217
UK government demanding access to encrypted iCloud
(www.bbc.co.uk)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 07 Feb 2025
217 points (99.1% liked)
Privacy
33459 readers
375 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
Set an iCloud recovery passcode. It removes the ability to recover your iCloud account by verifying that you’re the owner but it also removes the ability of Apple to be compelled to access it.
Op: read about pgp/gpg. Do it now. When you don’t understand something ask questions about it instead of giving up.
Email was never intended to be private. It was never designed with privacy in mind and your use of a client employing an encrypted connection to your mail server does not solve the problem because tens of thousands of mail servers use unencrypted connections.
No one needs your iCloud to read your email, they can just look at the plaintext mail coming to and from the server.
Then what’s the point of services like Proton and Tuta over Gmail?
Anonymity and not being google or one of the other big mail providers.
Email is not an easily selfhostable service either. Modern spam filtering systems require the maintainer to jump through a bunch of hoops intended to defeat their anonymity and establish a recourse in case of problems.
They're not anonymous, contrary to common perception. They're encrypted, but they know things like your IP address and which IP addresses you're communicating with, even if they don't know the content of your messages. Some of them explicitly state as much.
Depending on the local laws of the company or servers, they might be compelled to share whatever data they do have, which could be enough info to assist law enforcement in making an arrest, even if they can't see the message itself.
If you want anonymous email use, you have to use a logless VPN at a minimum every time you access a third party encrypted email service. That way neither side of the email exchange can tie your IP address to you.
Of course, I only meant that unlike Gmail and such services like proton don’t actively impede your anonymity and build a profile on you as far as we know.
Proton does require you to have a dedicated phone number or email to sign up though, like that was my main thing that swayed me away from making a protonmail account was when I went to sign up I was met with a phone number requirement and I'm like "oh well this isn't going to be helpful"
They claim it's to prevent abuse of the service, and that it's only the cryptographic hash which can be used to find out if the email has been used on an account before. But I dislike that it requires even going that info
ammendum: apparently this restriction may be based off of your region used and browser. I was able to finally successfully create an account using Chrome, but Firefox exclusively gave me email or phone number requirements
I never understood this stance... do people really think a corporation is going to risk their entire company over your anonymity when their country's government does not allow this? Nobody is going to jail for you.
Plus, if everyone could easily sign up anonymously, then like they said, it would be overrun with bots and the reputation of their IPs would quickly deteriorate to where most other email providers would just block them, making the service almost worthless.
It's a privacy activist stance, privacy and security are always at a constant battle. There was a post about it a few weeks back, every attempt at security compromises privacy, because private info is the easiest way to lock security down, so it's always the route that companies take. Personally I don't think a corporation should have to risk their company over it, but I don't think a company that isn't privacy oriented should pretend to be. It's misleading. I give them credit that they might be good for privacy but, the entire operation gets undermined when in order to sign up, it tries to force you into giving information that could identify you. The less information needed the better, and the less you can tell overreachers. If you don't have the information you don't have the information. That's signals motto, it's also Mullvads motto, and its the direction that proton runs in if you can find your way through it's hoops.
I think I got in before they started doing that.
Actually I don’t think they require that. I just set up a new proton account on a device with a fresh wipe from a vpn endpoint I never used before and they offered to record a phone number or recovery email but didn’t require it.
Can you tell me which endpoint/region that you used? Cuz I just tried using a VPN endpoint from Switzerland Sweden and Ukraine and all three of them brought up a requirement to have a verification email
edit: disregard apparently it was a browser issue, switched from Firefox to Chrome and reconnected to a Switzerland endpoint and it let me solve a captcha instead of using email verification system
Mullvad us Denver 205.
I’m also using their encrypted dns though that shouldn’t matter. Recording an email might be a regulatory requirement of the intelligence sharing treaties of the eu and broader eurozone.
Try an endpoint outside of the western world and see what happens!
Yeah weirdly enough it ended up being a browser issue, Firefox wasn't able to use anything but email verification/phone number verification but Chrome was able to offer a captcha in place of it
Smaller attack surface and fewer leaks. If you specifically are targeted, the government will look for a warrant for the data in your account, rather than the one you sent to. Gmail also I think there's a concern that text will leak via AI - I remember hearing this concern even when it was just that associations in search terms might build from private email content.
I don't think gayhitler is entirely correct about reading all the plaintext emails. If I understand right, major (most?) email providers use TLS (encryption) between each other and and to your laptop. The difference is the email is available on their servers somewhere, if someone were to get access.