Why isn’t that incident enough for everyone to drop them?
There is no public email service provider -as far as I know- that would refuse a court order to share such information. In the case of Proton any foreign authority wanting such needs to convince Swiss authorities that their request is legitimate.
Ultimately if you register an account with false credentials & never pay for pro, then the only thing proton can give to Swiss authorities is maybe your IP address, which will be your VPN if you have one. If you pay then payment credentials could be used to identify you.
All the emails stored on proton’s servers are non-recoverable, same as with Tuta.
It sucks that paying for pro reduces your privacy, but this applies to other email providers as well. This is actually what happened in the Atlanta case & there is no real defense against it. Using your personal credit card creates a trail.
Can you imagine a world where you can order physical cards for email credit? (and they would have randomized codes to avoid this exact problem)
Did he make a post defending the asterisk “privacy first” should have in their marketing?
Private email is a bit of an oxymoron, the best anyone can do is to store your own email history in an unrecoverable way, which proton is doing, but their marketing team is not really transparent about what “private email” really is & what that means to users.
They sell their service as privacy-first across a suite of tools, but they don’t explicitly define the limitations. Now that I’m looking they lean in on the whole Swiss thing being a reason their privacy is so private. So if anything they are advertising that the Swiss government is hard to convince to share information with foreign authorities (they weren’t).
This is exactly the kind of bullshit marketing that I’m getting at. Proton AG could be upfront the limitations of that privacy, or how an account should be created to be compatible with the expectation they are creating, or disclose when they’re being asked for information, by whom, or a whole raft of choices. They could choose to be loud about it all, but they are only loud about the marketing and silent on their compliance activity.
As an aside I’m also wary of these goofy org structures of non-profit owned by for-profit companies. It’s the same kind of assumptions-based marketing at play where non-profit sounds nicer than big evil money hungry corpo. But it’s actually just a way to shelter money from tax, or access the Swiss Finance system in a way that enables the company to hide they want to hide.
you could pay tuta in cash AFAIK.
this makes it basically impossible to recover a trail from the mail. just FYI.
(neglecting forensic madness on fingerprint analysis of the bills and letter you handed in.)
Though Proton is a subscription service. Then again, probably with some clever tricks it’s possible to devise a renewing subscription that is not storing the payment credentials in such a way that the company could not extract it. The more I think about this, the more i’d like to know what Swiss law really allows for. (chatGPT thinks you’re right & my argument is on very weak grounds)
There is no public email service provider -as far as I know- that would refuse a court order to share such information. In the case of Proton any foreign authority wanting such needs to convince Swiss authorities that their request is legitimate.
Ultimately if you register an account with false credentials & never pay for pro, then the only thing proton can give to Swiss authorities is maybe your IP address, which will be your VPN if you have one. If you pay then payment credentials could be used to identify you.
All the emails stored on proton’s servers are non-recoverable, same as with Tuta.
It sucks that paying for pro reduces your privacy, but this applies to other email providers as well. This is actually what happened in the Atlanta case & there is no real defense against it. Using your personal credit card creates a trail.
Can you imagine a world where you can order physical cards for email credit? (and they would have randomized codes to avoid this exact problem)
Private email is a bit of an oxymoron, the best anyone can do is to store your own email history in an unrecoverable way, which proton is doing, but their marketing team is not really transparent about what “private email” really is & what that means to users.
They sell their service as privacy-first across a suite of tools, but they don’t explicitly define the limitations. Now that I’m looking they lean in on the whole Swiss thing being a reason their privacy is so private. So if anything they are advertising that the Swiss government is hard to convince to share information with foreign authorities (they weren’t).
This is exactly the kind of bullshit marketing that I’m getting at. Proton AG could be upfront the limitations of that privacy, or how an account should be created to be compatible with the expectation they are creating, or disclose when they’re being asked for information, by whom, or a whole raft of choices. They could choose to be loud about it all, but they are only loud about the marketing and silent on their compliance activity.
As an aside I’m also wary of these goofy org structures of non-profit owned by for-profit companies. It’s the same kind of assumptions-based marketing at play where non-profit sounds nicer than big evil money hungry corpo. But it’s actually just a way to shelter money from tax, or access the Swiss Finance system in a way that enables the company to hide they want to hide.
you could pay tuta in cash AFAIK. this makes it basically impossible to recover a trail from the mail. just FYI. (neglecting forensic madness on fingerprint analysis of the bills and letter you handed in.)
Alright, so Tuta has gift cards, that’s wicked cool. TIL
But at the end of the day secure mail is still not a real thing for most people.
right I just checked they do gift cards now.
I think I was mistaken, posteo accepts cash payment: https://posteo.de/en/payment
yes living in this dystopia one must say that most people do not have a specific threat model. but i get your point.
I meant that encrypted email is not very useful if none of your mailing partners are using a compatible service. (that is the case with me)
How did I miss this???
AFAIK Signal cannot couple payments with users. Why can’t email do the same?
Honestly I’m not entire sure, i’m not a lawyer.
Though Proton is a subscription service. Then again, probably with some clever tricks it’s possible to devise a renewing subscription that is not storing the payment credentials in such a way that the company could not extract it. The more I think about this, the more i’d like to know what Swiss law really allows for. (chatGPT thinks you’re right & my argument is on very weak grounds)