Hacker News new | past | comments | ask | show | jobs | submit login

Are you claiming ProtonMail hands over message content to law enforcement? That contradicts this quote from the post:

>Furthermore, ProtonMail’s end-to-end encryption means we cannot be forced by a court to provide unencrypted message contents.




OP is in the wrong about message contents. Message contents were never compromised to my knowledge. The issue was specifically metadata like login times and IP addresses. Also possibly mail server logs, such as that a user sent a message to a Gmail account, although I'm not 100% certain on that last point. Once again, when using the proper settings in ProtonMail, the message contents cannot be retrieved without a brute force attack thanks to end-to-end encryption.


I think the real meat of the question is the extent to which they cooperate with law enforcement. Do they respond to requests to extract keys from the client? Or used compromised keys for select users? If the government orders them to build such a mechanism to their client then encryption doesn't help. Even things like tracking the dates that messages are sent and received can make users vulnerable to correlation attacks.

I stand by the claim that the only truly secure mail is to do your own encryption and decryption client-side with open source tools. Anything done by a 3rd party service should be assumed to be compromised.


If the government could force them to extract keys from clients, to utilize compromise keys, or build a mechanism into a silent update, what makes you think and other company would have a different choice? Wouldn't such a government pose the same threat to any email provider?


> what makes you think and other company would have a different choice?

A company that operates in a country where the government is legally forbidden from doing such things would be more resilient to attack through the judicial or law enforcement system. Granted, there's always the suspicion that surveillance maybe be conducted extra-judicially, but it's still better. I don't know of any such countries. I think the Apple v. FBI case was going to set precedence in this matter, but that never went to trial.


Nothing prevents you from attempting your own client side security.

This is in no way related to the issue at hand.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: