this post was submitted on 06 Aug 2023
163 points (94.5% liked)
Privacy
29883 readers
798 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 4 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Well they changed the IP logging policy of protonmail on a dime, so who's to say that they won't change their VPN's policy? They just don't have as good of a track record as people seem to think around here.
Of course it's dissapointing that protonmail did this, although i wouldn't say that the policy was changed "on a dime", as it said that ip logging was not "on by default"^[1]^. But while dissapointing, i can imagine courts pressuring Proton to start ip logging since it's easier rather than, say, change the entire backend to not encrypt the emails anymore. But to be fair i would say that if your threat model might include the government somehow, you should probably not trust any service with sensitive details like your ip. But as protonmail does what it sets out to do (encrypt your emails + some more) and as there aren't too many alternatives exept maybe tutanota, i think i'll stick with it. As for the VPN, it's open source^[2]^^[3]^^[4]^ (atleast the clients, I don't know about the server), but as I don't know how to audit code, take that with a grain of salt. And it does semi-regular(?) audits, although the last ones seem to be from 2019(?)^[3]^ and a penetration test (or maybe it was an audit, doesnt seem like it though) from 2021^[5]^^[6]^. But they said that they're planning an audit in the next months. ^[7]^.
Sources: ^[1]^https://arstechnica.com/information-technology/2021/09/privacy-focused-protonmail-provided-a-users-ip-address-to-authorities/
^[2]^https://github.com/ProtonVPN
^[3]^https://protonvpn.com/blog/open-source/
^[4]^https://itsfoss.com/protonvpn-open-source/
^[5]^https://drive.proton.me/urls/XWPWPN079G#KSgiJSoTkysU
^[6]^https://proton.me/community/open-source
^[7]^https://www.reddit.com/r/ProtonVPN/comments/14kvy1e/comment/jsh0l7u/?utm_source=share&utm_medium=mweb3x&utm_name=mweb3xcss&utm_term=1&utm_content=share_button
Additional sources: https://proton.me/blog/security-audit-all-proton-apps
Please tell me if i got something wrong, i'd be happy to fix any issues
Edit: formatting issues and added back the start and the end that was removed
But the point is what Swiss law is. They cannot be compelled by a court order to log data for their VPN service, but they can be compelled by a court order to log email accesses. This needs to be considered by users of Proton, and indeed it is a bad mark against them that this wasn't clear upfront before the French activist case.
I'm not saying all this to defend Proton, really. I don't even use their service anymore, but I did use the vpn for 3 years without incident.