Protonmail now keeps IP Logs (opens in new tab)

(schneier.com)

46 pointslorenz_li4y ago15 comments

15 comments

My understanding is that they will log you under specific law enforcement request. It’s very different from saying they automatically log everyone.

smorgusofborg4y ago

In the discussion of their fulfilling the request, the data they provided was described as the IP during account creation. If that was accurate then it is a neat trick that law enforcement knew which accounts would eventually be of interest.

lindenstark4y ago

I dmed Andy Yen and he assured me they only start logging after requests, can you link me to your source?

1 more reply

temp89644y ago

If that's the case then my understanding of the event is wrong.

newsbinator4y ago

Not really different, since it's binary.

The message used to be "we don't keep IP logs" and now it's the opposite.

lindenstark4y ago

Not the opposite more a middleground "we don't keep IP logs unless (uncommonly) forced by law enforcement".

1 more reply

0xdeadb00f4y ago

Or... they always have, and now they're just being honest about it.

I'd be willing to bet 99% of services that say they don't log your IP, actually log your IP in some form. You're telling me all these companies just discard webserver logs? No chance.

idsout4y ago

It would be nice if we lived in a world where the Protonmails could not be compelled by law to keep IP logs for when their service is accessed by specific users, but at least they can not reveal the content of those specific users' email.

mountainriver4y ago

What are some good alternatives?

1MachineElf4y ago

None for email, unless you roll your own[0][1][2][3][4].

[0] https://github.com/foxcpp/maddy

[1] https://github.com/LukeSmithxyz/emailwiz

[2] https://github.com/iredmail/iRedMail

[3] https://github.com/Mailu/Mailu

[4] https://github.com/docker-mailserver/docker-mailserver

peakaboo4y ago

https://fediverse.party/

Peer to peer services with encrypted communications are impossible to centrally control and monitor.

0xdeadb00f4y ago

AFAIK none of those are "encrypted" outside of TLS and disk encryption (that is, if your instance uses encryption at rest, which it might not).

Regardless, they are not suitable replacements for email.

dewey4y ago

Don't do things that get you into trouble over email or use Tor / VPN.

reginold4y ago

I dislike all the Protonmail stuff but he's wrong. It's weird to see a popular name get it wrong about something I know a fair bit about. Afaik he's trustworthy so wtf is this.

j / k navigate · click thread line to collapse

15 comments

temp89644y ago

My understanding is that they will log you under specific law enforcement request. It’s very different from saying they automatically log everyone.

smorgusofborg4y ago

lindenstark4y ago

I dmed Andy Yen and he assured me they only start logging after requests, can you link me to your source?

1 more reply

temp89644y ago

If that's the case then my understanding of the event is wrong.

newsbinator4y ago

Not really different, since it's binary.

The message used to be "we don't keep IP logs" and now it's the opposite.

lindenstark4y ago

Not the opposite more a middleground "we don't keep IP logs unless (uncommonly) forced by law enforcement".

1 more reply

0xdeadb00f4y ago

Or... they always have, and now they're just being honest about it.

I'd be willing to bet 99% of services that say they don't log your IP, actually log your IP in some form. You're telling me all these companies just discard webserver logs? No chance.

idsout4y ago

mountainriver4y ago

What are some good alternatives?

1MachineElf4y ago

None for email, unless you roll your own[0][1][2][3][4].

[0] https://github.com/foxcpp/maddy

[1] https://github.com/LukeSmithxyz/emailwiz

[2] https://github.com/iredmail/iRedMail

[3] https://github.com/Mailu/Mailu

[4] https://github.com/docker-mailserver/docker-mailserver

peakaboo4y ago

https://fediverse.party/

Peer to peer services with encrypted communications are impossible to centrally control and monitor.

0xdeadb00f4y ago

AFAIK none of those are "encrypted" outside of TLS and disk encryption (that is, if your instance uses encryption at rest, which it might not).

Regardless, they are not suitable replacements for email.

dewey4y ago

Don't do things that get you into trouble over email or use Tor / VPN.

reginold4y ago

I dislike all the Protonmail stuff but he's wrong. It's weird to see a popular name get it wrong about something I know a fair bit about. Afaik he's trustworthy so wtf is this.

j / k navigate · click thread line to collapse