Hacker News Reader

Comment by _heimdall | Hacker News Reader

There's a pretty egregious misunderstanding of how email works in both the article and the proposed ban.

Protonmail can only end-to-end encrypt email when the receiver is also using Protonmail. The email spec has no support for a universal encryption method, one of the reasons we'd be better off not using email at all today.

They also don't explain how the inability to track the sender's IP is specific to Protonmail. Unless I missed a key feature, Protonmail doesn't do anything to hide or obscure the sender's IP.

View on HN

> inability to track the sender's IP is specific to Protonmail

The issue is India doesn't have a judicial agreement with Switzerland over data sharing (which includes User IP Addresses) for criminal investigations [0] while the US does [1], and Protonmail only honors Swiss litigation [2]

This should change with the new India-Switzerland FTA though.

[0] - https://carnegieendowment.org/files/ParsheeraJha_DataAccess....

[1] - https://www.dataprivacyframework.gov/framework-article/1%E2%...

[2] - https://proton.me/legal/law-enforcement

India is target Protonmail rather than all companies in countries that India doesn't have an agreement with though, right?

My point was just that singling out Protonmail doesn't make sense and misses the point on how email works.

Think of laws like Blacklists/Deny Lists.

A platform is default allowed until it denies to comply with Law Enforcement Requests. When that happens, a platform can by denied/blacklisted.

This is why Protonmail is blocked in India and not Gmail or Yahoo.

If Proton AG decided to ignore US Law Enforcement requests, it would get shut down the same way. This exact thing happened to Lavabit in 2013.

I may be getting out over my skis here, hopefully someone will correct me if so. But I believe this is the main distinction with a Common Law system, where everything is default legal unless regulated by legislation. Effectively, laws are only blocklists under legal systems based on Common Law.

I don't know for sure if India is Common Law, though given its history with the British Empire I would guess that it isn't.

India is Common Law as well.

Former British Dependencies like India, Malaysia, Singapore, Canada, South Africa, New Zealand, Ireland, and Australia are ruled under Common Law with additional colonial authoritarian flourishes, as these dependencies could be overruled by Westminster until the mid-late 1900s.

England, Wales, and North Ireland are themselves Common Law, and it's somewhat common for Indian lawyers to cross apply to join the English Inns of Court as well. That said, modern India is starting to transition towards an American style common law system over the British one, as America has way more of an impact in India today.

Civil/Roman/Latin Law is a continental thing. You'll see influences of it in former Spanish, French, and Russian colonies.

That is completely untrue.

Email supports end to end encryption between any two servers. You set each server up with a list of supported protocols and denied protocols.

If either side can't agree on the encryption algorithm, then the email does not go through.

If both sides do agree, which is almost always the case if both sides are using industry standard encryption methods, then the email is end to end encrypted.

On top of that, we have PGP encryption which allows the user to encrypt the email from everybody including the email provider. Only the recipient email address and possibly the subject line would be readable to the email providers.

As for the IP, if protonmail removes the sender's origin IP then it's removed and that's it.

Email is one of our best methods of international communication available today.

There aren't many services that support e2e encryption though. I've been a Protonmail user for years and only remember being able to send encrypted emails to other PM users, maybe Fastmail also supports the same protocols?

Regardless, if I'm not mistaken encryption protocols are layered on and not part of the official email spec. I'm not 100% on that so may it was added to the spec as an optional feature, but by no means is it common (especially with the market share Gmail owns).

Hi! PGP is open source, and therefore Proton Mail's encryption is interoperable with anyone who uses PGP to encrypt their emails: https://proton.me/blog/what-is-pgp-encryption. Proton Mail also allows you to send password-protected emails to anyone: https://proton.me/support/open-password-protected-emails.

PGP is its own protocol though, right? Meaning it is an optional addition to email and not part of the email spec at all?

Yes, but all emails exchanged between two Proton accounts, as well as between a Proton account and a non-Proton user who relies on PGP encryption, are protected by PGP.

I guess I fail to see the relevance between the distinction.

If you want end to end encryption, both ends can just run their own email servers.

PGP supports all email carriers.

But there's also server side encryption that is end to end. If both the sender and recipient uses a trusted mail server that uses encryption then nobody between the two can see the email.

Reply on news.ycombinator.com