ProtonMail - Encrypted Email

[B4its2L8]

Originally Posted by jl66

Hmmm no comments...

http://thehackernews.com/2015/11/enc...rotonmail.html

From the article: "However, even after paying the ransom amount, the crippling DDoS attacks continued to the ProtonMail service."


Boy, if you can't trust a cyber-criminal, who can you trust?

[FredOnline]

@ProtonMail on Twitter:

One of our engineers has just left Geneva, Switzerland to bring critical hardware to our datacenter to stop the attack against us.

It is a perilous 4 hour night drive into the mountains. With him go the hopes and best wishes of many.

[David]

Originally Posted by FredOnline

@ProtonMail on Twitter:

It is a perilous 4 hour night drive into the mountains. With him go the hopes and best wishes of many.

It sounds like the beginning of a good thriller!

[Tsunami]

Is it correct that this service has no inactivity limit, as Wikipedia suggests? I'm Always a bit wary to just believe Wikipedia ...


I find it very odd that a company would pay to stop such attack. I realise that filing a complaint isn't going to scare off people committing illegal activities, but to just give in to it and pay is like rewarding and encouraging such attacks ... Very odd.

[FredOnline]

@ProtonMail on Twitter:

At 3AM today, after 3 days of hard work, we beat the attackers who tried to deny us our human right to privacy. We thank all who helped us.

[Tsunami]

Maybe an odd question, but isn't it quite strange that a service that opposes data mining of any kind uses Twitter? Twitter registers not your (constantly changing) IP address and the URLs you visited, they register your device number which is a fixed number unique to your computer or smartphone... See also this topic

[popowich]

Originally Posted by Tsunami

Is it correct that this service has no inactivity limit, as Wikipedia suggests? I'm Always a bit wary to just believe Wikipedia ....

The published inactivity limit on their web site was 3 months.

It's hard to reach their site at times to verify right now. It was previously tracked here at compare | encrypted email service providers

[pjwalsh]

Inside the ProtonMail siege: How two small companies fought off one of Europe's largest DDoS attacks
TechRepublic, Nov 13

[Just Bill]

Protonmail paid off thugs to stop a DDoS attack. I have no use for them.

[libCognition]

Originally Posted by pjwalsh

Inside the ProtonMail siege: How two small companies fought off one of Europe's largest DDoS attacks
TechRepublic, Nov 13

That article says protonmail initially refused the ransom, and then eventually paid. But this was an escalating ransom, so it seems the ransom paid was not the demanded amount. Some articles said 15 btc, but this article said 20 btc, which increased by 20 btc/day.

If they only paid the ransom of the first day on day 3 or 4 or whatever, of course the attack would be expected to continue.

[FredOnline]

https://protonmail.com/blog/ddos-protection-guide/

[B4its2L8]

Originally Posted by FredOnline

https://protonmail.com/blog/ddos-protection-guide/

Trying to check this at about 5:20 eastern US time and Protonmail is down -- and not just for me.

[FredOnline]

Originally Posted by B4its2L8

Trying to check this at about 5:20 eastern US time and Protonmail is down -- and not just for me.

Just taken from @ProtonMail on Twitter:

We can confirm the intermittent network outages earlier were due to a large DDoS. Attackers likely hitting us due to our earlier blog post.

[pjwalsh]

Impact of Swiss surveillance laws on secure email
ProtonMail Blog, Dec 16

In September of this year, the Swiss Parliament passed a new Swiss surveillance law, known as the Nachrichtendienstgesetz (NDG) in German and la Loi sur le renseignement (LRens) en française.

This did not come as a total surprise because the Swiss surveillance law has been debated for quite some time, and mirrors similar efforts which are ongoing in other countries such as Germany, France, the UK, and the US. Unfortunately, due to the tragic events in Paris, efforts to curtail privacy have attracted political support even though it is clear that banning encryption won’t prevent terrorism.

As the world’s largest secure email service, we are following the discussions in Switzerland closely and we have gone over law with legal experts to understand the implications for ProtonMail. The Swiss surveillance law is similar to the one which was recently approved in Germany. However, there are some differences. The Swiss version requires sign off by a judge and needs to go through two levels of judiciary for approval. The Swiss also don’t have a history of cooperating with the US, unlike German intelligence.

After careful analysis, we can conclude that the new Swiss surveillance law will not significantly impact the environment for secure email services in Switzerland, and in particular will not affect ProtonMail. There are a couple reasons for this.

First, the new law only allows Swiss intelligence to conduct more surveillance. Given Switzerland’s neutrality, Swiss intelligence is mostly concerned with domestic threats and does not have an interest in the data of the 95% of ProtonMail users who are not from Switzerland. While the new law might open the door for Swiss intelligence, it certainly doesn’t open it for the NSA or other foreign intelligence agencies.

Second, there is a distinction between handing over the data we already have (which is end-to-end encrypted), and being forced to actively hack users. The new laws could compel us to hand over data that we have, but they definitely CANNOT force companies to hack their users.

Third, while it seems bad that these new laws can force ProtonMail to hand over encrypted user data, this doesn’t actually change anything. Any company (ProtonMail included), can already be asked to hand over user data provided there is a VALID Swiss court order. The new law doesn’t change this. What it does is provides Swiss intelligence another avenue to get data. Instead of having to bring a case through the courts first, they can now directly request through the judiciary. This of course applies only to Swiss intelligence, foreign intelligence agencies will still need to go through the courts.

Fourth, since ProtonMail emails are encrypted using PGP (which provides end-to-end encryption), any emails that we do hand over would be encrypted, and only the owner of the emails will have the ability to decrypt them. This means the new Swiss surveillance laws actually strengthen instead of weaken ProtonMail’s use case. If Swiss intelligence has easier access to confidential personal data under the new laws, it becomes even more important to encrypt this data, which is exactly what ProtonMail does.

For the non-Swiss ProtonMail users, it is safe to say that these laws have little to no impact. As for Swiss users, unfortunately the privacy environment in our country has gotten worse which increases the need for secure email services like ProtonMail. Even though the new Swiss surveillance law does not fundamentally harm ProtonMail’s usage case (it in fact arguably improves it), we are consistent in our stance of opposing government invasion of personal privacy. For this reason, we are supporting the referendum effort to overturn these laws, and we encourage all Swiss ProtonMail users to also study the laws and sign the referendum. More information about the referendum can be found in our blog post here [fr].

If you are interested in better protecting your email privacy, it is possible to get a ProtonMail account here: https://protonmail.com/invite

Best Regards,
The ProtonMail Team

[pjwalsh]

Another ProtonMail blog post.

CISA Surveillance Law has passed, here’s what we can do
Dec 21