Proton Mail came under scrutiny for its role in a legal request by the Spanish authorities leading to the identification and arrest of a user.
The requests were made under the guise of anti-terrorism laws, despite the primary activities of the Democratic Tsunami involving protests and roadblocks, which raises questions about the proportionality and justification of such measures.
Since Proton complied, it means there was enough there for Swiss courts to agree. All requests are subject to Switzerland laws.
So key tip here is don’t set a fuckin non friendly service as a recovery email on protonmail lmao
Well the key tip is that recovery emails are not encrypted.
Depending on what its purpose it, it likely needs to be unencrypted (or at least decryptable by the operator without the user’s key) in order to function. A recovery email likely needs to be used precisely when you don’t have your password, so it can’t work if it’s encrypted with your private key.
I suppose this isn’t necessarily obvious to a user but it’s not a flaw or fault of Proton, it’s unavoidable if a recovery email is used. Note that it’s optional to add one (see article update).
Honest question, what we should be using as of recovery email? Another Proton Mail?
Nothing that is tied to you directly at all if you genuinely care about that. Or better yet no recovery email at all that you can use. If things get lost consider the account lost.
*sigh*
Maybe I’d better start self-hosting…
If you do, make sure you are savvy enough to lock down access and your network is secure. Misconfigured networks are one of the biggest vectors for data breaches.
I’ll probably stick OpenBSD on an old laptop. The FSF have some recommended software I can try.
If I can get a few friends and family onto Gemini, I could also use Misfin.
Self hosting email is a rabbit hole I’d rather not go down. :(
They always complied with legal court orders, as all companies do. It just highlights the fundamental issue with email as a protocol.
This has nothing to do with email as a protocol. The court order discussed in the article asked for the recovery email address of an account. No actual email data was transferred.
I wonder what the authorities could use the recovery email for? Did they gain access to the Protonmail through the recovery email?
Recovery email was tied to Apple, so they asked Apple to private the data they needed. No email content was shared at any point from Proton.
Man. Apple is really terrible here.
