Proton: “We’re consolidating our social media presence due to limited resources and no longer posting on Mastodon. Follow us on Reddit for the latest updates”
“Privacy is important, so you can follow our latest updates exclusively on the platforms that don’t give a shit about privacy”
TBF, they push the same content via their email newsletter.
Follow us on Reddit
That’s where you lost me. Not for now, for good.
Proton can now officially go fuck themselves.
First, their CEO supports Trump. Then this, ditching Mastodon in favour of nazi-Twitter. Proton is not safe anymore and people need to migrate away ASAP.
Was it ever? I ditched them years ago when they tried to gaslight people that e2ee in javascript in browser is secure.
Security is hardly a binary property.
Given you mention the specific technical setup, I would say yes - that is secure against most risks relevant for most people.
At least, it’s totally fine according to my own threat model, where I looked specifically at broswer-based encryption vs “manual” encryption (I.e. using PGP tools locally).
It is nuanced, but having the ability to selectively serve malicious javascript stealing keys to specific people only on one access is considerable issue in practice, compared to distributing binary where you would generally have the same binary for everyone and you are able to archive and analyse it. Especially if you use third party distributions, like github releases or flatpaks.
Well, yes-ish.
An organization with resources to coerce or compromise Proton or similar wouldn’t have trouble identifying individual users “well enough” (trivially, IP address). At that point there is absolutely nothing stopping a package distributor to serve different content by IP. Not even signatures help in this context, as the signature still comes from the same party coerced or compromised.
Also most people won’t (or are unable to) analyze every code change after every update, which means in practice detection is even more unlikely for OS packages than it is for web pages (much easier to debug code and see network flows). The OS attack surface is also much broader.
In general anyway, this is such a sophisticated attack (especially the targeted nature of it) that it’s not relevant for the vast, vast majority of people. If you deal with super sensitive data you can build your proton client directly, or simply use the bridge (which ultimately is exactly like other client-side tooling), so for those very rare corner cases where this threat is relevant, a solution exists. Actually, in those cases you probably don’t want to use mail in general. So my question is, who is the threat actor you are concerned about?
All in all I think that labeling “insecure” the setup for this I think is not accurate and can paint a wrong picture to people less technically competent.
Bridge did not exist back then.
As for it being sophisticated attack, I think it is relative.
Regardless, if Proton said it did not matter to most people, I would respectfully disagree and move on. They did not. They claimed it is not at all less secure than a native app, which is BS.
I can see a threat model already from 2014.
Anyway, I think it’s a tradeoff that it’s hard to assess quantitatively, as risk is always subjective. From where I stand, the average person using native clients and managing their own keys has a much higher chance to be compromised (by far simpler vectors), for example. On the other hand, someone using a clean OS, storing the key on a yubikey and manually vetting the client tool can resist to sophisticated attacks better compared to using web clients.
I just don’t see this as hill to die on either way. In fact, I also argue in my blog post that for the most part, this technical difference doesn’t impact the security sufficiently to make a difference for the average user.
I guess you disagree and that’s fine.
doesn’t impact the security sufficiently to make a difference for the average user.
I think it is borderline. I am not advocating for PGP, I like the Signal model where you trust signal for introductions but have the ability to verify, even in retrospect. Trust but verify. Even a few advanced users verifying Signal keys forces Signal to remain honest or risk getting caught.
I think the lack of meaningful verification for proton is a significant security weakness, though average user probably has bigger things to worry about.
due to limited resources
Either:
- We have lost our password
- Our C and V keys are broken and we can not copy paste our social media messages anymore
It might be the Control key which broke.
If Proton does not refer to the Steam’s Windows adapter layer for Linux, I don’t care.
Damn, reddit, really? That sucks 🙁
I liked electrons and neutrons better anyways…
Underrated comment, right here!!
Since I have found it historically hard to engage on this (broader) subject around here, just yesterday I put together my own thoughts at https://loudwhisper.me/blog/proton-fediverse-burnout/
Personally, I did not see the value of their Mastodon presence, it was write only marketing communication, no engagement with the community anyway. That happened only ever on Reddit, which I think is going to continue being the case.
They push the same info via email newsletter, if someone really wants that stuff.
Either way, the post above covers my take on the whole drama, not just this last small chapter.
Read your entire post. You claim people will say you come off as an apologist and you do.
As a person who was seriously considered switching to Proton this just reminds me of why I should not. It is clear no matter what corner of the Internet we run to as long as it is into the open arm of corporations it is a mistake.
Blue sky, Proton, etc. are not a solution to a problem. They are just the newest version of putting lipstick on a pig. We need to move beyond corporate control and it is clear Proton, even being a nonprofit, is no solution.
I find your hand waving of the CEOs position particularly distasteful. There are a lot of CEOs out there that don’t decide to get all political. They don’t do this because they have an image or brand to protect. Maybe I just like a good illusion though.
In this respect I am glad he opened his ignorant mouth and showed he has no business commenting on politics. He is no political scientist, just another person drunk on his accomplishments trying to pretend he knows fuck all about anything.
Thanks for the response, despite the fact we disagree quite substantially.
I think it’s OK that different people have different points of view. Everyone’s opinion also should fit within a broader (political) praxis and strategy that they support.
There are a lot of CEOs out there that don’t decide to get all political. They don’t do this because they have an image or brand to protect. Maybe I just like a good illusion though.
This is something I particularly disagree, as you probably have already read. Ignorance on once’s position doesn’t mean that position doesn’t exist. I appreciate Jeff Bezos for example writing that memo (just yesterday’s published), compared to acting the same way without my full knowledge.
He is no political scientist
If this was the criteria to comment on politics, honestly we should shut down everything (including Lemmy) :)
Your don’t really have much of opinion except as an apologist. A devil’s advocate defender of corporate and political nonsense without stating your actual thoughts beyond, “it is more nuanced that that” is pretty disingenuous.
It is okay to have differing opinions when someone’s opinion smells like shit. All the while you pass out the verbal/written clothespins is really just your version of carrying water. I know, I know it is more nuanced than that. Only it really isn’t.
And yes, you should have a degree or really just some critical thinking skills before deploying your wanna be political commentary on the world when you are in a leadership position. Otherwise please keep that shit to yourself and keep it out of your business if you ever want my money.
I felt that was really uncalled for. The whole post elaborates quite a lot in thousands of words, and I feel like your summary is not really accurate. Unfortunately, I have no way to debate accusations that follow a circular logic, so I won’t attempt to do so.
Otherwise please keep that shit to yourself and keep it out of your business if you ever want my money.
I reiterate that I find curious that you seem to prefer ignorance of those positions, as if the reality is suddenly better if you don’t know a problem exists. You would rather pay for Proton not knowing that Andy Yen thinks what he thinks than having more information so that you can choose to stop paying. Obviously just an example, same thing applies to the WaPo or Tesla, or any other similar case.
There is nothing to debate because my summary and all your replies just reinforce my opinion of you. This is just my critical opinion though and it is not meant as an attack, but a wake up call. I appreciate the time and effort you put into this even if it is misplaced at best
We all know problems exist. We all know speech has consequences. A leader, particularly in business, has a special fiduciary responsibility to their business. If they choose to expose themselves as politically ignorant and supporting positions that are indefensible the consequences are they will lose business. This is all I am pointing out.
You conflate two things here which are a person’s right to speak their mind and their responsibility to bigger issues. I get you want to hear their opinions and then play devil’s advocate about them because that is just what you do.
You are clearly technically minded but you are also clearly not politically minded. Much like our errant CEO and reminiscent of when a US congressman tries to grasp web technology. They say a lot of ignorant things about tech just like Andy says ignorant things about politics.
Clearly you feel a kinship with this man because you are also heavily invested in the tech world. You defend him because you also admire him. No amount of debate or hand waving will change this immutable fact.
If they choose to expose themselves as politically ignorant and supporting positions that are indefensible the consequences is they will lose business. This is all I am pointing out.
Very easy to understand. But why should we (the customers, citizens, etc.) care? My interest is to have that knowledge, it’s the shareholder interest to have the business succeeding, and they take care of that. So why from your words you seem to imply that it’s “better” if they keep their mouth shut (and therefore protect the businesses)?
I get you want to hear their opinions and then play devil’s advocate about them because that is just what you do.
Unnecessary ad-hominem, which is also easily proved wrong. I hear the opinions of Musk, of Bezos (but also of Zuckerberg, of the Nvidia guy, of Altman and many others) and I am happy because with that information I can (and do) distance myself from their companies. In this case, I feel differently and therefore I take another decision. I like to think that I can critically evaluate situations, but if the conclusion I end up with is different from yours it doesn’t mean that mine is wrong by definition.
You are clearly technically minded but you are also clearly not politically minded.
You are clearly wrong about this. I have nothing to prove obviously, but you can easily also see that by just browsing through other posts on my blog, for example this. I will even go a step further and say that the purism and localism (as defined in this book) that emerges from your words is something I explicitly want to distance myself from, because it has proved to be a complete failure in terms of political battles.
I am referring at things like:
It is clear no matter what corner of the Internet we run to as long as it is into the open arm of corporations it is a mistake.
Clearly you feel a kinship with this man because you are also heavily invested in the tech world. You defend him because you also admire him.
I don’t. I actually can’t care less about him, and I barely know anything about him. My involvement is very limited to this case, and that is because wanting to understand inevitably forced me to learn certain things and inform myself. Please don’t assume other people’s positions.
You can only see better from your point of view that you want more knowledge. Keeping their mouth shut is what leaders do everyday to protect their business, their profits, their coworkers, etc.
I suppose you have to be a knowledgeable leader to understand this. We often thrust people into leadership positions and we end up with people like Andy as a result.
I don’t pretend to the arbitrator of what is right or wrong, but I have learned a lot in my lifetime and calling a spade a spade is something I believe is important. You take all this so personally and thus show a certain level of immaturity as you probably feel I display as well.
Your proof of your political commentary only supports my assertion that you are very technically minded. Your critique of cloud computing shows your technical understanding is profound, but does little to forward a feeling that you are politically minded. You state yourself you are just learning about this which is very clear.
If they aren’t getting much traction somewhere, but are spending outsized resources there, it makes sense to redirect the manhours elsewhere.
Well, read comments under their latest posts on Mastodon. Solid shitstorm of 9 Beaufort since more than a month.
Will be missed /s
Why not on Nostr? No any freaked admin, etc
