Em :official_verified: @Em0nM4stodon@infosec.exchange
Public

Here's the thing about Proton Mail:

With Proton Mail, the content of your email is fully end-to-end encrypted and inaccessible to service providers IF (and only if) you are communicating with another Proton Mail account, or you have set up a PGP key exchange otherwise.

The metadata of your email, however, isn't end-to-end encrypted. It is accessible in plain text to Proton. This includes:

  • Your payment information
  • The subject line of your emails
  • Your IP address(es), which can reveal your location
  • The email addresses you have communicated with
  • The time you have sent and received emails

If Proton is legally forced to provide this information to law enforcement, they will. They have to.

If your threat model makes it that it's dangerous for you when this metadata is shared, you need to use another, more private, method of communication.

My camera shoots fascists @Mikal@sfba.social
Public

@Em0nM4stodonEm :official_verified:

That's what has bugged me about this whole kerfuffle. Instead of it being a great opsec learning opportunity, it's being used as a clickbaity headline or an excuse for people to grief on Proton...for doing exactly what every other company will do if required by law.

The takeaways should be, imo:
1) what you said about assessing your threat model and using other comms channels if necessary; and
2) the fact that at least Proton (Tuta, etc.) only gives up this more restricted info and only with a court order, while Google, Microsoft, and their ilk will happily hand over *everything* they have on you just for the asking.

0
0
0

If you have a fediverse account, you can quote this note from your own instance. Search https://sfba.social/users/Mikal/statuses/116185301517623898 on your instance and quote it. (Note that quoting is not supported in Mastodon.)