Proton launches self-custody bitcoin wallet

[pooya87]

They added BIP39 to their email recovery option back in 2022, it sure took them long enough to add bitcoin wallet feature.

In any case this sounds intriguing to have a bitcoin web wallet that you can access just through your email account while you also access all the other tools (VPN, storage, etc.) that this company offers. As long as you don't store your coins there and only use it for pocket change, it's a cool tool.

[PrivacyG]

I do not know.  I have very mixed feelings about this but they are mostly leaning toward a negative one.  Proton has been looking kind of sketchy in my eyes particularly over the last years.

They have a VPN they advertise as providing Privacy and Freedom to their Users.  However.  The VPN requires a Proton Account.  How does that work?  How do I have Privacy if all my connections are directed through the same Account that I have?  It is also increasingly harder to create a Proton Account without involving personal information such as a Mobile Phone Number.  It was all nice and great before, back when you could have an Account in a few clicks.  Now it just seems sketchy.

I wanted to give this a try.  So I click the link and the first thing I am met with is a Sign In page telling me they need my Java Script enabled to proceed.  Web Wallets are not my preference anyway.  In fact, they are some where at the bottom of the list of preferences, close to Custodial Wallets.  A Web Wallet can not be more Secure than an Open Source Wallet such as Electrum.

Fuck that.  I do not trust them any more.

[ABCbits]

They have a VPN they advertise as providing Privacy and Freedom to their Users.  However.  The VPN requires a Proton Account.  How does that work?  How do I have Privacy if all my connections are directed through the same Account that I have?  It is also increasingly harder to create a Proton Account without involving personal information such as a Mobile Phone Number.  It was all nice and great before, back when you could have an Account in a few clicks.  Now it just seems sketchy.

I've seen some people complaint about it. They claim it it's done to prevent spam or abuse of their free tier, but AFAIK they doesn't provide choice to pay for non-free tier during registration. And i just found they write blog about register email without phone number[1], which is ironic.

I wanted to give this a try.  So I click the link and the first thing I am met with is a Sign In page telling me they need my Java Script enabled to proceed. 

Which apply to most modern website. And this part isn't surprising since they have their own CAPTCHA system[2].

[1] https://proton.me/blog/create-an-email-account-without-phone-number-verification
[2] https://proton.me/blog/proton-captcha

[DaveF]

I do not know.  I have very mixed feelings about this but they are mostly leaning toward a negative one.  Proton has been looking kind of sketchy in my eyes particularly over the last years.

They have a VPN they advertise as providing Privacy and Freedom to their Users.  However.  The VPN requires a Proton Account.  How does that work?  How do I have Privacy if all my connections are directed through the same Account that I have?  It is also increasingly harder to create a Proton Account without involving personal information such as a Mobile Phone Number.  It was all nice and great before, back when you could have an Account in a few clicks.  Now it just seems sketchy.

I wanted to give this a try.  So I click the link and the first thing I am met with is a Sign In page telling me they need my Java Script enabled to proceed.  Web Wallets are not my preference anyway.  In fact, they are some where at the bottom of the list of preferences, close to Custodial Wallets.  A Web Wallet can not be more Secure than an Open Source Wallet such as Electrum.

Fuck that.  I do not trust them any more.

Just a nitpick from the one letter I bolded above.
Your Proton VPN account does NOT have to be the same one you send & receive mail through.
You can setup & configure the VPN though an account you set up at that point in time and then create another one while VPNed in to create an email.

I think the web / hot wallet thing has been discussed to death. It's a hot insecure wallet, just like the one in your pants. Don't leave more in then you are prepared to loose.

-Dave

[PrivacyG]

Interesting, last time I experimented with creating a Proton Account I met this issue where I was obliged to either use a Mobile Phone number as verification or to abandon the process entirely.  I did not know of this pretty recent article.

-----

Which apply to most modern website. And this part isn't surprising since they have their own CAPTCHA system[2].

I have to agree, only up to the point where Proton advertises themselves in various ways that attracts a specific type of Customers.  Almost any where you look on their website, they advertise themselves as the Service that frees you from the Big Tech.

Many email services, citing security reasons, require a phone number for identity verification. This creates an unfortunate paradox in which you must give up a highly sensitive piece of personal data to Big Tech.

https://proton.me/blog/create-an-email-account-without-phone-number-verification

A better internet starts with privacy and freedom
Choose an internet where your privacy comes first
With Proton, your data belongs to you, not tech companies, governments, or hackers.

https://proton.me/

More importantly, on the front page they mention this,

Most tech companies, whether it’s Google or Apple, define privacy as “nobody can exploit your data except for us.” - We disagree. We believe nobody should be able to exploit your data, period.

Java Script is a deal breaker for me.  Even if it is as Private and Secure as they make it seem, Java Script being mandatory is instantly a no go.  It can be exploited, so the entire 'no body should be able to exploit your data, period' argument falls short in my eyes.

I am really skeptical about Proton generally anyway.  The motive of the entire project is a question mark for me.  They had scandals and controversies in the past too which further raised more questions for me.  They promised they would not hand out any IP to any body and then they handed IPs for a case of the Authorities and after being under fire for it they deleted the statement from their Policy.  I find it very suspect to have a project that 'promotes Freedom and Privacy' not being subject to a lot of hatred from Governments.  It is being praised even by the United Nations.

Fishy if you ask me.

[pooya87]

Fishy if you ask me.

Anything centralized should be considered fishy when it comes to privacy related matters. There is just no way there can be a company with a physical location (centralized point of failure) that the government is not going to visit and put pressure on then owners to cooperate with the authorities.

We simply don't need any other reason than that in my opinion.

[RickDeckard]

Fishy if you ask me.

Anything centralized should be considered fishy when it comes to privacy related matters. There is just no way there can be a company with a physical location (centralized point of failure) that the government is not going to visit and put pressure on then owners to cooperate with the authorities.

We simply don't need any other reason than that in my opinion.

+1 on this one. While I understand that having centralized services is great for the overall population - after all most people that I know really want to have all their services in just one place (let it be e-mail, documents, photos, etc) - this kind of business also becomes really interesting from a data gathering point of information. Albeit that Proton has all the motives to avoid doing this considering that it actually acts as a pillar of protecting their customers so any kind of leak or news that could scratch this image would surely mean the company demise.

[keychainX]

Granted, I am a Proton enthusiast. But I would not want to use this wallet. This is effectively a web wallet in the style of Bitamp, so any extension or userscript or some other malicious code that compromises your web browser can add a stealer.

I don't think the wallet is open source either. I don't know. I just wrote to customer support asking about that.

It is open source:
https://github.com/protonwallet/

Amazing that you are a visionary. I find that quite expensive, I would like to make a one time paymnet to become a supporter with some new features , but they do not have such plan...

We have the visionary but would never attach a BTC wallet address to the mail account

/KX

[bitmover]

Hey, I finally got access to my proton wallet!!

I have 5 invites. Anyone wants?

It looks a nice wallet. It supports 12-24 words and also a passphrase.

[ABCbits]

Hey, I finally got access to my proton wallet!!

I have 5 invites. Anyone wants?

It looks a nice wallet. It supports 12-24 words and also a passphrase.

I'm not interested with the invites. But do you plan to make a short review or impression? While i wouldn't use it, i certainly hope it's more promising than other web wallet out there.

[dkbit98]

It looks a nice wallet. It supports 12-24 words and also a passphrase.

I am not impressed so far.
This is just another web wallet that I wouldn't consider safe enough for my daily use.
In case Proton server is down you won't be able to use Proton wallet either, only you can do is importing seed words to your own wallet.
Receiving Bitcoin with email is cool. but this sounds worse to me than using single wallet address, and I don't know anyone who offered to send/receive BTC with proton email.

[bitmover]

Receiving Bitcoin with email is cool. but this sounds worse to me than using single wallet address, and I don't know anyone who offered to send/receive BTC with proton email.

Maybe it could be an interesting way to introduces bitcoin to older people.

Maybe my father will find Interesting to receive bitcoin using an email  . And if he wants to know more, he can just look further in the same wallet

I think overall this wallet is similar and even a competitor to blockchain.info . However,  it looks better and safer

I'm not interested with the invites. But do you plan to make a short review or impression? While i wouldn't use it, i certainly hope it's more promising than other web wallet out there.

This could be a nice idea .
I can send you 5 usd using my email in this wallet to your email, and then you can send me back. Then we can share the experience.

But I will only be able to it in a few days because I am traveling now   

[PrivacyG]

Maybe my father will find Interesting to receive bitcoin using an email  . And if he wants to know more, he can just look further in the same wallet

Which is also a bad idea if you ask me.  Particularly if older people are involved, which are also easier to fool.  A few ideas popped up in my mind for potential Scams and I am sure some idiots will not only think the same but put the Scams into practice too.

[JollyGood]

When weighing up all the benefits related to the company behind it, the fact remains it is still a web wallet and that will entail a degree of concern even for the most open minded crypto enthusiasts.

Keeping that aside, though not directly relevant to their Bitcoin wallet it is important to mention in the past Proton had to face massive negative publicity for claims they made on their website (we do not keep any IP logs) but only to remove the words from their Privacy Policy after the backlash.

It may have happened in 2021 but apparently it seems Proton handed over email related information including IP addresses to French authorities that requested them via a Swiss court. When that request arrived, the Swiss judge forced Proton to log and disclose the IP and browser fingerprint of a specific person. That basically is shocking even though they provided mitigation by saying they had no choice as it was a legal request they had to comply with. All that because the French authorities were seeking information on a climate activist.

Back to their web wallet, I would advise against using it for the same reasons you have cited.

There is no single reason that will push me and many other people to use Proton Wallet instead of Electrum and Sparrow.

Me neither, to be honest. I am using a combination of hardware wallets, desktop, and mobile wallets, and see no reason to bring a web wallet into the mix. Regardless of the company behind it and its non-custodial nature, it remains a web wallet that relies heavily on storing sensitive data on centralized servers. A leak, hack, or an unhappy employee could cause a lot of problems.

[NotATether]

It may have happened in 2021 but apparently it seems Proton handed over email related information including IP addresses to French authorities that requested them via a Swiss court. When that request arrived, the Swiss judge forced Proton to log and disclose the IP and browser fingerprint of a specific person. That basically is shocking even though they provided mitigation by saying they had no choice as it was a legal request they had to comply with. All that because the French authorities were seeking information on a climate activist.

This is more of a problem with France than with Proton. Just yesterday, they also arrested the Telegram founder Pavel Durov for not giving them the encryption keys to decrypt all of their user's messages.

And you know what would happen once one government gets a hold of the decryption keys, they share them with all the other governments upon request.

[Pmalek]

This is just another web wallet that I wouldn't consider safe enough for my daily use.
In case Proton server is down you won't be able to use Proton wallet either, only you can do is importing seed words to your own wallet.

You are approaching this from the wrong angle. Of course Proton Wallet isn't as safe as hardware wallets, airgapped systems, or most quality desktop/mobile wallets, but you shouldn't compare it with those superior products. It should only be compared with other web wallets because that's what it is.

What you did is like saying I don't like this new skateboard. It's not as safe as my car, is much slower, offers me no protection against rain and heat, and I get tired pushing myself constantly on the road. That's because you are comparing it to a car, which it isn't meant to be tested against. It's only for skateboard enthusiasts.

[JollyGood]

It may have happened in 2021 but apparently it seems Proton handed over email related information including IP addresses to French authorities that requested them via a Swiss court. When that request arrived, the Swiss judge forced Proton to log and disclose the IP and browser fingerprint of a specific person. That basically is shocking even though they provided mitigation by saying they had no choice as it was a legal request they had to comply with. All that because the French authorities were seeking information on a climate activist.

This is more of a problem with France than with Proton. Just yesterday, they also arrested the Telegram founder Pavel Durov for not giving them the encryption keys to decrypt all of their user's messages.

I think the issue about the climate activist was down to a Swiss court forcing Proton to adhere to the ruling/request. They did state later that the French authorities would never have been able to identify/locate the climate activist if he had used a VPN as they would have handed over the VPN IP address rather than the IP address of the mobile phone the climate activist was using at the time. Still, they published one piece of information about their no-logging policy but breached it and removed it entirely from their website after the backlash.

And you know what would happen once one government gets a hold of the decryption keys, they share them with all the other governments upon request.

If he had access to the decryption keys at the time of the arrest in France then many Telegram users will certainly be worried but I doubt he would carry them with him. It seems the problem France have against Durov is the lack of moderation on Telegram. If that is the case they have against him then owners/operators and shareholders of Microsoft, Meta, Google and many others should have been arrested when they stepped foot in France too because platforms they provide are hardly moderated.

[DaveF]

It may have happened in 2021 but apparently it seems Proton handed over email related information including IP addresses to French authorities that requested them via a Swiss court. When that request arrived, the Swiss judge forced Proton to log and disclose the IP and browser fingerprint of a specific person. That basically is shocking even though they provided mitigation by saying they had no choice as it was a legal request they had to comply with. All that because the French authorities were seeking information on a climate activist.

This is more of a problem with France than with Proton. Just yesterday, they also arrested the Telegram founder Pavel Durov for not giving them the encryption keys to decrypt all of their user's messages.

I think the issue about the climate activist was down to a Swiss court forcing Proton to adhere to the ruling/request. They did state later that the French authorities would never have been able to identify/locate the climate activist if he had used a VPN as they would have handed over the VPN IP address rather than the IP address of the mobile phone the climate activist was using at the time. Still, they published one piece of information about their no-logging policy but breached it and removed it entirely from their website after the backlash.

And you know what would happen once one government gets a hold of the decryption keys, they share them with all the other governments upon request.

If he had access to the decryption keys at the time of the arrest in France then many Telegram users will certainly be worried but I doubt he would carry them with him. It seems the problem France have against Durov is the lack of moderation on Telegram. If that is the case they have against him then owners/operators and shareholders of Microsoft, Meta, Google and many others should have been arrested when they stepped foot in France too because platforms they provide are hardly moderated.

There is a difference between a platform being hardly moderated and the police / government showing up and saying your platform is being used for a crime here is the what we have about when and where and how the crime is being committed and all you have to do is show us who.

If ask to borrow your car and you say yes and then I use it to rob a bank you are probably not going to be charged with anything.

If the cops show up BEFORE I ASK and tell you that I rob banks and borrow peoples cars to do it and they found out I am going to rob a bank later today and you still loan me your car then yeah, they are coming after you too.

-Dave

[JollyGood]

Sure there is a difference but when it comes to large corporations you would expect them all to plead ignorance citing a wide array of excuses regardless of their actual involvement (or lack of) in others breaking their terms and conditions.

As for the excellent analogy you stated, I think giving you the car as a loan without knowing you were going to rob a bank does not provide defence because the prosecution will try their best to demonstrate there was collusion even though I was innocent. Would a jury accept it? I do not know but I would not be the only innocent person imprisoned.

Many people view this as double standards being implemented by law enforcement agencies that allow some tech giants to get away with dubious conduct but aggressively pursue others for reasons that cannot be understood.

There is a difference between a platform being hardly moderated and the police / government showing up and saying your platform is being used for a crime here is the what we have about when and where and how the crime is being committed and all you have to do is show us who.

If ask to borrow your car and you say yes and then I use it to rob a bank you are probably not going to be charged with anything.

If the cops show up BEFORE I ASK and tell you that I rob banks and borrow peoples cars to do it and they found out I am going to rob a bank later today and you still loan me your car then yeah, they are coming after you too.

-Dave

[pooya87]

Many people view this as double standards being implemented by law enforcement agencies that allow some tech giants to get away with dubious conduct but aggressively pursue others for reasons that cannot be understood.

Yeah. Many of these so called "tech giants" or services that we see that appear to not be harassed by the law enforcement are already fully cooperating with the law enforcement! Like the case with bitcoin mixers. They are either honeypots that continue to exist or they refuse to cooperate and get shut down. Like the Wasabi wallet versus Samourai wallet case. Or Meta versus Telegram. One is cooperating with them, the other had its founder arrested.