According to Ortis, briefed him about a “storefront” that was being created to attract criminal targets to an online encryption service. A storefront, said Ortis, is a fake business or entity, either online or bricks-and-mortar, set up by police or intelligence agencies.

The plan was to have criminals use the storefront — an online end-to-end encryption service called Tutanota — to allow authorities to collect intelligence about them.

“So if targets begin to use that service, the agency that’s collecting that information would be able to feed it back, that information, into the Five Eyes system, and then back into the RCMP,” Ortis said.

  • ReversalHatchery@beehaw.org
    link
    fedilink
    English
    arrow-up
    6
    ·
    1 year ago

    The plan was to have criminals use the storefront — an online end-to-end encryption service called Tutanota — to allow authorities to collect intelligence about them.

    Excuse me, what?

  • privacybro@lemmy.ninja
    link
    fedilink
    English
    arrow-up
    4
    ·
    1 year ago

    Tutanota was (at least) compromised from the moment that they were ordered by German courts to spy on anyone that they were ordered to. Including skipping encryption upon email arrival. Why the hell they are suggested in the privacy space after that just proves how retarded most privacy bros are.

    • ReversalHatchery@beehaw.org
      link
      fedilink
      English
      arrow-up
      5
      ·
      edit-2
      1 year ago

      Why, what else could have they done with laws? Protonmail and literally every other provider on the clearnet is also susceptible to this.

        • ReversalHatchery@beehaw.org
          link
          fedilink
          English
          arrow-up
          2
          ·
          edit-2
          1 year ago

          Proton can be legally ordered to start recording the IP address of a specific user. That’s why they recommend that you always connect through their Onion site.
          Other than that and if that’s possible, I think it may also be possible to legally order Proton to keep the unencrypted form of incoming emails for a specific user, but Proton did not said it in the article, and Swiss laws might protect them against that. It’s certainly possible technically, and good to be aware of it, I think.

          Sorry but I can’t open the second link, as it actively resists it. I suspect though that the problem with Tutanota was not their encryption, but their legal system, which required them to keep a copy of the incoming emails.

          Also, don’t mistake me, I’m all for protonmail, and I mean this. But did you know they only encrypt the email contents? Metadata like title, sender recipient and other things in the mail header don’t get encrypted.

          • privacybro@lemmy.ninja
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 year ago

            you’re right about the IP thing. that’s a good clarification rather than just “spy”. i suppose it’s less dire than Tutanota not encrypting incoming mails if you use tor and vpn by default.

            yeah basically it more or less proves that swiss privacy is a bit stronger in this case vs Germany.

            on the proton encryption, i did know about this but does that apply to proton-to-proton, proton-to-NonProton, or both? if you have details on this let me know.

            either way the fact that they dont makes me feel that proton is a similar honeypot to signal and telegram, where they make a compromise with the five eyes, to give them metadata even if actual contents are safe. metadata can be much more powerful than contents often times

            in general email is just the worst protocol when it comes to privacy. sadly.

            • ReversalHatchery@beehaw.org
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 year ago

              on the proton encryption, i did know about this but does that apply to proton-to-proton, proton-to-NonProton, or both? if you have details on this let me know.

              As I know it applies to both. Formerly they were asking (among other things) about the titles of your latest emails for account recovery. (after I have put all the links here I realized that these don’t give a details on whether this also applies to inter-proton messages…)

              A few sources:

              https://proton.me/support/proton-mail-encryption-explained

              Subject lines and recipient/sender email addresses are encrypted but not end-to-end encrypted.

              https://www.reddit.com/r/ProtonMail/comments/b1ect2/a_question_about_encryption_metadata_subject/eiphhs7/?context=3

              https://security.stackexchange.com/questions/196265/why-is-some-meta-data-not-encrypted-in-proton-mail

              either way the fact that they dont makes me feel that proton is a similar honeypot to signal and telegram, where they make a compromise with the five eyes, to give them metadata even if actual contents are safe. metadata can be much more powerful than contents often times

              Yeah, might as well be. But if it is, I’m afraid we won’t get to know for a few decades, if ever. And I think it’s still better than the alternatives… the alternative email providers, that is.
              If it comforts you, in their reddit comment I linked they mention (in 2019…) that there’s a proposal they support for openpgp to be able to have an encrypted subject line.

              • privacybro@lemmy.ninja
                link
                fedilink
                English
                arrow-up
                1
                ·
                1 year ago

                Really appreciate your thoughts and time, thanks.

                I found out also that Tutanota is essentially the same, except that they do E2EE subject lines between tutanota users, but I am guessing that is because they don’t use PGP unlike Proton. In which case, Proton is in the right in this case because they are increasing E2EE interoperability beyond just their own users. So, my comment about honeypotting was really uncalled for I think, and I apologize for that.

                The OpenPGP proposal is interesting, but I couldn’t find anything on it. All I found was this below, which explains that email headers can’t be/aren’t encrypted, and subject is one of those, so that’s why. I have no clue what Proton was talking about, or where they got that info

                https://www.reddit.com/r/ProtonMail/comments/cku293/cant_find_the_openpgp_subject_line_encryption/

    • Otter@lemmy.ca
      link
      fedilink
      English
      arrow-up
      4
      ·
      edit-2
      1 year ago

      This is a comment from a random user, not the pinned explanation on that link, but I thought it was funny

      CBC can’t be trusted. Propaganda state media for the Liberals.

      lol what

  • AutoTL;DR@lemmings.worldB
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    This is the best summary I could come up with:


    Cameron Ortis, the former RCMP intelligence official on trial in Ottawa, says he was tipped off by a counterpart at a “foreign agency” that the people he’s accused of leaking secrets to had “moles” inside Canadian police services.

    “I had sensitive information from multiple sources that each of the subjects had compromised or penetrated Canadian law enforcement agencies,” Ortis testified last week.

    The testimony is contained in redacted transcripts released Friday evening, more than a week after the former civilian member began testifying in his defence during his unprecedented trial.

    The Crown alleges Ortis used his position as the head of a highly secret unit within the RCMP to attempt to sell intelligence gathered by Canada and its Five Eyes allies to individuals linked to the criminal underworld.

    Ortis is accused of sharing information in 2015 with Ramos, the head of Phantom Secure, a Canadian company that made encrypted devices for criminals.

    Under cross-examination, Crown prosecutor John MacFarlane asked why Ortis didn’t approach one of the Five Eyes partners to discuss his plans with them “just generally.”


    The original article contains 956 words, the summary contains 175 words. Saved 82%. I’m a bot and I’m open source!