Got a source for that? Proton isn’t able to access to any user emails. I believe Swiss law also makes it illegal for them to provide user information without a (Swiss) court order.
The only case I’ve heard of that was similar was when the Swiss court ordered them to provide all the info they had on a user. This was the last IP address they logged on from and a recovery email the user had entered. The recovery email is an optional thing the user had set up on their account. They also used this same email address to sign up for a Twitter account. They were able to get enough data from Twitter to identify the person.
I’m simply reporting on what I’ve been told and saw. Form what I read seem to be using asymmetric encryption and generating a private key itself protected with your password when you sign up. There’s no guarantee they don’t have an unprotected copy of that as well.
Vast majority of Proton users signed up because Proton promises your data is safe at rest. Even from them. In fact, they specifically advertise this protects them from subpoenas because they cannot provide decrypted copy of user’s data.
Of course, the only emails that are encrypted with proton are proton->proton. Mail between proton and anyone else, like say gmail, isn’t encrypted unless you pgp it separately.
Not fully correct. Mails between Proton users are E2E encrypted where Proton cannot see them, and rest of the emails are encrypted at rest once Proton receives them. Based on the audits and open source code, Proton is not keeping a copy of those emails when it receives them, and once they are encrypted, nobody but you will have access to it
You were being mislead with false information. Share appropriate sources to back up whatever you are saying. Proton has regular audits for security and encryption for all their products, which makes whatever you’ve been told pretty much false information
What’s more likely? a) I’m being mislead by someone that actually got into legal trouble that involved them and isn’t profiting in any way from it or b) You / everyone else that simply is eating their marketing and PR is being mislead in some way.
Truth is, none of us can prove their claims and auditors are true.
Yes I do, and I tried encouraged my source to make the entire thing public but no luck there. In this case the person was already identified it wasn’t much of an issue, the issue is that Proton simply provided everything to an US court without even a flinch. Apparently they can access user emails and they do without much fuzz.
That doesn’t hold up against the publicly available source code for their applications, white papers on their security and encryption, and multiple independent security reviews. And again, they are legally required to ignore US court orders. Only a Swiss court order can compel them to provide user information.
Got a source for that? Proton isn’t able to access to any user emails. I believe Swiss law also makes it illegal for them to provide user information without a (Swiss) court order.
The only case I’ve heard of that was similar was when the Swiss court ordered them to provide all the info they had on a user. This was the last IP address they logged on from and a recovery email the user had entered. The recovery email is an optional thing the user had set up on their account. They also used this same email address to sign up for a Twitter account. They were able to get enough data from Twitter to identify the person.
Courts can require you to provide your password in some circumstances. Where your email is stored is irrelevant.
In that case Proton wouldn’t be providing the data, the user would be. Proton can’t provide what they don’t have.
This wasn’t the case, at all. Proton simply handed the entire mailbox decrypted.
That seems unlikely since your data is encrypted with a password they don’t have.
I’m simply reporting on what I’ve been told and saw. Form what I read seem to be using asymmetric encryption and generating a private key itself protected with your password when you sign up. There’s no guarantee they don’t have an unprotected copy of that as well.
Vast majority of Proton users signed up because Proton promises your data is safe at rest. Even from them. In fact, they specifically advertise this protects them from subpoenas because they cannot provide decrypted copy of user’s data.
Of course, the only emails that are encrypted with proton are proton->proton. Mail between proton and anyone else, like say gmail, isn’t encrypted unless you pgp it separately.
Guess the question is if your private key is actually only yours or do they have some copy they can use somewhere.
Not fully correct. Mails between Proton users are E2E encrypted where Proton cannot see them, and rest of the emails are encrypted at rest once Proton receives them. Based on the audits and open source code, Proton is not keeping a copy of those emails when it receives them, and once they are encrypted, nobody but you will have access to it
You were being mislead with false information. Share appropriate sources to back up whatever you are saying. Proton has regular audits for security and encryption for all their products, which makes whatever you’ve been told pretty much false information
What’s more likely? a) I’m being mislead by someone that actually got into legal trouble that involved them and isn’t profiting in any way from it or b) You / everyone else that simply is eating their marketing and PR is being mislead in some way.
Truth is, none of us can prove their claims and auditors are true.
Yes I do, and I tried encouraged my source to make the entire thing public but no luck there. In this case the person was already identified it wasn’t much of an issue, the issue is that Proton simply provided everything to an US court without even a flinch. Apparently they can access user emails and they do without much fuzz.
That’s called hearsay.
That doesn’t hold up against the publicly available source code for their applications, white papers on their security and encryption, and multiple independent security reviews. And again, they are legally required to ignore US court orders. Only a Swiss court order can compel them to provide user information.
Yes, I know about all of that.
show the source mothe*****r