Proton a few years ago disclosed the IP address of the user of a certain mailbox upon request by LEA. That was enough to get the person found and arrested (I don’t remember what the case was about). They HAVE to comply with these requests, but they DON’T need to log/retain those info ETA: and I was wrong, thanks @Cheradenine@sh.itjust.works to set me straight. But I think the point still stands. I don’t want to be ALWAYS be tied to a VPN, there are some scenarios where I can’t use a VPN.
That was the moment I decided to selfhost my email server.
In that particular case they did need to log the ip because they were compelled to do so by a Swiss court.
That was an opsec failure on the user, if they used a VPN or Tor they would not have been caught.
So couldn’t a court compel the VPN to log all IPs and then use some FISA level shit to prevent the VPN from alerting users?
There’s been a handful of VPN cases taken to court where they have proved, at that moment in time, that they had no logs to hand over. But why not take it that last step and compel the change then?
That’s a good question. I know good vpns like mullvad do not and can not log ips/traffic without changes to their backend, I wonder if they could claim “it’s impossible” or something (clearly bogus, but the argument could be “with our current infrastructure, I.e. We can’t afford to redo our systems to comply”)
A VPN would’ve only shifted the “blame” unless it was a decent one like IVPN.
Tor would’ve been much better, especially considering Proton has an .onion address.
Yes, by VPN I meant something decent. Not whatever spyware is top on the Play Store for circumventing geoblocks.
They were already using Proton Mail, they just were probably thinking that was enough. It would have been if the French had not been able to convince a Swiss court that their request was valid.
That was the moment I decided to selfhost my email server.
So now the hosting you use will share the same(or likely much more) data if some government requests it.
Posteo doesn’t have to retain IPs and doesn’t, it also doesn’t retain payment info (though if you transfer by wire there’s still a window where a payment can be traced AFAIU).
They will also absolutely forward any and all traffic for a particular account to law enforcement when given a court order. What’s it with criminals thinking that they can outsource opsec to legitimate businesses. Defending against a state-level actor actively hunting you down, watching closely and pouncing on any and every mistake, is a vastly different beast than making sure google doesn’t know about the butt plug you just bought.
Agree with you, that’s why I buy my butt plugs (and similar toys) with my gmail account! 😁
