Post #794320

ProtonMail Did Nothing WrongObservations:The TLDR; ProtonMail is getting bad press for "handing" over emails for a pro-Catalan protester. The problem here, ProtonMail did nothing wrong. Using an encrypted email application only works if you use it correctly. This user had linked into the ProtonMail account an iCloud and Gmail account. They were under the incorrect understanding that those iCloud and GMail emails would be encrypted just by using the app. That is not the case as those email services are external to Proton. On the compose screen in ProtonMail, there is a lock icon you have to click to set the password for the secured email. If you don't do that with an external email address, the message is NOT encrypted. If you do, the recipient will then receive an email with a link to the secured email gateway at ProtonMail. Entering in the password unlocks the email message and the recipient can securely reply. Tutuanota and other secure email providers operate their secured messages to external address the same way. This Spanish protester did not do this with his emails. As thus, the emails were never secured. Authorities having the protester's name from his iCloud and GMail accounts and the ProtonMail address where emails were being sent were able to identify him. The second issue was the recovery email address on the ProtonMail account in question was set to an iCloud address. Quoted from the article: "Proton does not require a recovery address, but in this case, the terror suspect added one on their own. We cannot encrypt this data as we need to be able to send an email to that address if the terror suspect wishes to initiate the recovery process."ProtonMail did nothing wrong here, this was user error and poor opsec. Links:Original: https://www.techradar.com/computing/cyber-security/proton-mail-hands-data-to-police-again-is-it-still-safe-for-activistsArchived: https://archive.today/rJyzIFor more content, head over to http://WhiteHatSecurity.stream #Cybersecurity #News #ProtonMail #SecureEmail #OpSec #ProtonMail