If you have any way to check the key validity offline (for example, you subpoena the encrypted data) then it’s trivial to check and automate.
Trivial to automate, yes. The rest is a question of how long it takes to compute, that’s the basic rules of cryptography:
good algorithms are computationally more expensive to solve in one direction than the other
the hardware of tomorrow will more easily solve the cryptography of today, making it important to rotate your bits into new algorithms as old ones become more solvable
big business and big government have more power to throw at the problem, but not infinitely so; where will you fall on their wait list?
Lack of physical access to your files protects you against casual inquiries by businesses and local governments. If you’re a person of interest, they are breaking down your door and getting your bits unless they self destruct or are in a country they can’t bully.
In summary:
Don’t be a person of interest if you can avoid it.
If you live somewhere that hurting a politician’s feelings (or having the wrong demographic) will make you a person of interest, assume they will get physical access to your bits unless those bits are in an unfriendly country. What country do you want them in?
Assume they will get their hands on your bits anyway. How easy are they to decrypt, and will the juice be worth the squeeze?
Still, the idea is that Proton has everything they need to access your data (your encrypted bits, your encrypted key, and your password you send them every time you login). You have no guarantee that they don’t have something (intentionally or not) that can catch this and extract data about you.
You also (and more importantly) have no guarantee that the Swiss government can’t or won’t force them to implement such systems, and hand over your data.
They already lied about not storing your IP until a judge ordered Proton to produce it for a French national. They have since redacted their privacy policy to say they may store such data about you if requested. They can do the same to get your key.
No matter how, if they possess the keys, it’s not your crypto not secure.
Trivial to automate, yes. The rest is a question of how long it takes to compute, that’s the basic rules of cryptography:
Lack of physical access to your files protects you against casual inquiries by businesses and local governments. If you’re a person of interest, they are breaking down your door and getting your bits unless they self destruct or are in a country they can’t bully.
In summary:
Still, the idea is that Proton has everything they need to access your data (your encrypted bits, your encrypted key, and your password you send them every time you login). You have no guarantee that they don’t have something (intentionally or not) that can catch this and extract data about you.
You also (and more importantly) have no guarantee that the Swiss government can’t or won’t force them to implement such systems, and hand over your data.
They already lied about not storing your IP until a judge ordered Proton to produce it for a French national. They have since redacted their privacy policy to say they may store such data about you if requested. They can do the same to get your key.
No matter how, if they possess the keys, it’s
not your cryptonot secure.deleted by creator