They clearly give you options to avoid this scenario, this is not on Proton, this is simply an opsec fail of the user.
Don’t get me wrong, opsec is hard, exhausting and just annoying, it needs discipline and constant focus, you only need to fail once for it to be ineffective.
The customer signed up for Proton, but didn’t follow their guidelines for anonymity, that is not a failure of proton, it is a failure of the user.
Maybe they’ve changed the website, but when I started using Proton, they never gave me any warning about paying with a credit card.
Anyways, my point is that both the government and service here need to be changed. Switzerland should not be responding to subpoenas from a fascist regime, protonmail should not be based in Switzerland, and Protonmail is too captured by capitalists that want to be Google to have the morals to give up instead of giving in.
See Mullvad for example of a service that will just not offer services like port forwarding instead of pretending they’re secure. They have the same credit card opsec issue but they actively discourage it, and they don’t pretend that unencrypted email is secure.
You can’t demand warnings about stuff like that all the time, YOU need to teach yourself these things.
You can’t rely on anyone else for your own opsec.
That is the entire argument here.
The guy should have read up on protecting his anonymity before he started his activities.
Opsec fails have brought down many, many people.
From darknet site owners, to government agency operations, to countries at war and more.
Opsec sounds easy at first, but it is extremely difficult, and you can’t rely on anyone else doing your job for you.
You need to develop OCD like habits, you need to understand why they are needed, and what you are giving away when breaking them.
You imply that a warning would have prevented the guy from using his credit card, I don’t think it would have made any difference, the guy would either not understand at all, or just ignore it
Unless he intuitively understood that Proton was required to retain cc numbers for X years, and that these cc numbers were tied to a specific transaction, his account and his identity, I just don’t see him taking a warning serious.
This is the real world, it isn’t fair, it doesn’t care, you need to care about this for your self preservation.
How do you think it would play out if proton refuses lawful orders from a court in the country they operate in?
I do think proton does a lot of misleading advertising, but its still on the user to research and have good opsec. Paying with a card when crypto is an option, using the same service for both email and a vpn, using that service from a public wifi near where you are known to live while actively doing crimes. A lot of mistakes made on the users part. Proton is running a business not a criminal protection racket, you cant expect them to help you get away with crimes just because they claim to value privacy.
Correct, but arson vandalismn and a call for violence is.
I couldn’t what exactly the charges awere in the MLAT request, so i have to go what 404 wrote
One can argue if the swiss goverment should have honired the MLAT request…unfortunately, that thing was put in place before the USA whent insane, and most countries do honor agreements they sign
It’s not theoretical. Protonmail should not have handed over the personal data for victims of political persecution, but they did.
The system is broken. The practical next step is to solve the problem.
They clearly give you options to avoid this scenario, this is not on Proton, this is simply an opsec fail of the user.
Don’t get me wrong, opsec is hard, exhausting and just annoying, it needs discipline and constant focus, you only need to fail once for it to be ineffective.
The customer signed up for Proton, but didn’t follow their guidelines for anonymity, that is not a failure of proton, it is a failure of the user.
Maybe they’ve changed the website, but when I started using Proton, they never gave me any warning about paying with a credit card.
Anyways, my point is that both the government and service here need to be changed. Switzerland should not be responding to subpoenas from a fascist regime, protonmail should not be based in Switzerland, and Protonmail is too captured by capitalists that want to be Google to have the morals to give up instead of giving in.
See Mullvad for example of a service that will just not offer services like port forwarding instead of pretending they’re secure. They have the same credit card opsec issue but they actively discourage it, and they don’t pretend that unencrypted email is secure.
And that is why you would have failed at opsec.
You can’t demand warnings about stuff like that all the time, YOU need to teach yourself these things.
You can’t rely on anyone else for your own opsec.
That is the entire argument here.
The guy should have read up on protecting his anonymity before he started his activities.
Opsec fails have brought down many, many people.
From darknet site owners, to government agency operations, to countries at war and more.
Opsec sounds easy at first, but it is extremely difficult, and you can’t rely on anyone else doing your job for you.
You need to develop OCD like habits, you need to understand why they are needed, and what you are giving away when breaking them.
You imply that a warning would have prevented the guy from using his credit card, I don’t think it would have made any difference, the guy would either not understand at all, or just ignore it
Unless he intuitively understood that Proton was required to retain cc numbers for X years, and that these cc numbers were tied to a specific transaction, his account and his identity, I just don’t see him taking a warning serious.
This is the real world, it isn’t fair, it doesn’t care, you need to care about this for your self preservation.
How do you think it would play out if proton refuses lawful orders from a court in the country they operate in?
I do think proton does a lot of misleading advertising, but its still on the user to research and have good opsec. Paying with a card when crypto is an option, using the same service for both email and a vpn, using that service from a public wifi near where you are known to live while actively doing crimes. A lot of mistakes made on the users part. Proton is running a business not a criminal protection racket, you cant expect them to help you get away with crimes just because they claim to value privacy.
In Switzerland, privacy is not a crime, nor is protesting.
Correct, but arson vandalismn and a call for violence is. I couldn’t what exactly the charges awere in the MLAT request, so i have to go what 404 wrote
One can argue if the swiss goverment should have honired the MLAT request…unfortunately, that thing was put in place before the USA whent insane, and most countries do honor agreements they sign