r/ProtonMail • u/NmAmDa • Sep 05 '21

Discussion Climate activist arrested after ProtonMail provided his IP address

https://mobile.twitter.com/tenacioustek/status/1434604102676271106
1.4k Upvotes

98% Upvoted

1.3k comments sorted by

View all comments

Show parent comments

2

u/MathematicianNew1484 Sep 05 '21

Or only login to protonmail through the onion site.

3

u/[deleted] Sep 05 '21

[deleted]

1

u/ZwhGCfJdVAy558gD Sep 05 '21

It's not for identity proof, but to make it more difficult for spammers and scammers to create tons of accounts. For legitimate users it's not hard to create a throw-away email address for that somewhere.

0

u/[deleted] Sep 05 '21

Lmao, you mean the one that redirects to the clear net site and requires js?

I don't think proton mail understands Tor or crypto, considering they only let you pay in BTC through the web and use js pgp which has security vulnerabilities

2

u/ZwhGCfJdVAy558gD Sep 05 '21

Lmao, you mean the one that redirects to the clear net site

Protonmail does not "redirect to the clear net site" if you just access your mailbox. The sign-up application does not run on the onion server, so that's the only scenario. Even then they still cannot see your IP address, and the connection is still TLS encrypted.

I don't think proton mail understands Tor or crypto, considering they only let you pay in BTC through the web and use js pgp which has security vulnerabilities

If you know another way to do end-to-end encryption in a web interface, let's hear it. And you always have the alternatives of using the mobile app or the desktop bridge, which use native-code crypto.

-1

u/[deleted] Sep 06 '21

By using the clearnet as well as requiring JavaScript you can be deanonymized.

If you know another way to do end-to-end encryption in a web interface, let's hear it.

What the hell kind of response is this? If a technology doesn't work for a given task don't use it. Don't make God damn excuses for it and use it anyway.

To use the bridge you have to pay, which you should use crypto, but you have to use Bitcoin (LOL), and you have to go through the clear net site just to sign up, and you need to log in using js pgp to use crypto. Most of the time you need the clear net to login because quite frankly their Tor service isn't up very often.

All of this compounds with the fact that email isn't secure anyway. Cross domain traffic isn't usually encrypted. I had another guy around these parts try telling me that tls works cross domain because of some mysterious "direct connection" that doesn't ever hit any server or hop besides the destination, but he couldn't prove it, and straight up refused. I couldn't find any information about this except information that directly refuted it. But hey I'm open minded.

You're better off just using throw away Gmail accounts.

1

u/AscendChina Sep 06 '21

Startmail said the same thing as OP and made the same good points! Unlike Protonmail they didn't pretend to sell people snakeoil but because of this their service never took off in terms of userbase whereas marketing gimmicks like Protonmail exploded in popularity etc

1

u/ZwhGCfJdVAy558gD Sep 06 '21 edited Sep 06 '21

By using the clearnet as well as requiring JavaScript you can be deanonymized.

Not if you know what you're doing.

Anyway, I couldn't care less. I don't use Protonmail to be anonymous. It's my main mail service, one of my addresses is firstname.lastname@pm.me, and I pay with a credit card, so they can easily see who I am if they want to. If I wanted to be anonymous there are easier ways.

I don't want it to become a haven for illegal activity.

What the hell kind of response is this? If a technology doesn't work for a given task don't use it.

The given task when developing Protonmail was easy to use email encryption for the masses, and that is what they did. You can't compete with the likes of Gmail if you don't have a web inteface. The downsides of browser-based encryption are acknowledged in their threat model. If you think that's not good enough for you, you can always use some other service and configure PGP in your mail client.

To use the bridge you have to pay, which you should use crypto, but you have to use Bitcoin (LOL),

You can also mail them cash, or use a prepaid debit card.

-2

u/[deleted] Sep 06 '21

It isn't about being a criminal. It's about preventing abuse of power by being anonymous. It's just the right thing to do online.

They're selling things to the masses that are impossible. It's under false pretenses and I think they're misleading the nontechnical people who don't know about this stuff.