- cross-posted to:
- technology@lemmy.world
- cross-posted to:
- technology@lemmy.world
Summary
Proton Mail, known for its privacy-first email services, faced backlash after CEO Andy Yen praised the Republican Party and its antitrust stance.
The company initially posted and deleted a statement supporting Yen’s comments, later claiming an “internal miscommunication” and reiterating its political neutrality.
Critics question Proton’s impartiality, particularly as it cooperates with Swiss authorities on legal data requests.
Privacy advocates warn that political alignments could undermine trust, especially for Proton’s users—journalists and activists wary of government surveillance under administrations like Trump’s.
I think the major difference is that for a software package or operating system like GrapheneOS, theoretically people can audit the code and verify that it is secure (of course in practice this is not something that 99% of people will ever do). So to some extent, you technically don’t have to put a ton of trust into the GrapheneOS devs, especially with features like reproducible builds allowing you to verify that the software you’re running is the same software as the repository.
For something like Proton where you’re using a service someone else is running, you sort of have to trust the provider by default. You can’t guarantee that they’re not leaking information about you, since there’s no way for you to tell what their servers are doing with your data. Accordingly, to some extent, if you don’t trust the team behind the service, it isn’t unreasonable to start doubting the service.
This is where audits come into place. Currently Proton only made the result of their security audit public, but you can also get an accounting firm to audit the privacy statement. Not endorsing them or anything, but PureVPN has been audited by iirc Deloitte on their privacy statement. I have verified this a couple year by then sharing the conclusion of the report from Deloitte with signature.
Proton should do something similar and yearly and could have a lot more faith in them. An accountant isn’t going to risk his career for something like Proton’s privacy statement. At least I would hope not