Privacy

Facebook never learns and clearly doesn’t think the various privacy laws created to protect individuals apply to them. Yet another example of Facebook thinking it can break rules and never be brought to account.

This is a blatant breach of privacy and shouldn’t go unpunished in my view. Will be interesting to see how Facebook tries to squeeze out of this one.

https://news.sky.com/story/meta-fined-for-forcing-users-to-agree-to-personalised-adverts-12779859

What’s the best email client? As you can see from my other threads I’m trying to make changes to my digital life (android phone).

https://sudonix.org/topic/678/most-privacy-security-focused-password-manager/9

https://sudonix.org/topic/679/which-vpn-do-you-currently-use/6

I’m trying to get away from Gmail, does anyone have any suggestions of a good email provider?

I currently use Proton’s Password manager, it’s got me thinking Protons ethos is security first focused, but are there any other password managers people recommend?

I currently have a few passwords and 2FAs stored in Microsoft Authenticator that I haven’t taken over to Proton and I’m looking to find a password manager to move these to.

This is an interesting / alarming read.

Amazon France Logistique, a subsidiary of the e-commerce giant that manages its large warehouses in France, has been fined €32m ($35m) for infringing its workers’ privacy.

Following an investigation into Amazon France Logistique’s surveillance system which was set up to monitor staff performance, France’s information regulator, considered it to be "excessively intrusive.”

https://www.infosecurity-magazine.com/news/cnil-france-amazon-32m-fine-spying/

ProtonMail often touts its Swiss jurisdiction and privacy guarantees, but at the same time, it is complying with a record number of data request orders going through the Swiss legal system.

ProtonMail is one of the most popular secure email services in the world, having launched in 2014 via a crowdfunding campaign. It promises a higher level of privacy and security over other email platforms and frequently touts its Swiss jurisdiction.

While Switzerland is a good jurisdiction for privacy-conscious users, it’s certainly no guarantee for data security.

On the ProtonMail homepage, you can see references to “strict Swiss privacy laws” that should keep your data secure.

Proton provides data to the FBI and other police agencies

This past week Forbes ran an article on a case where the FBI was able to get data on a U.S. ProtonMail user who was being investigated for harassment (but not charged with any crime).

The warrant revealed that the FBI managed to acquire data from Proton Technologies, the owner of Proton Mail, to kick off the hunt for the anonymous emailer. It’s a rare example of a U.S. data request on Proton and shows how small pieces of metadata from encrypted software can prove hugely useful for cops trying to unmask users who expect strong privacy protections from such apps.

– Forbes

In this case, Proton Technologies provided the FBI with the “recovery and associated email addresses” of the user, which lead to his discovery.

Two years ago, RestorePrivacy ran an article on another ProtonMail logging case involving a French activist who was also a ProtonMail user. In that case, French police received the user’s IP address from Proton Technologies, leading to the arrest of the suspect.

This begs the question, how common are cases like these, particularly with cases that don’t end up in the news?

Nearly 6,000 data request orders “complied with” in 2022

To ProtonMail’s credit, the organization publishes a transparency report going back to 2017. In it, we find the following statistics detailing legal orders for user data.

Additionally, you can see that the number for all three categories continues to climb every year. With that being said, this growth is also not surprising given that ProtonMail is a popular brand with a growing user base. Aside from email, the company also offers Proton VPN and a Proton Pass, a password manager.

Proton prefaces the transparency report noting that data requests must go through Swiss legal channels.

From time to time, Proton may be legally compelled to disclose certain user information to Swiss authorities, as detailed in our Privacy Policy. This can happen if Swiss law is broken.

… Swiss authorities may from time to time assist foreign authorities with requests, provided that they are valid under international legal assistance procedures and determined to be in compliance with Swiss law. In these cases, the standard of legality is again based on Swiss law.

– Proton Transparency Report

Proton Mail provided us with an explanation for the growing number of cases below.

The increase in cases reflects the increase in our user base. As Proton has scaled, and now has 100m sign ups to our services, it’s not surprising that these figures have risen. However, these cases have come through the Swiss authorities (which is a good sense check of their validity) and have also been reviewed by Proton to ensure they are reasonable for us to respond to (hence why there are also cases that we have not complied with mentioned on the transparency report). Please note that in all cases email content, attachments, files etc are always encrypted and cannot be read.

– Proton spokesperson

Is Proton Mail still secure and private?

The answer to this question all boils down to determining your threat model and the adversaries you are trying to protect yourself against.

In short, the answer is yes if you are looking for a secure, encrypted email service that does not have access to the contents of your inbox. After all, ProtonMail is far better than Gmail or Yahoo when it comes to privacy.

If you are doing things to attract the attention of law enforcement, then the data you provide when you use ProtonMail, such as IP address and recovery email, may be shared with authorities if Proton Technologies is legally compelled to do so in Swiss court.

All businesses must comply with the laws in the countries where they are legally based. The only other option is to shut down, like we saw with CTemplar in 2022 and Lavabit back in 2013.

Furthermore, there are also different alternatives with various privacy and security benefits, as you can see in our secure email guide.

Consider your OPSEC

It’s also important to consider what data you provide when you sign up for a service. In the ProtonMail cases we mentioned above, the data that exposed the users was the user’s IP address (French activist) and the “recovery and associated email addresses” (US suspect investigated by the FBI recently).

By protecting the data you provide when interacting with the email service, you can make your email account even more private and secure.

IP address – Use a good VPN service to hide your IP address whenever using the email service (or anytime you are online for that matter) Recovery email – Consider using a disposable email for a recovery email, or a new and unused recovery email address that is not linked to your identity Payment methods – Email is fundamentally different from a no logs VPN service in that there is always personal data stored (your inbox contents and other account data). Therefore it’s more important to use an anonymous payment method if you want more privacy.

Having good OPSEC is a crucial consideration whenever you are using privacy tools.

– Source :

https://restoreprivacy.com/protonmail-data-requests-user-logs/

Nice to see Apple taking the initiative to finally provide a decent set of controls to protect from tracking, and silent sharing of data

https://www.apple.com/privacy/control/

What’s odd is why it’s taken Apple so long to finally accommodate this when it’s been mainstream in Android for years. As much as I dislike the Apple ecosystem for a number of different reasons, this is quite appealing - further bolstered by the advertising campaign which I noticed during an ad break for a TV series I was watching this evening.

Another interesting thread topic around the whole privacy side of things is here.

Given this new privacy campaign, I’m interested to understand the genesis for this in the sense that privacy advocates have been requesting this from Apple for years, and now suddenly, as if by magic, it’s now available in the latest iOS release.

Saw this in the news today, and I suspect it’s not restricted to just the UK

https://news.sky.com/story/google-sued-for-using-the-nhs-data-of-1-6-million-brits-without-their-knowledge-or-consent-12614525

The Royal Free NHS Trust in London, which gave Google the patient data, was previously told the move was illegal following an investigation by the Information Commissioner’s Office.

Looks like both The NHS trust itself and Google are going to have the ICO knocking on their doors pretty soon - and not without justifiable reason either. The NHS is also in scope for HIPAA so this is going to be an interesting space to watch.

Either way, the sale of any data that does not belong to you without formal consent is a breach of GDPR in Europe. I’m guessing Google will have a way of wriggling out of this one, but the fine would be four times the annual turnover of the firm, and not the €25m advertised.

Completely off-topic, but…is it me, or does the below sound like it was taken from a Json Bourne film 😕 (In the last film, the term “IronHand” made an appearance)

The company’s artificial intelligence arm, DeepMind

https://www.bustle.com/articles/175023-what-is-iron-hand-in-jason-bourne-get-ready-to-close-all-your-social-media-accounts

And despite such a warning… Those with Facebook accounts will continue without a care in the world 🙂

Hi,

I wonder about others’ opinions about PGP (Pretty Good Privacy) encryption in email inboxes. Or if others are concerned about the privacy of their email inboxes.

I recently learned that emails are not meant to be confidential or encrypted. At least, during its inception. However, since many email servers/providers are trying to sell “us” as a product, and additionally governmental surveillance programs are increasing day by day, I am more and more interested in encryption for my email inboxes. I am not interested in targeted ads or promotions.

So the main aim is to decrease the amount of my data to be circulated between marketing companies.

I wonder if this is a concern for others and how they solved these problems.

I usually connect to Germany or Netherlands etc. I avoid the UK connections but is that necessary?

Express VPN to give you a list of recommended connections and the top of the list is UK connection.