| ▲ | 93po 2 days ago |
| they didnt do it because CERT said they legally had to - they did it presumably because they pay CERT to catch abuse and misuse and take action based on their findings |
|
| ▲ | BoredPositron 2 days ago | parent [-] |
| This doesn't change my statement, even if they take the word of the CERTs as gospel. This represents a significant attack vector for denial-of-service attacks, as demonstrated by what happened here, and for a service like Proton, such a vulnerability is nearly inexcusable. |
| |
| ▲ | 93po 2 days ago | parent [-] | | What's the attack vector? I'm genuinely curious, I'm not seeing it. My understanding that I'm too lazy to investigate further is that the use of this account by a journalist got caught up in a block of accounts because the nature of its legitimate activities too closely mimicked the behavior used by illegitimate accounts. No one can force a journalist's account to take actions if they don't have the credentials of the account. | | |
| ▲ | BoredPositron 2 days ago | parent [-] | | Automated Trust Chain. According to their official statement, the accounts were reinstated following individual review. The vector is that legitimate accounts that don't break the ToS get dumped in a big set of accounts that actually do. A classic case of automated systems being gamed to trigger false positives. The vague statement about other accounts from the same set that couldn't be restored while not explicitly naming that these accounts were also phrack accounts makes the case even stronger. It was a denial-of-service and they blatantly didn't care until social media outrage hit them. I am not even blaming the CERT here maybe they were real false positives on their side. It's on Proton. They need to verify before taking actions against their own customers. |
|
|
