If you pay Proton Mail for a service, they may hand over the payment data in response to a court order: https://www.404media.co/proton-mail-helped-fbi-unmask-anonymous-stop-cop-city-protestor/

[waffles@masto.yttrx.com]

@caitp @evacide I run my own mail server and spammers have made deliverability impossible for lil guys like me.

I run my own server out of Germany, but I also have to text all of my friends to check their spam folders whenever I email them 🥲🥲🥲

[dozymoe@mastodon.social]

@evacide aren't their servers based in Switzerland

[chiraag@mastodon.online]

@private_brewing @evacide I guess? It's definitely nontrivial because they have to deal with recurring payments (so they need _some_ way to charge the card even if someone isn't logged in, since paid accounts are not subject to auto-deletion).

The rhetoric around this has been pretty shitty too because *of course* Proton is going to comply by sharing whatever little info they have if ordered by a Swiss court - they make that exceptionally clear.

[chiraag@mastodon.online]

@private_brewing @evacide And like, most alternatives would do *exactly* the same thing when ordered by courts in their jurisdiction. Other than Tutanota and perhaps a few others, most have access to *more* information, and some of the big ones *proactively* share information.

The fact that some people have the gall to sit here saying that Proton, a company, should refuse to share info after being ordered by a Swiss court is ludicrous.

[chiraag@mastodon.online]

@private_brewing @evacide And I agree with you that the best option perhaps would be designing a payments system that allows all of their usecases without storing payment tokens or whatever in "plaintext" (meaning accessible to the company). Given the care they put into literally every single one of their products, I find it hard to believe that they would not have implemented this if it were trivial.

[gruff@stroud.social]

@evacide
I don't know why people are so surprised by this. Few people bother to read it but Proton do spell out about data disclosure and law enforcement in their privacy agreements etc.

https://proton.me/legal/privacy

[johnlogic@sfba.social]

@evacide

@protonprivacy would you please comment on this?

[nbailey@mstdn.ca]

@evacide I’m no fan of ProtonMail, or its trumpy ceo “andy88”, but I don’t think they should be expected to put themselves in legal danger for the sake of their customers. Maybe their marketing should make that clear, but no sane person should expect a for-profit company to go to jail for you.

The law is wrong here, as it usually is with stuff like this. But they have to obey one way or another.

[awws@mastodon.social]

@evacide I get Proton had little choice here complying with a legal Swiss court order and recording the data… my big question here is why the Swiss authorities complied with the FBI request on what looks like a (not across the details) legit protest group?

Surely the fault here is at the feet of the Swiss government for cooperating with the FBI request?

Sorry… much as I am not a big fan of Proton, this looks like they direct they were forced to, legally and only after court order.

[choomba@social.tchncs.de]

@schroedingerspossum @maya_b @cliffle This is exactly it. It's bad opsec to leave data your provider can hand over. Any company must and will comply with local law. It's your responsibility to not leave a paper trail. Proton, like a few other service providers like Mullvad, offers cash payments via mail. If you don't use that or stick to a free plan, that's on you.

[de_treias@livellosegreto.it]

@caitp @evacide it is not a solution because you have to pay someone to deploy your own server, such as the internet provider, or the VPS provider. The solution could be to pay corporations without a tracked method, if available.

[nohillside@smnn.ch]

@rashunda @evacide *Any* Swiss company will comply with a court order (as will other companies in other countries).

[chewie@mammut.gogreenit.net]

@nbailey @evacide maybe, but some people do the right thing.
Without Ladar Levison, we may not have had the Snowden files: https://www.theguardian.com/commentisfree/2014/may/20/why-did-lavabit-shut-down-snowden-email

This also vindicates why @Linux does not include them on his "outside US Jurisdiction" alternatives when people keep asking him why they aren't listed: https://codeberg.org/Linux-Is-Best/Outside_US_Jurisdiction/src/branch/main/Privacy_Focused_Email.md

[tragivictoria@mastodon.catgirl.cloud]

@evacide@hachyderm.io what’s the full article? Because I am certainly not gonna make an account just to read this

[mkljczk@pl.fediverse.pl]

@tragivictoria @evacide that’s what an AI crawler would say

[tragivictoria@mastodon.catgirl.cloud]

@chiraag@mastodon.online @evacide@hachyderm.io Idk, to get shut down? People are pretending as if Tuta or Mailbox or other email provider would be different here.

[tragivictoria@mastodon.catgirl.cloud]

@mkljczk@fediverse.pl @evacide@hachyderm.io You’re absolutely right — you got me!

[kdelta@ieji.de]

@evacide @Tekchip Oh how petty that is. I think someone blocked me 🤭

[riverpunk@defcon.social]

@tragivictoria @evacide I will say that 404Media retains basically no info on you. They ask a name (you can lie if you want) and an email (if you're able, you can use a forward address to obscure your actual email). They don't save passwords, they just email a temp login code. And if you don't wanna risk being tracked across the site or the web, you can clear your site cookies afterwards to logout.

Still totally valid not to make the account, but i recently bit the bullet and did it, I was surprised how little info they accepted that might accidentally get leaked.

[tragivictoria@mastodon.catgirl.cloud]

@riverpunk@defcon.social @evacide@hachyderm.io so if they accept little to no info, why they require it in the first place?