Depending on what its purpose it, it likely needs to be unencrypted (or at least decryptable by the operator without the user’s key) in order to function. A recovery email likely needs to be used precisely when you don’t have your password, so it can’t work if it’s encrypted with your private key.
I suppose this isn’t necessarily obvious to a user but it’s not a flaw or fault of Proton, it’s unavoidable if a recovery email is used. Note that it’s optional to add one (see article update).
Nothing that is tied to you directly at all if you genuinely care about that. Or better yet no recovery email at all that you can use. If things get lost consider the account lost.
The requests were made under the guise of anti-terrorism laws, despite the primary activities of the Democratic Tsunami involving protests and roadblocks, which raises questions about the proportionality and justification of such measures.
If you do, make sure you are savvy enough to lock down access and your network is secure. Misconfigured networks are one of the biggest vectors for data breaches.
This has nothing to do with email as a protocol. The court order discussed in the article asked for the recovery email address of an account. No actual email data was transferred.
If they could get into the recovery email, yeah, they could get into his Proton account. Also useful just for confirming the ID of the person in question.
It’s in the article ffs. The recovery email was managed by Apple, so they made a request to Apple and obtained the users real identitiy. Once they arrest the user they can gain access to all the users accounts — unless the user had specifically guarded themselves against that possibility.
I’m aware. But some user data and metadata required for email protocol to function that can’t be encrypted is the fundamental issue. No provider can solve this issue, no matter how private and secure they are.
In this specific case, the user was a dumbass and linked another email that was tied to Apple. My point was more about email being flawed by design and a need for an alternative protocol if we want true privacy.
It’s just a general rule of thumb: privacy and security companies can work well against outside attacks but can only do so much against a government/court order, so don’t expect any of them, not even Mullvad, to go to jail for you. Encryption, anonymization and no logging are the most anyone can expect/hope for from a company, which still puts companies like Proton or even Tutanota leagues ahead of the spyware that is Gmail, Yahoo or Microsoft when it comes to email. The end user needs to do the rest themselves.
Add comment