It is worth noting though, that Proton doesn't allow you to use certain domains for recovery addresses. Admittedly this was awhile ago and maybe things have changed there but when I first joined Proton they wouldn't allow me to set a duck.com or simplelogin.com or addy.io address as a recovery email.

Obviously using an apple ID is stupid but Proton could make more of an effort too.

At any point in the process, does it warn you about setting up recovery with personal email addresses?

Feels like with as much as Proton advertises nowadays as a privacy protecting service, they need to be taking into consideration that a lot of their customers now are going to be average users who don't know anything about proper OpSec. They should be much clearer about what things they can't protect you from.

It shouldn't be in a press release like this, they should be explaining the difference between privacy and anonymity to the customer. It's not like their marketing team isn't aware of the fact most people don't know any better.

It's in their best interests, too, because it doesn't matter how many times you say "we provide privacy not anonymity", the headlines are a bad look.

Thing is, Protonmail has been telling people this from the very beginning. It's like it gets rediscovered every year or so when somebody else gets busted.

What would be a more appropriate email address to use - or just no recovery email?

Proton does require a recovery email address if you sign up to a mail forwarding service or similar, right after creating the account. In that case the account remains locked if you don’t, so that’s just a lie

Most info came from the fact that they made the move to link their personal iCloud Mail as a recovery method.

Infinite wisdom.

Its more secure to use physical mail

Because proton put themselves into this position by making false advertising claims. Let's not forget this isn't the first time proton has given away the IP of an individual and last time was even worse because proton at the time was directly advertising they kept no IP logs which they had to quietly remove after giving the Swiss feds the IP.

All valid points made in an academic setting. I think the general consensus, and the points other users are trying to make, involve more transparency and proper presenting of the facts in their statements. I have parroted the "oh you should try proton, they're more private and secure" to other people. This is a factual but misleading statement without the nuance of higher OPSEC fundamentals.

Just look at their main landing page for proton mail.

• Proton Mail's end-to-end encryption and zero-access encryption ensure only you can see your emails. Not even Proton can view the content of your emails and attachments.

• Proton Mail protects you from these digital spies and prevents companies from monitoring you.

• your data is protected by some of the world's strictest privacy laws.

• From newsrooms, activists, and international organizations to academics, Nobel Prize winners, and movie characters, Proton Mail is the trusted choice for secure and private communication. Join over 100 million people worldwide who believe their online privacy is worth protecting.

A common user will look at this and believe that by just having this account, they will be protected. There is no asterisk* beside e-mail recovery explaining the dangers of linking to another e-mail. In fact, a lot of their services promote linking e-mail because you can't use third party verification if you haven't setup your recovery e-mail and/or cell phone verification. I ran into this trying to help an older relative who's paranoid about online accounts, ended up being more hoops and they were dissuaded because it always come down to "enter more information to continue...privately ;)"

The front landing page should have a section explaining everything that's being said here with vpn's, alternative e-mails, and how to really protect yourself with anonymity. To a lot of people, Private+Secure=Anonymous. It's not accurate, but unless you already know the things you have to do to protect your identity, it's not very clear on what the average person should do.

Proton is the only one I know of who takes mailed cash.

This was all an opsec problem. And not even an “exposed my ip address because a software bug leaked it” it was an “here’s my usual email address in case I get locked out”.

The cops didn't need to break into proton email. They just asked the backup email address for that stuff.

@lemmyreader Yes, the name/address of the terrorism suspect was actually given to police by Apple, not Proton. The terror suspect added their real-life Apple email as an optional recovery address in Proton Mail. Proton can't decrypt data, but in terror cases Swiss courts can obtain recovery email.

So proton will only give users' information to governments if the government calls the user a terrorist. Good thing governments don't just throw that word around willy-nilly!

Proton is just a company and would always give in to legal requests and all other companies and any email provider would do the same

It’s amazing how people easily forget about lavabit and what a company that is committed to real privacy is about.

Does it matter? He's still a judge with a judge's authority. If their policy is to obey the law then the political views of the judge don't change the fact that his order was lawful.