Well they changed the IP logging policy of protonmail on a dime, so who’s to say that they won’t change their VPN’s policy? They just don’t have as good of a track record as people seem to think around here.
Of course it’s dissapointing that protonmail did this, although i wouldn’t say that the policy was changed “on a dime”, as it said that ip logging was not “on by default”[1]. But while dissapointing, i can imagine courts pressuring Proton to start ip logging since it’s easier rather than, say, change the entire backend to not encrypt the emails anymore. But to be fair i would say that if your threat model might include the government somehow, you should probably not trust any service with sensitive details like your ip. But as protonmail does what it sets out to do (encrypt your emails + some more) and as there aren’t too many alternatives exept maybe tutanota, i think i’ll stick with it. As for the VPN, it’s open source[2][3][4] (atleast the clients, I don’t know about the server), but as I don’t know how to audit code, take that with a grain of salt. And it does semi-regular(?) audits, although the last ones seem to be from 2019(?)[3] and a penetration test (or maybe it was an audit, doesnt seem like it though) from 2021[5][6]. But they said that they’re planning an audit in the next months. [7].
But the point is what Swiss law is. They cannot be compelled by a court order to log data for their VPN service, but they can be compelled by a court order to log email accesses. This needs to be considered by users of Proton, and indeed it is a bad mark against them that this wasn’t clear upfront before the French activist case.
I’m not saying all this to defend Proton, really. I don’t even use their service anymore, but I did use the vpn for 3 years without incident.
Well they changed the IP logging policy of protonmail on a dime, so who’s to say that they won’t change their VPN’s policy? They just don’t have as good of a track record as people seem to think around here.
Of course it’s dissapointing that protonmail did this, although i wouldn’t say that the policy was changed “on a dime”, as it said that ip logging was not “on by default”[1]. But while dissapointing, i can imagine courts pressuring Proton to start ip logging since it’s easier rather than, say, change the entire backend to not encrypt the emails anymore. But to be fair i would say that if your threat model might include the government somehow, you should probably not trust any service with sensitive details like your ip. But as protonmail does what it sets out to do (encrypt your emails + some more) and as there aren’t too many alternatives exept maybe tutanota, i think i’ll stick with it. As for the VPN, it’s open source[2][3][4] (atleast the clients, I don’t know about the server), but as I don’t know how to audit code, take that with a grain of salt. And it does semi-regular(?) audits, although the last ones seem to be from 2019(?)[3] and a penetration test (or maybe it was an audit, doesnt seem like it though) from 2021[5][6]. But they said that they’re planning an audit in the next months. [7].
Sources: [1]https://arstechnica.com/information-technology/2021/09/privacy-focused-protonmail-provided-a-users-ip-address-to-authorities/
[2]https://github.com/ProtonVPN
[3]https://protonvpn.com/blog/open-source/
[4]https://itsfoss.com/protonvpn-open-source/
[5]https://drive.proton.me/urls/XWPWPN079G#KSgiJSoTkysU
[6]https://proton.me/community/open-source
[7]https://www.reddit.com/r/ProtonVPN/comments/14kvy1e/comment/jsh0l7u/?utm_source=share&utm_medium=mweb3x&utm_name=mweb3xcss&utm_term=1&utm_content=share_button
Additional sources: https://proton.me/blog/security-audit-all-proton-apps
Please tell me if i got something wrong, i’d be happy to fix any issues
Edit: formatting issues and added back the start and the end that was removed
But the point is what Swiss law is. They cannot be compelled by a court order to log data for their VPN service, but they can be compelled by a court order to log email accesses. This needs to be considered by users of Proton, and indeed it is a bad mark against them that this wasn’t clear upfront before the French activist case.
I’m not saying all this to defend Proton, really. I don’t even use their service anymore, but I did use the vpn for 3 years without incident.