Hacker News Reader

Comment by nrthRockHopper | Hacker News Reader

And they REALLY pester you to set one. They are not looking out for the user that's for sure.

Providing recovery methods is certainly care about the users. Proton isn’t the weakest point in the privacy defenses: user stupidity is. If you make FBI or DHS your enemy, you’d better think about your attack surface and don’t assume there exists something or someone who will secure your communications for you.

This comment feels like it's coming from communist Russia. You'd better not make the KGB your enemy. Be careful not to do anything they would take an interest in, even if it's not illegal. Is that the USA we're living in? Sure feels like it sometimes.

The user you are replying to doesn’t live in the USA. And for non-US citizens, not doing anything a US three-letter agency might take an interest in is certainly a consideration, because US law doesn’t protect them. (I’m not sure how much better the situation is for US citizens in actual practice.)

If I would try to do something against American interests, US law would be the last thing I would care about. I have more faith in German or Swiss law regarding privacy and if that’s not enough, keeping data in Russian or Chinese jurisdiction in that specific case would make more sense.

It didn’t work out very well for people like Julian Assange.

He‘s unlucky to have a passport of a country with zero influence in this part of the world. I doubt that if he was in Australia he would be extradited.

The US has been like this since sometime in the 1950s, possibly even before. You had to watch what you said or you'd be labelled a communist sympathizer and the FBI'd take interest in you.

Your interpretation of my comment is wrong. I didn’t say you shouldn’t make certain powers your enemies. I said you need to prepare adequately. Your country isn’t famous for protecting citizens privacy, on the contrary.

Well yes, because the odds that the average user will need recovery for their account at some point are pretty likely. Email being as important as it is for identification, the last thing you want is to be locked out because of some extremely improbable situation involving the FBI.

The "average" user is on Gmail, not ProtonMail. The service is specifically for non-average users who want to maximize privacy.

We want to recommend it to average users.

> The service is specifically for non-average users who want to maximize privacy.

That I think is a pretty small sliver of Proton users. Users who want to maximize privacy are certainly there, but I think most simply want a stable email provider that respects customer preferences instead of Google shenanigans. My 2c.

For example, I am a happy, paying Proton customer for my primary email that clearly identifies me by its domain.

If ProtonMail was solely for users who want to maximize privacy, it'd be as difficult to use a ProtonMail address as your primary email as it is to do your normal web browsing through Tor.

Services that are primarily used to hide shady stuff from the FBI tend to get shut down or, failing that, heavily stigmatized.

Proton was created because we believe that privacy is a human right, and therefore needs to be available to everyone. The Proton ecosystem is there to make privacy convenient.

99% of users would be angry if they can’t restore their account because they forgot they credentials. A very small amount who needs the “privacy” knows that they shouldn’t set a non anonymous recovery email.

For most users, losing a password is a major risk -- the most common request our support team receives on a daily basis is by far from users who lost their passwords. This is why we try to make sure users input some sort of recovery method. It doesn't need to be a recovery email address, or a phone number, you can also use a recovery phrase: https://proton.me/support/reset-password#how-to-reset-your-p...

Reply on news.ycombinator.com