12mo ago

Proton Mail goes AI, security-focused userbase goes ‘what on earth’

pivot-to-ai.com Proton Mail goes AI, security-focused userbase goes ‘what on earth’

If an organization runs a survey in 2024 on whether it should get into AI, then they’ve already bodged an LLM into the system and they’re seeing if they can get away with it. Proton Mail is a priva…

we appear to be the first to write up the outrage coherently too. much thanks to the illustrious @self

184 comments

Well, I was contemplating Protonmail...
I'm in the process of degoogling and dewindowing. I'll be dammed if I'm going towards ANYthing even related to"artificial intelligence" if I can help it.
Feckin bullshit.
- I'm pretty happy with Tutanota all things considered. There are some tradeoffs back and forth between the two, but I think it's neat they run on renewable energy. And they're very focussed on being open source which I also appreciate.
  Maybe an option worth looking into. They're also encrypted (though I wish either them or proton had an option not to be) and have a free tier)
  Hope you find what you're looking for!
  
  I’ve been using Mailbox.org. I tried Tutanota but the domain name was just awful.
  
  Thanks
- I'll mention I went to Fastmail (mainly because they're an Aus company as well as the privacy stuff), so far so good.
  
  fastmail is viciously anti union however https://union.place/@fastmailunited/112672408714595554
- It's not even in the consumer version. Also it's a optional local LLM running in your browser for basic stuff
  
  though to be honest, the fact that you think this is local-only and only affects business accounts perfectly demonstrates how fucking dangerous Proton’s marketing and design around this feature is

Eamonn Maguire, author of the Proton Scribe announcement post, responded to my tweet with this: https://x.com/EamonnMagu14645/status/1814062340863651965
We built this as an opt-in alternative to the non-privacy centric options on the market.
Our goal is always privacy by default, we want to make that possible in the GenAI world too given the number of businesses already using it, and the privacy risks other options pose.
- not sure how legit that account is, actually. It's not the one I @'ed - this one was created in Jan 2024 - either it's his low-key alt or a bot
  perhaps his plausible deniability account.
  
  do you get banned from twitter if you call him a fucking asshole?
  I’m working on a more detailed reply on mastodon but to be honest, I’m pretty sure he didn’t read the original post

the usefulness of any feature should be measured in how deep you can bury its "opt-in" option in the settings pages without hurting its adoption

Great, just as I've decided to switch some services to Proton (mail and VPN).
Now I'll have to reconsider this decision.
- The fact that you never realized that you should've self hosted since all corporations will inevitably follow the money, and that politics will always be tied to money, therefore all corporations will make political decisions against your interests makes me lose hope in common sense.
  
  it’s time for you to fuck off back to your self-hosted services that surely aren’t just a stack of constantly broken docker containers running on an old Dell in your closet
  but wait, what’s this?
  @BaroqueInMind@lemmy.one
  oh you poor fucking baby, you couldn’t figure out how to self-host lemmy! and it’s so easy compared with mail too! so much for common sense!
  
  don't shame people for not having the capacity to run their own infra, jeez
  
  @BaroqueInMind @cordlesslamp You unironically use words like "windoze" don't you?

Right after this I spot the announcement post on my front page, in !protonprivacy@lemmy.world. I'm surprised just how positive the comments are.
- Same, tbh. I went on their subreddit expecting a shitstorm but the announcement sits at like 85% upvotes with mostly positive replies.
  What kind of bizarro world have I stumbled into?
  At least the top-level comments seem to be split.
  
  between that thread’s activity pattern and how hard they tried to fudge the numbers on their own survey to make this feature look popular: boy there’s a lot of stank on this one
  but hey here’s some worrying shit straight from the Proton team:
  Our business audience was the most interested in a writing assistant, this is why we started gradually rolling it out starting with Business and Visionary plans. We will look into making it available to more users at a later date!
  so there’s something utterly fucking obvious for the “it’s only for business users” posters to consider; they’re doing the same frog boiling shit that all LLM fuckheads do.
  I’m tempted to crosspost David’s article and my mastodon thread to that community, since Proton hasn’t really replied otherwise, and they seem plenty active there answering softball questions and removing posts. I don’t look forward to the Kagi-level shitstorm in my inbox afterwards though
  
  Reddit content is paid/generated content. It is literally part of their commercial offering to customers that they can expertly deceive their users. It is an advertising platform and you use it to try and force a public image.

The good news is I barely use Protonmail (or email at all, for that matter).
The bad news is I have a fucking Proton account. Fuck.
- they're still least worst, but "oh the fuck no" is the correct reaction

"Pro privacy" company that cucked to the state to get a climate activist arrested (against their privacy policy that they sneakily change after the fact) are actually a bunch of typical corporate grifters that sell out their userbase to promote shitty llm garbage? Nawwwwwww. Say it ain't so! It's like every week or month after I argue about these shitty fake privacy companies with idiots in c/privacy I recieve massive vindication. Maybe this is my sign to become a man of faith.
- I'm also sick of hearing about Swiss privacy laws. Their intelligence service got busted covering for a US and German spy front operation in Switzerland. If it happened once, I promise it has happened before and since.
  Edit for those who can't click: a front company in Switzerland sold fake encrypted communications services around the world for years, possibly decades, with the assistance of Swiss intelligence agencies.
  
  it's as if swiss privacy laws are only useful for big time, pre-crypto, old school money laundering
- What's your alternative to the fake privacy company? I'm assuming the correct thing would be: if your threat model does not include governments, self hosted email, or if it does include governments, probably don't use email.
  
  Self hosted email is its own can of worms. I wouldn't recommend it to anyone outside of experienced IT people. You'll end up blacklisted before you send your first email if you do anything wrong (and there's a lot that can go wrong), and it doesn't solve any security problems email has.
  Anything sent over email just isn't private. That goes for Proton customers when they send or receive anything from a non-Proton address too. The one thing privacy email providers can actually do is keep your inbox from being scanned by LLMs and advertisers. That doesn't prevent the inboxes and outboxes of your contacts from being scanned, though.
  If you use email, the best thing you can do is be mindful of what kinds of information you send through it. Use aliases via services like simple login or anonaddy when possible. Having a leaked email is a security vulnerability. Once bad actors have your email, they now have half of what they need to breach multiple accounts.
  
  Self hosting on a bulletproof vps that actually deletes their logs and has a proven track record like buyvm is my preferred solution. I used this guide. It's not perfect, it doesn't set up encryption, and is a bit dated, but it's an okay starting point. I didn't bother setting up rspamd. You can also technically avoid setting up dovecot if you don't want to use IMAP/POP3, but really limits your selection of mail clients to basically mailx and friends. This setup will let you mail to major mail providers, but be wary of what TLD you buy, my .work TLD means I get autospammed. :(
- I must have missed the climate activist getting arrested because of protonmail. Any link or a name to search from?
  
  https://www.theverge.com/2021/9/6/22659861/protonmail-swiss-court-order-french-climate-activist-arrest-identification

Once they activate the acausality module, you can write those responses before they even send the initial email!
- Alright Eschaton
- Most email providers already have this feature it's called automatic out-of-office reply.

I went to Proton for the explicit reason I didn't want Google scanning all my docs. Glad I moved away from them now, hopefully Fastmail doesn't do the same.
- It's a local model running in your browser though
  
  Doesn't sound like it
  Your prompt — that is, the email you’re writing — is kept in plain text on their server
  Besides, I just don't want AI in general, is that too much to ask? I wonder how long it will be until there are companies actively promoting their lack of AI.
  
  read the fucking article before you multi-post your uninformed shit in this thread, thanks

Oh for fucks sake. I don't use their email but I don't want to have to switch VPN service AGAIN.

Never rely on multi services products from a company. I know it’s more practical but you get the real benefits of having spread services.

Rhaa fk, enshitification... I don't want to host my emails...

tbf it's only in the business plans and some of the legacy lifer type plans, but yeah, wildin
- just a little violation of my trust for the company I pay for privacy and encryption services. as a treat.

It should be an option that is turned off
- it was acausally enabled before you clicked on it, for your comfort and convenience, like the new ad tracker built into Firefox 128
- alternatively, if the only version of this that doesn’t break Proton’s e2e security model is the local-only version, maybe don’t ship the cloud hosted version of the feature under any circumstances
  I’d still hate the feature because the LLM model’s derived from plagiarized work and the labor of exploited workers from the global south, but this didn’t have to be a fucking privacy catastrophe

With Skiff going down at the end of the month and Proton gearing up to start data mining, there are very limited options for private email hosting. Basically Tuta and a few others now.

Glad I stuck with mailbox.org.
- I'm not familiar with them. What makes them more privacy focused?
  
  It's encrypted and based out of Germany (so, outside of five eyes). The ui is shit but if you use an app for email it's great. They also offer anonymous payment methods if you're into that.

i hate proton because they store ips and give them to the police even if they wouldn't need to

Why is that an issue? I deploy local LLMs for work and none of the content they use or generate goes outside the encrypted active domain, so no security issues or privacy issues. The question is how contained the LLM is, that's all.
- did you read the parts of the article that describe why the LLM is an issue?
  
  Shouldn't the headline be about unencrypted text prompts, rather than AI?

Mistral isn't trained on copy righted data. It's based off selective databases that were open use. This article in general is full of false information. But I suppose most people only read the headlines.
- https://huggingface.co/mistralai/Mistral-7B-v0.1/discussions/8#6527a6fca6eaf92e6c26fa59
  Unfortunately we're unable to share details about the training and the datasets (extracted from the open Web) due to the highly competitive nature of the field.
  The "open web" is full of copyrighted material.
  
  We had a social contract!
  
  but it's apache2 sega! tooooootes freebies!
- was this incorrect? https://www.patronus.ai/blog/introducing-copyright-catcher
  
  Yes, they are incorrect:
  https://arstechnica.com/information-technology/2023/07/why-ai-detectors-think-the-us-constitution-was-written-by-ai/

184 comments