Upon receiving the recovery email from Proton Mail, Spanish authorities further requested Apple to provide additional details linked to that email, leading to the identification of the individual. PSA: Email providers HAVE to respond to lawful requests or shut their service down. 2 options. That's it. This is a case of bad OPSEC. They did NOT give LE the guys password or PGP key. They contacted Apple (I assume he had an icloud email linked at setup for spam verification which is a noob but very common mistake but they make it hard not to provide email or phone number and we're not all zero cool). Then LE contacted Apple to get more information on the link of the guy (timestamps etc, contacts, list is endless at this point). In the US this may have only gotten him watched. Spanish courts fucked him. He probably also used the protonmail app on either his mac or his iPhone, probably thinking "Apple is priv8 br0, and iCloud Private Relay, it's lttrly in the name bro" and Proton complied (alternate option: shutter operations of a profitable, well-respectable business.) Let this be a lesson. Login ONE TIME on the phone app, desktop app, or give them ONE PIECE of identifiable information like real email or phone, you've burned that email and it's only a matter of time. Think proton has a 6 month data retention policy. VPN might be designed in a way that doesn't require username, idk, but I don't trust it.

Proton is a legit business therefore they have to comply otherwise they may have their domains and infrastructure seized or even be charged. If one really needs to use Proton they should: - Access only via Tor. - Encrypt everything themselves. I for one don't trust their e2ee implementation, I'm sure they can sabotage it if compelled to do so. They can still hand over a ton of metadata like access times, message times, who is talking to who, browser fingerprints and who knows what else they may collect. This goes for any legit service provider no matter how private they claim to be. PS: When you see a Swiss law enforcement agency on a seizure banner I'm sure it's mostly about Proton.

Still better than most email providers. But yeah, don't do anything illegal on there, don't do any activism on there, etc.

Use canary ffs

[removed]

I only use them because of the other services they provide, and pretty cheap and stable to be honest. I assume no right to privacy nor would EVER communicate with anyone from this arena. Even if you use PGP folks could associate a P2P exchange with someone.

I'm thinking of getting rid of my tutanota subscription simply because why

Stop looking for that "secure email host". It doesn't exist. Unless you are running it yourself. This.

I was semi aware proton mail had issues, but I appreciate the clarity on how easily your info can be given up by them. So if we dont personally encrypt our emails, they can be up for grabs by LE?

/u/HeadJanitor Do I understand this correctly that an e-mail first became of interest of LEA, they requested the information and that lead to an arrest of a person?

Thanks for posting this! I'm not feeling this at all. Really sucks. Granted, I make sure me and my crew always use PGP for anything op related regardless of how deep or torrified I am, regardless of the sites credibility, etc, for exactly this reasons. I even PGP some session messages and/or matrix. This really sucks to hear though.

That is why I create totally anonymous accounts on proton. completely untraceable = peace of mind while being naughty. At once I actually thought I could sell them :D

protonmail sucks I will no longer trust him again. and I hope this also opens the eyes of others who think that proton mail is totally anonymous

Why are you using email /u/headjanitor - it's not like you're forced to do that if you're a criminal. We are all criminals in here. I got a gazziliones of protonmails and hotmails too, want to buy some 3 letter ones? It's not like I'm using it irl biz.

I use mysudo for reasons

I went "down" because of ProtonMail but luckily be identity obfuscation saved me from a long sentence. Actually ProtonMail disclosed the IP used by my VPN to my other PM accounts linked to my actual (private) account which lead to a raid. Luckily all OPS had siezed prior and this only lead to them finding one chat with various suppliers leading to a lame 1 year sentence. Don't use ProtonMail use AUTISTICI or COCK.LI over TOR.

Protonmail was compromised by geopolitics more than a year ago. Due to some US and European Union agreement. Cant remeber what the official agreement was called but it happen in plain sight, it was covered in the news amoungst a G summit of some sort. Basically, the servers in Switzerland allowed interpol, FBI CIA gain access. DNMX, this has been compromised a while ago too, it's basically a honey pot at this point. A collective of global LE run this one. What HeadJanitor said. A secure email client doesn't exist unless you're running one yourself. Use pgp and the best practices you can, but keep always keep in mind most of these email client servers are run in established counties, counties that are part of geopolitical alligences e.g NATO, European Union, Pacts, G summits of various sorts and so forth. Most of these countries receive money from the US so those funding agreements come at some costs. So always think the servers are compromised at any time all the time. This is why PGP and many other opsec filters are foremost best practice.

You can very easily make proton mail accounts anonymous. It provides a Tor service which will keep you anonymous; people that get caught using proton mail is like being caught with using Monero, it is just bad OpSec. You are the one to blame if you are caught, maybe if there is an onion service available you should use it. If you do not need a recovery email why have it; but lets say you are creating your proton mail account with the Tor service just go get a disposable email address from guerilla mail, or somewhere else just to make the account then remove it afterwards. Proton Mail is meant to be a privacy respecting email service not a place for just criminals, you can use it anonymously. It is okay to use Proton Mail: http://6tc72lnilgt4dn2u6qk44vfns2qca552smajbilfcl6zs7ezf7emhbad.onion/en/service/491 <-- tosdr Proton AG, their terms and services simplified.