He made a statement that Protonmail was insecure because the Proton company had stated in a transparency report it complied with a Geneva court order to hand over identifying information to the French authorities, which resulted in the arrest of a French national who had used Protonmail.
https://www.privacyaffairs.com/protonmail-surrenders-user-logs/
The facts of this break down as such:
- Proton is Swiss and offers an e-mail and VPN service.
- Swiss law does NOT permit Swiss e-mail services to have a zero-log policy.
- Swiss law DOES permit Swiss VPN services to have a zero-log policy.
- The French national did not use Proton VPN to access ProtonMail, so there was a log.
When Proton received a court order, they complied and were transparent about it. Google, by the way, receives hundreds of thousands of similar orders.
https://transparencyreport.google.com/government-removals/government-requests
I use Proton so I take accusations like this very seriously, though I recognize that using a secure email provider is only one part of personal privacy and other forms of data hygiene are necessary.
The crux of Graf's statement was: Proton received a court order and complied, and because the user in question practiced poor hygiene, he was able to be identified through access logs alone.
I asked him, what would he do if he received a Canadian or US court order? He is Canadian, and his services are hosted in the US. So, if Proton is bad for complying to court orders, then he must have some idea of how he's going to be noncompliant in the jurisdiction of his business and person. Pretty reasonable.
His response was just to tell me to fuck off, which is probably one part anger at being called out, and one part anger at me in general because he seems to blame me (and the Kiwi Farms userbase in general) as being a huge source of his personal issues.
I desperately would like graf to be a more reasonable person.
