims to be a champion of privacy...As we can see, ProtonMail is found out to be a paper tiger when examined deeper. It does have an onion domain, but guess what - when you try to sign up through it, you are redirected to the clearnet with no indicators unless you happen to look at the address bar. This behavior is something I'd expect from a honeypot - you get lured with the added security of the onion domain, and then it's pulled away like the carrot on a stick. Avoid!"

maybe off topic: how was lavabit different from protonmail?

>>13858 Ah ah justifying yourself just made you more suspicious.

Why not just self-host something like Mailcow?

>>13889 This is copied from this article. https://privacy-watchdog.io/truth-about-protonmail/ https://archive.is/Qo4ib

>>13828 ok joey of the cia

>>14616 How reputable is this leak?

Bit naive, but consider the following: PM prices itself on providing secure and encrypted mail. Let's assume it is an effective honey pot, with some secret service actually getting intel from it. If they actually use the information against people (and there's a lot of users there), it would raise suspicion sooner or later due to either using the contents of the mails directly or being able to pinpoint related evidence way to precisely. Since outright preventing that suspicion from leaking anywhere is difficult and seeing how PM has been around for quite some time now, it is unlikely we wouldn't have heard of more solid evidence by now. Possible, yes, but in that case we can't really do anything more than apply the usual measures of caution anyway, right?

>>14908 The standard assumption for any privacy service is that if its a honeypot they are not use it to target small fish. They may funnel into some black project datacentre that just stores data but they aren't going to actually start doing arrests based on it as once the honeypot is exposed it loses all value. What any privacy service that is a honeypot will be doing however is using the data for broader projects (potentially sentiment analysis) and to target high value individuals through parallel construction. If it ever hits a court they will never say that they accessed the honeypot, they will use the evidence gathered from the honeypot to find other evidence and then get you on that if they need to. Or if you are a sufficiently big fish they will just kill you in a way that doesn't implicate the honey pot.

>>14916 True. Although pinpointing other evidence using the intel from a honeypot still risks exposure if the train of thought becomes obvious. Since PM isn't quite mainstream, people using it tend to be more adept at connecting dots like that anyway, making large-scale exploitation more risky. I'm thinking like in WW2 cracked codes were not exploited in obvious ways as to not alert the enemy. It still applies today. Yes, I did watch The Imitation Game. No, that's not where I get my information about WW2 cryptography, that movie was soycaf all over. Back to topic, yes, they are most likely not gonna use it on small fish, which can be an advantage. And even if you're in their sights, risk of exposure for them is still higher than if they were to just rummage around in GMail accounts. Not going to save you, but you can at least increase the risks and effort involved. Self-hosted may very well be worse for you, because everyone already knows that the server (and domain, if applicable) is yours. There's no honeypot to expose after all.

>>13828 Fed

The biggest red flag is they have your private key so if they want they could easily just use it to read your emails.

>>13858 >zero, zip, nada This is one of the most generic "look kids I'm one of you" phrases there are. .>Best regards. Nobody except for narcissists and feds say this in such context.

>>13858 >>13828 Feed this in the fedspeak algorithm. >>15004 Based from how that anon sounded, either they are that bald&buff type or just_a_fed type. It's still kind of unusual to see when I've seen anonspeak for years.

>>14327 >maybe off topic: how was lavabit different from protonmail? Only the storage was encrypted.

>>14957 >The biggest red flag is they have your private key so if they want they could easily just use it to read your emails. This

Here's the og copy pasta and references for those interested. I haven't read all of it, although my personal opinion on e-mail is that you should basically never assume it's secure and willing for all of your e-mails to be published.

>>15035 Isn't that valid for basically anything you put into proverbial writing (as in, voice counts too) anywhere? Although, many people have their secrets, personal or criminal alike, revealed because they couldn't keep their mouths shut. Especially when it comes to scriptkiddies or folks that deface soykaf "for da lulz", they want to get recognition for their daring exploits.

>>14273 I already don't trust proton since it had asked for a phone number when I first tried to make one. (maybe they are depending on IP blacklists, someone in the public dynamic IP pool had used it for registration so it triggered fraud detection, or someone in the pool triggered it long time ago. maybe it's my modified user agent not aligned with my "unique div" fingerprint, not gonna use vpn as it triggers suspicien by default causing the account to possibly get legally spied on for eternity). Giving up phone number is like giving up your exact location, it contains basestation location data even with a disposable SIM.

>>15027 does the 2key option does gives them your second encryption key too? it was called mailbox password iirc that goes after the account password.

in Brazil there is an attwhore on the internet called "GOEC" he commits crimes described as "terrorists" in Brazil through the internet with hoax and falseflags since 2016 and his identity has never been revealed, he uses Protonmail to make international death threats to various figures using the name of disaffected. If the CIA gets involved with Protonmail, why hasn't this guy been arrested yet? in 2017 he carried out a terrorist attack through a failure of printers and threatened to blow up several locations in the USA

>>15321 My guess is because he's a meme that doesn't actually do anything.

>>15045 There are services that let you rent a phone with crypto so it is possible to use the service anonymously. Still, Protonmail is nakedly anti-anonymity and should not be considered trustworthy in this Lain's personal opinion. >>15321 This is a common mistake in appraising the privacy or anonymity of services. US law enforcement / TLAs are perfectly capable of operating/compromising a service and ignoring criminal activity on the service. I don't know the laws in other countries, but US cops do not have a legal duty to stop criminals. Enforcement is discretionary. The fact that people are getting away with things is not interesting.

>>15325 >There are services that let you rent a phone with crypto Wait, explain more pls

>>15326 There are two types of service you're looking for. One lets you rent a device with a SIM card. The other lets you buy each activation as an individual transaction. I've used SMSprivacy but they aren't taking new accounts. I think they have scaling issues. I can't vouch for these but they look legit: crypton.sh verifywithsms.com smscodes.io There are also subreddits where you can hire a human to do things like activations for you. And you can use Reddit with Tor the last time I checked.

>israel-tied Get me the fuarrrk outta this. Well, what's another option who actually is transparent and private for Email?

>>15580 Cockmail, obviously.

What do you need an email for? Your bank/local bureaucrat/potential employer won't send PGP encrypted messages to your l33t homeserver or anything outside DNSBL cabal. I presume Protonmail in itself acts as a standalone messaging service with traffic looped onto itself which makes it even a better honeypot, like whatsapp but for net-snowflakes, has anyone actually tried sending an email to or from Protonmail to any corporate server without it immediately being rejected into spam or blackholed?

>>13828 nice attempt at obscurity, Homeland Department of Security Present Day, Present Time! AHAHAHAHAHA!

The phone version of protonvpn makes connections to api.protonvpn.ch on every startup, even when you don't start it.

>>13820 this >>13847 , SMTP/IMAP aren't exactly secure standards. If you use something like cock.li, Vincent's at least honest about how much he can actually do in the way of privacy. If you really don't want people reading the content of your email then use PGP, but then the metadata is still unencrypted. TL;DR if your threat model consists of you hiding your email then you should reconsider your threat model.

I get the feeling this is just gaslighting people into not using Proton. Maybe the CIA wants you to think this. Theyd like you to be scared of Tor and think they own it too. Its the mind game to make you think they are everywhere when they arnt. Some people are scared of using privacy apps as they think it looks suspect. I had a friend who was so ignorant and cyber-superstitious that he wouldnt even use private mode for this reason and would just get all the cookies instead. I stopped hangin out with him though as his mental health was as bad as I suspected.