Proton AG of ProtonMail can provide FBI with your account recovery email

https://fxtwitter.com/monetaryreset/status/1691446834655535105

by CHEF-KOCH • 2 years ago

91 91 2 years ago

andersa• 2 years ago

Of course they can, why is this news? If you intend to use it anonymously why would you set a recovery email to something that identifies you?

dgellow• 2 years ago

It’s “news” because someone wanted to share it.

codetrotter• 2 years ago

Even the guy that ran Silk Road messed up and provided his email address with his real name online while posting about Silk Road before almost anyone had heard about Silk Road. This would later come back to bite him.

In that post, altoid asked for some programming help and gave his email address: rossulbricht@gmail.com. Doing a Google search for Ross Ulbricht, Mr. Alford found a young man from Texas who, just like Dread Pirate Roberts, admired the free-market economist Ludwig von Mises and the libertarian politician Ron Paul — the first of many striking parallels Mr. Alford discovered that weekend.

https://www.nytimes.com/2015/12/27/business/dealbook/the-uns...

I don’t doubt for a second that a non-zero number of people similarly create a ProtonMail address for something shady and then provide a Gmail address using their real name as recovery address.

blactuary• 2 years ago

Also, most recent tweet from that account blaming a Boeing jet hardware failure on diversity initiatives

https://twitter.com/monetaryreset/status/1766156285249012151

throw089672• 2 years ago

I'm currently a paying Proton customer. I'm dreaming of the day when I can cancel my subscription, to be honest.

I've been a customer for a few years now. Long enough to watch the company steadily scope creep in ways I don't agree with. I wasn't 100% against the VPN idea. But then came Drive. And calendar. And ...

Thing is, their core Mail product kinda sucks. End to end encryption is great, but have you ever actually tried to search for emails in Proton Mail? It's embarrassingly bad. I've lost count of the number of times I know exactly what I'm looking for in my mail archives, but no matter what search incantations I try, I can't find it.

Their bridge clients are stupid. The way threaded replies are handled are stupid. Their web UI is frustratingly laggy in Firefox. I didn't particularly like their iOS app, and now that I'm on Android, I don't particularly like their Android app, either.

For me, the next step is to self host my email. Yes yes, I know: "but self hosting your email is notoriously hard and bla bla bla!". Yes, no doubt. But email is important, and I've been burned by GMail, appalled by Fastmail spying for the Aussie govt (god, what a shitshow that was/is), and suffered constant disappointment as a Proton customer. Self hosting feels like the only option left.

staunton• 2 years ago

Self hosting by itself is easy. The hard part is not getting all your sent emails marked as spam. It's not really a technical problem.

ChrisMarshallNY• 2 years ago

I won't self-host, but even hosted mail can easily be spam-canned.

I have found success, using SPF and DKIM signing. I had to do that, to get emails from my current app, through Apple's anonymizer.

layer87• 2 years ago

It’s not a particularly hard problem, since it can be solved by using a smarthost.

pelasaco• 2 years ago

can you get the email search solved easily than having it on protonmail?

gtirloni• 2 years ago

I tried ProtonMail for a few months and gave up. It was indeed too slow for my usage.

rad_gruchalski• 2 years ago

I'm dreaming of the day when I can cancel my subscription

Are they holding you hostage? Is there a contractual obligation preventing you from cancelling? Why can’t you just cancel it if it sucks?

lycos• 2 years ago

Meanwhile everybody you exchange e-mails with doesn't care about any of this and unless using E2EE all your email contents will be known by their e-mail providers anyway.

franky47• 2 years ago

End to end encryption is great, but have you ever actually tried to search

I've implemented a few e2ee apps, both for myself and clients, and every single time this comes up, along with other business metrics / queries.

If the encryption model ensures the server cannot process the data in any way, it means everything has to be done locally by clients, and only on their own data.

Also, bye bye BI.

richardfey• 2 years ago

Tried to register some months ago and they blocked me, support was giving a cold "we cannot tell why we are blocking you". It turns out their system gives a high score to self hosted email, since everything works if you use something like gmail.

protonmail10• 2 years ago

This doesn't sound right. Our anti-abuse systems don't discriminate against self-hosted email by default. You can find the possible reasons for account suspension here: https://proton.me/legal/terms. You're also welcome to share your support ticket number with us here so we can track it internally.

r721• 2 years ago

Source article: https://www.forbes.com/sites/thomasbrewster/2023/08/08/proto... (Aug 2023)

protonmail10• 2 years ago

The article doesn't link the original court filing or discuss what actually happened, and from the title alone, is rather misleading.

The actual warrant can be found here and has the important missing details: https://drive.proton.me/urls/57QC5F26BW#nseYl6ICaQHm

The only data we could provide (in response to a binding Swiss legal order), was the user's recovery email address, which the user added himself, and is optional to begin with.

Unfortunately, said user also used that recovery address to create a Twitter account, and Twitter turned over his phone number and IP address.

Coincidentally, this case again proves that Proton Mail's encryption cannot be bypassed by law enforcement.

henriquez• 2 years ago

No shit, Sherlock.

nrthRockHopper• 2 years ago

And they REALLY pester you to set one. They are not looking out for the user that's for sure.

dewey• 2 years ago

99% of users would be angry if they can’t restore their account because they forgot they credentials. A very small amount who needs the “privacy” knows that they shouldn’t set a non anonymous recovery email.

ivan_gammel4• 2 years ago

Providing recovery methods is certainly care about the users. Proton isn’t the weakest point in the privacy defenses: user stupidity is. If you make FBI or DHS your enemy, you’d better think about your attack surface and don’t assume there exists something or someone who will secure your communications for you.

hallway_monitor• 2 years ago

This comment feels like it's coming from communist Russia. You'd better not make the KGB your enemy. Be careful not to do anything they would take an interest in, even if it's not illegal. Is that the USA we're living in? Sure feels like it sometimes.

huimang• 2 years ago

Well yes, because the odds that the average user will need recovery for their account at some point are pretty likely. Email being as important as it is for identification, the last thing you want is to be locked out because of some extremely improbable situation involving the FBI.

lapcat• 2 years ago

The "average" user is on Gmail, not ProtonMail. The service is specifically for non-average users who want to maximize privacy.

protonmail10• 2 years ago

For most users, losing a password is a major risk -- the most common request our support team receives on a daily basis is by far from users who lost their passwords. This is why we try to make sure users input some sort of recovery method. It doesn't need to be a recovery email address, or a phone number, you can also use a recovery phrase: https://proton.me/support/reset-password#how-to-reset-your-p...

drooopy• 2 years ago

Proton is a company not some charity and their services and what you do with them are hosted literally on someone else's computers that are outside of your control. They will comply with requests made by law encorcement if that's what they are forced to do, full stop.

illiac7866• 2 years ago

Proton Mail is a zero knowledge service and the whole point of zero knowledge is to protect yourself against court orders.

Hence I think it's pretty clear for ZK customers that a company has to abide to the local law...

The article is about what Proton knows, not what they will or will not do if the law knocks on their door.

chinathrow• 2 years ago

If they allow you to give them knowledge about you, then they're not zero knowledge, at all.

jeffbee2• 2 years ago

If an entity exists for the purpose of subverting the exercise of legitimate government powers then the government in question should just bomb it flat. Tolerance would be dereliction of duty.

Of course, Proton is not such an entity, but they are happy that you have fooled yourself into paying for this imaginary property.

layer87• 2 years ago

This may actually be a good point. Instead of storing your recovery address, they could only store a hash of it, and require an email to be sent from the recovery address to initiate the recovery process. Still not completely zero-knowledge, but an improvement.

takerjop• 2 years ago

A google search will show Proton had cooperated before and given info leading to user arrest. THEY WILL 100% do it....sorry they did already. So it is greater than 100% from now onwards.

nwhnwh• 2 years ago

Proton Saga

janmo• 2 years ago

A few years ago they already shared the IP Address of a user with law enforcement https://www.pcmag.com/news/protonmail-explains-why-it-shared...

webstrand2• 2 years ago

This feels like a post promoting FUD.

arvindkumarc5• 2 years ago

There was a bomb threat email sent by one of the proton mail users to South Indian state’s TN, some weeks ago. There was a big turmoil in 4-5 different schools in the city. Until the time they realised it to be a fake threat it was a nightmare. Some of my relatives were directly affected. What’s the privacy crap we talk here?

tjpnz2• 2 years ago

The authorities still have a choice in how they respond to it.

arvindkumarc5• 2 years ago

The problem is still not supported by proton and team.

cobbzilla• 2 years ago

Bad people can phone in anonymous threats. or send postal mail. This is not a new problem, no need to drop privacy rights.

arvindkumarc5• 2 years ago

You can always trace the numbers and postal mails in this age.

irusensei• 2 years ago

Come on guys. If you are sending stuff that cannot be seen for some reason (potentially illegal on your (potentially) authoritarian (and this includes the US) country) do not use e-mail. It’s a protocol from decades ago when the web was gentle and naive. For SMTP to work lots of stuff must be readable by the MTAs handling the message. It is also highly centralized nowadays because it essentially works on a whitelist of what the big providers allow. Just give up.

overstay89305• 2 years ago

This is why Apple didn't bother to implement E2EE for iCloud Mail, Calendar, and Contacts for Advanced Data Protection. It was just never meant for privacy, and any implementation would just have backdoors everywhere.

sph• 2 years ago

Make two Protonmail accounts, and use the other as recovery email address. Let the spooks figure that one out.

jeffbee2• 2 years ago

People who think this is interesting news always turn out to have Twitter accounts completely full of batshit content. We live in a society. The state exists and has powers legitimized by the consent of the governed. Grow up and get over it.

overstay89305• 2 years ago

People are surprised by this because Proton does the best it can to hide what information they actually have that isn't E2EE. Especially if you want to use it as a regular email service as a form of "privacy" (just read https://proton.me/mail/security if you want to see how misleading they're trying to be. "Strong encryption at all times" *except when there isn't).

They need a page like this to explain what exactly is E2EE and what isn't: https://support.apple.com/en-us/102651

lolinder3• 2 years ago

Sorry, but what exactly is misleading on that page? Over and over again it says that the content of your email is encrypted. It's very specific about that, and it's hard to see how someone would misinterpret that to include the account recovery email address.

Is that claim itself not accurate?

overstay89305• 2 years ago

"We cannot read or give anyone else access to your emails." is completely false, Proton can read emails sent or received from non-proton infrastructure. They have to.

I mean just look at the end-to-end encryption block, it's such an obvious dark pattern to make people believe they're getting end to end encryption, but when you actually read it they don't claim it at all, but how is someone who doesn't understand technobabble supposed to know that? They're just trying to pretend it's the same thing.

If Proton was an American company they would have been fined into the ground for this stunt. Google wasn't even safe from the Incognito mode lawsuit.

protonmail10• 2 years ago

We already do have such a page: https://proton.me/support/proton-mail-encryption-explained. Additionally, our Threat model has been publicly available since the service came into being in 2014: https://proton.me/blog/protonmail-threat-model

overstay89305• 2 years ago

A blog post from 2014 is a hilariously bad way to claim you aren’t blatantly lying in your marketing.

peter_d_sherman• 2 years ago

Transparency report pages for a few selected online email / social media platforms:

Apple (iCloud, Mail, etc.): https://www.apple.com/legal/transparency/

Facebook / Meta (Instagram, etc.): https://transparency.fb.com/reports/

Google (Gmail, Google Voice, Search, etc.): https://transparencyreport.google.com/user-data/overview

Microsoft (Skype, Outlook 360, LinkedIn, etc.): https://www.microsoft.com/en-au/digitalsafety/transparency-r...

Proton: https://proton.me/legal/transparency

TikTok: https://www.tiktok.com/transparency/en/reports/

Twitter / X: https://transparency.x.com/en.html

synicalx3• 2 years ago

A simple-ish workaround here if you want to use email recovery;

1. Use a custom domain for your emails with Proton

2. Set an address @ that domain as the recovery address

3. If you need to recover, simply update your MX records to point elsewhere, and begin the recovery process from another provider temporarily.

protonmail10• 2 years ago

Regarding the case in question, you can find the actual warrant here, to understand what exactly happened: https://drive.proton.me/urls/57QC5F26BW#nseYl6ICaQHm

The only data we could provide (in response to a binding Swiss legal order), was the user's recovery email address, which the user added himself, and is optional to begin with.

Unfortunately, the said user also used that same recovery address to create a Twitter account, and Twitter turned over his phone number and IP address.

Coincidentally, this case again proves that Proton Mail's encryption cannot be bypassed by law enforcement.

Proton AG of ProtonMail can provide FBI with your account recovery email

Related Stories