How will they take that IP address if Proton doesn’t log them? They can be asked to log for Proton Mail because the law permits that, but nobody can force Proton VPN to log.
Sorry in advance; I’ve not looked into this extensively and I can’t at this very minute study Proton’s privacy policy, but here are a few snappy excerpts:
Data collection is limited to the following:
2.1 Visiting proton.me or protonvpn.com website: We employ a local installation of self-developed analytics tools. Analytics are anonymized whenever possible and stored locally (and not on the cloud). IP addresses are not retained and stored for such analytics.
But are they stored for other reasons?
IP addresses, email addresses, and phone numbers provided are saved temporarily in order to send you a verification code and for anti-spam purposes. The period of temporary data retention is determined by our legitimate interests of protecting the service…
2.5 IP logging: By default, we do not keep permanent IP logs in relation with your Account. However, IP logs may be kept temporarily to combat abuse and fraud, and your IP address may be retained permanently if you are engaged in activities that breach our terms and conditions (e.g. spamming, DDoS attacks against our infrastructure, brute force attacks).
So Proton can choose to save IP addresses for frivolous reasons, such as a supposed breach of their T&Cs?
Here is the privacy policy of Proton VPN: Proton VPN - Privacy Policy | Proton VPN
Off-topic
I wonder when IVPN is going to support flatpak
Even better is to do everything locally on your computer. It’s free!
Not these two, obviously
Not read through your entire post yet (still busy), but regarding your point: “Slightly misleading to conflate privacy policies of the Website, of their mail service, and of their VPN to be one and the same.”
Seems you missed the point. I raised a question about whether the IP addresses of users logging into Proton Mail (it appears Proton’s privacy policy reserves them the right to log addresses) can be married up with the actual IP addresses of their users who rely on Proton VPN for privacy.
Whether Tuta logs IP address or not, if the user has Proton VPN, assumedly that degree of separation provides the user some protection?
Therefore, my question is (if it was not clear): might it be considered safer to use Tuta email if sticking with Proton VPN, rather than stick all our eggs in the Proton basket?
Read this from Tuta (the reason for my original questions):
“…you might still want to keep your IP address hidden even from us, which is why we will never add a VPN or a browser to our offer. Offering a VPN does not make any sense. Because if we did, we as the email provider would still be able to find out the users’ original IP addresses, if the connection were to be made via this VPN. For privacy reasons, it is better to keep the two services separated.”
P.S. Not everyone here are experts. Some are at the beginning of their journey and are seeking advice.
Thanks for your help. Will have a sit down tonight and have a proper look.
Off topic (Tor)
Been trying to make a Tuta account via Tor, but none of them pass validation. But that’s a separate headache.
Can’t make a Proton account without giving them another email address. Not ideal if attempting the highest level of privacy.
Try using a country which you think might be of least concern as exit node. Create an account.
It will work but be sure to have a spare Proton Account created via Tor so incase if your Tuta account is picked by abuse prevention you need to write to them to unblock it manually.
Not related to email, but worth reading: Your VPN provider won't go to jail for you for 5 dollars
For the marketing I don’t really see the issue. It’s very clear to me what the upfront cost is and this is a very common presentation.
For the Black Friday sale I’ve been able to apply it to an existing subscription as long as the new plan was longer than the current one. For instance I had an annual plan but during the sale I bought a two year plan. The rest of my first year got pro-rated to the new lower price. Didn’t expect that but it was my experience two years an ago.
Possible but extreme situation
Proton VPN doesn’t log IP but ISP can log them. Proton Mail logs IP if the law permits. Now it isn’t easy to find the missing piece of puzzle?
Proton has plus plans for mail, VPN, drive and pass. We can have more flexibility if its possible to club two plus plans instead of paying for unlimited.
This is the process flow illustrated everwhere.
Disclaimer: The below details may be wrong. Feel free to speak up if there are any inaccuracies.
I used opensnitch to check this.
While connecting to VPN opensnitch shows outgoing connection to say 192.0.1.1. After VPN is connected the IP shown in VPN app and IP leaks website is 192.0.1.3. So the above flow would be
You > ISP > ProtonVPN server (192.0.1.1) > ProtonVPN Internal IP (192.0.1.3) > ProtonMail
So ISP can see connection to ProtonVPN server, cannot see ProtonVPN Internal IP and activities in ProtonMail. ProtonMail can see nothing more than ProtonVPN Internal IP.
This, IMHO, is legally untested at best when it comes to connecting to Proton Mail.
A mail provider that’s required to log IPs saying oh, we can’t log because we put our own VPN in front of the servers isn’t something I think will hold up. That would be quite a loophole for any provider.
I think when Proton tries this the response they’ll get is that they need to log the IP address at the edge of their infrastructure, and their infrastructure pretty clearly includes ProtonVPN.
If you use a VPN other than ProtonVPN with Proton Mail then you should be good, obviously in that case Proton would have no way of knowing your IP.
And if you use ProtonVPN to connect to something other than Proton’s services, I agree Proton couldn’t be forced to log in that case.
It’s important to note that Proton disagrees with me here, and thinks using Proton VPN with ProtonMail would legally protect you. I am also not a lawyer.
Up to you if you want to take the risk.
Tested this with another VPN too. Thats the nearest conclusion I can reach. Search engines were not useful based on my search. AI responses were hallucinated but all the responses were either this or this.
Dark Patterns
Yes, it’s a very common presentation indeed. But it’s misleading, because they clearly want people to focus on the monthly cost and not the yearly cost, when they will be paying the latter. To me, that’s a dark pattern.
It would be very easy for Proton and other companies to be more upfront and emphasize the yearly cost. There’s a reason why they don’t do it, even though both prices (monthly and yearly) are visible, though one more than the other.
Discounts
In regard to discounts, it’s my understanding that if you got one for your current subscription, you are not eligible for a new one, unless it’s for a different product. So if you got a discount for Proton Mail Plus last year, you can still get one for Proton Unlimited.
Although I imagine that most people are happy with the Proton Unlimited discounts, I am personally weary of them. Because, although they are sometimes affordable, I always do the math of how much they will cost after they expire, and it’s clear that it’s too expensive for me. Hence, why I never bite.
Of course, if you get a discount for a 1 or 2 year subscription, it gives you time to find the money for when you’ll be charged at regular price. Still, when it comes to Proton unlimited, unless I’m sure I can afford the regular price, I won’t go for the discount,
I personally wish Proton did lifetime discounts. They’ve only done it once, for Proton Pass, but I suspect that it’s only because it was a new product. I doubt they’ll do it again.
There are privacy products that I’m only able to afford because I have a lifetime discount. I don’t think Proton is that affordable, but even it I thought it was, subscriptions add up. If I’m paying 10 $40/year subscriptions, that is a lot!
Proton is amazing for the casual privacy aware users.
The pros know that is always better to “decentralize” their tools selections.
The pros know it’s best to use the best tool for their specific situation. That’s why there’s a guide on threat modeling.