this post was submitted on 17 Feb 2024

174 points (93.9% liked)

Technology

59161 readers

2115 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

[email protected]

174

India may block Proton Mail (techcrunch.com)

submitted 8 months ago by [email protected] to c/[email protected]

31 comments fedilink hide all child comments

top 31 comments

sorted by: hot top controversial new old

[–] [email protected] 5 points 8 months ago

I'm surprised that they didn't use the "think on the children!" red herring yet. They probably will in the future, given that governments (not just India's, but all of them) have a burning hate against anything privacy.

[+] [email protected] -32 points 8 months ago (6 children)

Can we get away from email?

It's not a secure form of communication anyway. I want my messages to be e2e encrypted so I know I am the only one that can read them

[–] [email protected] 9 points 8 months ago* (last edited 8 months ago) (3 children)

What a stupid thing to say.

Whatever your favorite (and probably shitty) proprietary or open source messaging service - not everybody uses it. But hey, everyone has email, so let's kill that.

BTW since you said encryption is important to you: your walled-garden messaging service has a much easier time profiling you and your friends than they would in a heterogenous environment like email. They don't need the content anyway, just metadata.

[–] [email protected] 1 points 8 months ago

IDK, I think that's kind of flawed logic. E.g. "we should stop using gasoline for cars and switch to electric" - would you say "what a stupid thing to say. everyone uses gas so we shouldn't try to stop"?

And are you not aware of Signal? It's open source, and the default server is not, but it doesn't matter since it is E2E encrypted, just like Proton. The difference is that ProtonMail allows you to communicate unencrypted with non-ProtonMail accounts.

I think all they're saying is that, similar to gas users, there are many people who will not stop using it or just don't care unless we sunset gas cars / email for them.

I do agree with that, and in both cases it isn't something which can happen overnight, but it is a serious long term problem which IMO we should be pushing to solve.

[–] [email protected] 2 points 8 months ago* (last edited 8 months ago)

They don't need the content anyway, just metadata.

ProtonMail uses PGP encryption to encrypt emails, which means your meta data, including subject line is vulnerable to data collection. Also there is no forward secrecy with current PGP standard. See quotes from below:

We have built Proton Mail with PGP fully integrated, ... All messages between Proton Mail users are automatically end-to-end encrypted.

https://proton.me/support/how-to-use-pgp

Subject lines and recipient/sender email addresses are encrypted but not end-to-end encrypted.

https://proton.me/support/proton-mail-encryption-explained

PGP (especially for email) exposes much more info to outside party than any good communication protocol, like the signal protocol or OMEMO used by XMPP.

[–] [email protected] 1 points 8 months ago (1 children)

Oh no, profiling. Google can read your emails directly

[–] [email protected] 1 points 8 months ago (1 children)

No, they can't since I don't have a Google mail address. Even if I had, they'd have a harder time building a social graph when I communicate with others outside of Gmail.

[–] [email protected] 1 points 8 months ago

Okay, but unless all of your communication is e2e encrypted, your provider can read all of your messages. They can even show you ads based on the contents. Oh, you bought vitamins on Amazon? How about some minerals?

If I send messages with matrix, the matrix server admin cannot read them. If I cared about them seeing who I'm talking to, I would run my own server

[–] [email protected] 1 points 8 months ago* (last edited 8 months ago)

That's what s/mime does. If it were as easy to get personal certs as it is to get server certs through letsencrypt, everyone could easily sign and encrypt mail.

I can certainly do it anyway, but you'd have to trust my self signed cert.

That said, it's pretty rare to find relays these days that are not using tls for transport, so there's that.

[–] [email protected] -2 points 8 months ago

autocrypt has been around a while. get your contacts to use it.

[–] [email protected] 30 points 8 months ago (1 children)

Congrats, you just invented ProtonMail

[–] [email protected] 3 points 8 months ago (1 children)

Its not encrypted when 99% of your contacts aren't on Proton.

[–] [email protected] 13 points 8 months ago (1 children)

You can encrypt it for non-Proton users very easily.

[–] [email protected] -5 points 8 months ago (1 children)

oh? i have friends that use protonmail and i've asked them to do it. no one has succeeded yet

[–] [email protected] 6 points 8 months ago (1 children)

Yep, it just has you set a password, confirm it, and even set a hint if you want. Works on web or mobile.

[–] [email protected] -1 points 8 months ago (1 children)

you're talking about sending a link to a password protected message?

[–] [email protected] 5 points 8 months ago (1 children)

Yes, there's no other implementation I know of for provider-to-provider encrypted email. O365 is very similar. Recipients can then reply back too and the Proton user receives it directly.

[–] [email protected] 2 points 8 months ago (1 children)

pgp is true end-to-end

[–] [email protected] 1 points 8 months ago* (last edited 8 months ago) (1 children)

Ah yes, forgot about PGP. Haven't used it in a long time myself, but Proton automatically creates a PGP signature for you. You can just attach your public key that's already on your account and it'll encrypt your mail. It natively supports PGP/MIME.

[–] [email protected] -1 points 8 months ago (1 children)

you say it like it's simple, but i don't have any friends who have accomplished it

[–] [email protected] 1 points 8 months ago* (last edited 8 months ago)

It was pretty easy when I tested it just a few min ago, yes. Maybe they step the missed was adding your public key to the contact entry for you. As soon as you do that "encrypt" is enabled by default for you.

[–] [email protected] 4 points 8 months ago (2 children)

you can e2e encrypt emails though?

[–] [email protected] 1 points 8 months ago

Yet everyone sends me one time passwords in plain text

[–] [email protected] 2 points 8 months ago

And then just go PGP if you want even more security.

[–] [email protected] 15 points 8 months ago

Then use Proton Mail

[–] [email protected] 10 points 8 months ago

Hopefully that doesn't go through. This could be grounds for blocking something else like tutanota. Hell, if it works in India other might follow.

[–] [email protected] 60 points 8 months ago (1 children)

They probably sent the threats themselves to justify banning Proton Mail, because they want to destroy privacy and encryption.

[–] [email protected] 42 points 8 months ago

Yes, privacy and encryption are always the enemy of authoritarians. They enable dissent

[–] [email protected] 7 points 8 months ago

This is the best summary I could come up with:

In a statement, a Proton spokesperson told Indian daily Hindustan Times that the firm condemns the “potential block as a misguided measure that only serves to harm ordinary people.”

It will not prevent cybercriminals from sending threats with another email service and will not be effective if the perpetrators are located outside of India.”

Hindustan Times reported Thursday that the Indian IT Ministry had issued a notice to local internet service providers to block Proton Mail at the request of the Tamil Nadu police.

D. Ashok Kumar, a senior cyber crime wing police officer in Tamil Nadu, told Moneycontrol on Friday that he had sent the request to the IT Ministry to block access to Proton Mail.

Ashok Kumar, who is also the nodal officer for blocking orders in the state, said Proton Mail was “least responsive” in sharing details about the suspects who had sent the bomb threats.

Many lawmakers and privacy advocacy groups expressed concerns over the possible block of Proton Mail in India.

The original article contains 367 words, the summary contains 166 words. Saved 55%. I'm a bot and I'm open source!