3 Followers
104 Following
487 Posts

It feels like Proton are being intentionally misleading in their statements. They know that most of their customers aren't familiar with how legal process actually works, so are happy to spread half-truths.

Under US law, a US law enforcement agency (LEA) typically has to apply for a subpoena or search warrant with a US court. The court is then responsible for deciding if the legal bar for search a request has been met, then either grants or denies it.

The problem is, if a company has no real US footprint (no US corporate entity, offices, servers, etc.), then a US court typically doesn't have the jurisdiction to compel the company to hand over customer data (except in some rare circumstances). Even if the court approved the warrant anyway, it wouldn't really be legally binding.

Which is why the Mutual Legal Assistance Treaty (MLAT) exists. MLAT enables law enforcement agencies in one company to send requests for information to law enforcement agencies in another. Switzerland has such a treaty with the US. This means that the FBI can request that Swiss authorities hand over a Swiss company's data on their behalf.

Any country requesting information held by a company in a foreign jurisdiction would typically do so via MLAT. Which means from Proton's perspective, the legal request would appear to originate from their local law enforcement, not the FBI. Which they clearly understand based on their Reddit post.

Saying "we don't respond to legal requests from anywhere other than Swiss authorities" seems very intentionally worded to give the impression that the company does not cooperate with foreign law enforcement. But since it'd be the Swiss authorities handling any such requests, they'd have to comply, since as they admitted, they have to comply with local laws.

There is, however, some useful (but more nuanced) information here:

Firstly, MLAT requests are handled by local law enforcement according to local law. So if there is a difference between the law of the sending and recipient country, that might mean the MLAT request is denied. That probably doesn't mean much, because if you're on the FBI's radar, the chances are you did something that is also massively illegal in Switzerland too.

Secondly, they are 100% correct in saying that no other service provider is going to do any better. They're all beholden to local laws, and the ones that think they're not tend to get their doors blown off by SWAT like CyberBunker did. The only exception is if the company resides in a country which does not cooperate with US law enforcement (which Proton does not).

But the part that's extremely disingenuous is that the "we only respond to requests from the Swiss authorities". That statement is likely intended to imply they don't cooperate with law enforcement in any other countries, which is simply not true. Switzerland has MLAT agreements with over 30 counties.

People really need to understand that no company is going to shield you from the FBI (or any reputable law enforcement agency). They'll use misleading statements to make it sounds like they don't cooperate with law enforcement, but they do. They have to.

for whoever needs to hear this: you're not alone. i'm not vibecoding any of the software i write. i'm writing it by hand, but i've leveled up my emacs with eglot/lsp. i'm modernizing my stacks and use languages with excellent compilers. i think about how to do more with less. i'm trying to combine the best human-written libraries and modules and assemble them with minimal boilerplate. i enjoy reading your manuals and references. i believe in robust, secure, human-written software.

PSA: The Amazon wishlist doxing threat is much greater and more immediate than folks might realize. Attack works like this:

Stalker who wants your address opens an Amazon seller account and lists themselves as a third party seller for any item on your public wishlist. Then, they order the item from themselves as a gift for you. Bam, they have your address.

In particular, attack does not depend on an existing third party seller having poor PII handling hygiene, like the articles have implied.

RE: https://mstdn.ca/@drikanis/116107120926277506

I'd like to comment on the common "AI is just a tool" thing: I'm a woodworker by training & that means a lot of machines - but almost every craftsperson knows how to do their job with hand tools, or "lesser" machines.

Similarly, a writer can write without a text editor - just as well, only slower.

If loss of a tool = loss of your skill & knowledge, then that tool isn't an asset, it's a liability. You're signing over your ability to do business to whoever sells & maintains that tool.

#AI

RE: https://flipboard.com/@associatedpress/top-stories-u7govdf1z/-/a-Dpz7LK2BRzGyXWsVpl3LMA%3Aa%3A3199720-%2F0

this is completely against the Voting Rights Act ―because proof has never been enough for fascists.

they will demand you look exactly like whatever photo they decide is you and write exactly the signature they decide is yours. oh, you don't live in the same address? can’t vote. forget about transitioning: you’re a cis woman who had plastic surgery? too bad.

ALL OF THESE EXCUSES WERE USED BEFORE THE #VRA

white people, the fascists are coming for your right to vote.

#USpol #2026Elections

@ultranurd You can open an article in News via the share sheet from the web page.

@mjg59 According to this article [1], if FileVault is set up prior to Tahoe, the iCloud account recovery option stores the key accessible to Apple (not E2EE). If FileVault is newly enabled on Tahoe, then it stores the key in iCloud Keychain. I tested it just now--the previous iCloud account recovery method indeed was not presented as an option, and the key was present in Passwords.app [2].

"Or you could opt to use iCloud escrow, where the key was stored as part of your data on Apple’s servers without strong security"

[1] https://sixcolors.com/post/2025/09/filevault-on-macos-tahoe-no-longer-uses-icloud-to-store-its-recovery-key/
[2] https://support.apple.com/guide/passwords/filevault-recovery-key-mchl307c4fa9/2.0/mac/26

FileVault on macOS Tahoe uses iCloud Keychain to store its Recovery Key

In macOS 26 Tahoe, Apple has updated how it manages encryption keys in FileVault, the feature that protects your Mac’s data volume by encrypting it. Users with existing choices won’t be…

Six Colors

Let’s be honest, Ring was already some technocratic, dystopian BS, but if you needed a reason to finally, finally kill it with fire, here’s your reason: Ring is partnering with Flock to help ICE spy on you and your neighbors for the government 👀

#Technology #InfoSec
https://techcrunch.com/2025/10/16/amazons-ring-to-partner-with-flock-a-network-of-ai-cameras-used-by-ice-feds-and-police/

Amazon's Ring to partner with Flock, a network of AI cameras used by ICE, feds, and police | TechCrunch

Agencies that use Flock can request that Ring doorbell users share footage to help with "evidence collection and investigative work."

TechCrunch
@dalias It's outside my wheelhouse, but sounds possible if it pushes the device out of spec? In general, I'd guess it's more common that this failure is because the device doesn't have the resistors at all (cutting corners)
@dalias iirc, USB-A will always supply 5V but USB-C needs to negotiate USB PD first which requires a certain resistor configuration on the device side