Comment by fivefives55555
5 months ago
I've been following this on X/Twitter and I think one of the most egregious things that's important to point out is that folks from Phrack reached out to Proton in private multiple times, and Proton ghosted them. Proton only engaged with them and then reinstated the accounts after Phrack went public and their X/Twitter post went viral.
It also looks like one of the writers filed an appeal with Proton and Proton denied the appeal, so they manually investigated the incident and refused to reinstate the account and then only did after this got attention on X/Twitter.
So make no mistake about it: Proton didn't just disable the accounts after whatever CERT complained, which would have been bad enough - they also didn't do anything about it until this started getting lots of eyes on social media.
Proton does not require a shred of proof that you are a real human being either, fyi. I'm not actually attacking them for this specifically, because I feel that we need privacy focused tools, however the fact that I was able to create a few hundred proton email addresses in seconds by injecting usernames/passwords was scary, even to me. I'm surprised they aren't on spam block lists worldwide. Their captcha is child's play that a script can defeat with simple image examination. i encourage them to buff up their spam controls, just a bit, and decrease moderation by a lot unless they can promptly deal with cases such as this.
Their controls are buffed up: all of those accounts are linked due to having been created with the same IP address. If one is blocked, they all are. If you try to circumvent this with a well-known proxy (such as Tor or a V"P""N") you will find that captcha activation will not exist as an option.
That definitely doesn't look good for privacy POV. If they do not want abuse, they ought to use other means. They should not associate IPs with account creation. That is kind of scary. In fact, if what you have said is true, then one's account can be blocked by someone else's mischief on the same IP, which is not very uncommon at all i.e sharing the IP.
6 replies →
I dropped Proton when a ton of services (all the major A and B tier cloud providers I tried for starters) could not/would not activate an account with a proton email.
Email is a critical infrastructure these days. Most people have neither the time nor the will to deal with emails failing to send and/or be delivered. (Send or receive)
I'll go out on a limb and say it: it's an American cybersecurity agency. Proton's CEO/Proton[1] loves the current US admin. I wouldn't be surprised if they comply now and ask questions later, if at all.
1. According to the now-deleted Reddit comment from the official Proton account glazing Republicans, so I assume they were speaking on behalf of all of Proton. https://theintercept.com/2025/01/28/proton-mail-andy-yen-tru.... I have zero evidence except for the CEOs questionable public statements, but I wouldn't be surprised if Proton turned out to be the 21st century Crypto AG.
Proton is a honey watering hole pot. This has always been clear.
Please think a bit before posting. This feels like you didn’t stop to think that this could be seen as cheap and provocative by many.
And yes, some quotes, references, or a modicum of argumentation around a divisive point of view is also a good idea.
Makes sense to me.
I wanted to try Proton out when they were having a sale, but I could not complete the purchase because I was on Mullvad's VPN.
I created a ticket, and when they got back to me 5 days later, they told me to disconnect from the VPN to sign up for Proton.
So clear that you can present the least evidence for it aside from the CEO's saying a thing or two that doesn't automatically spit on the current administration?
Proton has always been political, you see them supporting some protests, but not others.
if I didn't knew better, that would sound plausible, but the truth is much more boring (for the better)
Don't go out on a limb, RTFA. But then you wouldn't be able to have your cake and eat it too.
> Proton's CEO/Proton[1] loves the current US admin
The CEO once expressed support for Gail Slater as head of antitrust and subsequently criticized lack of effective work towards tech regulation on the Democratic side in the same social media thread.
Calling that "love for the current US admin" (which hadn't even taken office when those statements were made) is pure disinformation.
Half the American tech landscape is either running toward Trumps bed or bending right down and making all the right mating signals in hopes of some interest, but a few pro-republican comments from the Proton CEO should be held as immediately and deeply suspect of this company being a honeypot?
People of all kinds can say certain positive things about the Republican Party for different reasons in specific contexts and not be fanatics you know. That's how using actual reasoning and nuanced discourse works in the world of not throwing your brain in the garbage through ideological rigidity.
For me, at least, it's less about the initial comments than how he handled the fallout from it.
5 replies →
Ideological rigidity or not, I'll bet dollars to donuts that Proton disabled the accounts at the behest of an American agency. All the highfalutin talk is missing my main point.
Which the reddit fanatics on their sub are bending over backwards to defend and explain away when there is no two ways about it tbh.
On a positive note: having reach on social media can solve problems nowadays.
The effect is opposite - things get fixed only when you get enough social noise and that is not good.
This has always been true. The difference today is that if you are able to craft a powerful message, distribution isn’t a problem anymore.
1 reply →
Isn't that like saying "Yay, rich people get to bend the law", certainly useful to some, but kind of a weird thing to cheer for?
So, if you have sufficient influence, you can get things moving.
What about those of us nobodies with no influence?
well, you can't get the same stuff done that the folks with influence can. like they're working with a better toolbox.
4 replies →
And there’s no shortage of people excited to hop on the next outrage train.
With good cause, in this case, but the crowds wielding pitchforks don’t much care either way.
> Phrack reached out to Proton in private multiple times, and Proton ghosted them.
According to Proton's response in the linked reddit post: https://news.ycombinator.com/item?id=45227356
They say: "Regarding Phrack’s claim on contacting our legal team 8 times: this is not true. We have only received two emails to our legal team inbox, last one on Sep 6 with a 48-hour deadline. This is unrealistic for a company the size of Proton, especially since the message was sent to our legal team inbox on a Saturday, rather than through the proper customer support channels."
You'll note that Proton's PR only mentions the second date - " last one on Sep 6 with a 48-hour deadline."
Proton doesn't mention that the first email from Phrack which Proton ignored was weeks prior to that, which is what led to the second email in the first place.
You'll also note that Proton doesn't mention that their Abuse Team refused to re-anable the account after the article author did the appeals process, as per Phrack's timeline at the top of their article.
That's a great point. I guess at this point it'd be ideal for them to treat this an incident and do a proper postmortem with timelines and decision calculus.
3 replies →
To be honest, I've found Proton's public customer service representatives to be very duplicitous, so it's hard to take their word at face value. It's pretty ridiculous to see their response to legitimate concerns start with: "That doesn't sound right..." 80-90% of the time.
Sorry but doubt.
The whole "we have only received two emails" is a classic move of every company caught with their pants down. Considering Proton's history, they don't get the benefit of the doubt on this one.
As for the "company size excuse" sorry but considering the business you claim to be in (the private and secure email), having an on-call skeleton crew legal team available over the weekend for urgent requests is a bare minimum (and I'm pretty sure they have people available to hand over everything the cops request if "the proper process is followed").
Remember that they have turned over information in less than 24 hours before (for what they call an extreme case of course). So the "size" excuse doesn't hold. Doesn't matter how urgent it is, if they are the small bean they claim they are, there is no chance they can have a turnaround of less than 24 hours.
Again, it's not what they did that's the biggest issue, it's the coverup. Just like last time they got in hot water. Because the coverup raises a lot more questions.
If you don't have enough people to run your business you're doing it wrong. If you don't have enough money to hire people for your business, it's not a viable business.
> having an on-call skeleton crew legal team available over the weekend for urgent requests is a bare minimum
I don't know about Switzerland, but in Germany, no company will be available "over the weekend". Almost everything on the internet in DE is Mo-Fr 9-17.
1 reply →
> a 48-hour deadline. This is unrealistic for a company the size of Proton
and yet suspending the account...
[flagged]