p3x.de
Proton’s Lumo AI chatbot: not end-to-end encrypted, not open source
David Gerardhttps://pivot-to-ai.com/2025/08/02/protons-lumo-ai-chatbot-not-end-to-end-encrypted-not-open-source/
Share on Mastodon
Share on Reddit
Share on WhatsApp17 Comments
Comments from other communities
vaguerantI kind of wish this headline just kept going.
Proton’s Lumo AI chatbot: not end-to-end encrypted, not open source, bad taste in music, murdered family of five
Once refused to say hello into the phone a toddler handed to them, refused to talk to the stray cat like it could understand them, farted on the bus and blamed it on an old lady
James R Kirk
John RichardLike most things by Proton. The client side service is usually open source, but not server-side. I use & even pay for some services from Proton, but honestly they could probably decrypt your data if they had a reason to. They do pilot tests all the time. If you use Aurora Store, you'll frequently see some Google Play accounts get different versions of the app that haven't been rolled out to everyone.
I've noticed several times the "open-source" app on their GitHub is multiple versions behind what they're publishing on Google Store. I don't know of anyone doing automated testing for all the unpublished versions. If you use the browser—since the encryption is handled via JS—all it would take is a few small changes to get the information needed to decrypt your data.
There are some alternative open-source bridges for Proton that solve some of these issues, but most people using Proton are just using the stock apps. If you use Proton then you're prob. doing a lot more to protect your privacy from advertisers, but if you think it'll protect you from the government spying if they have a reason, then you might want to think again.
peanuts4lifeWhile the open source argument is valid, the end to end encryption critique is a bit odd to me. It is, by definition, end to end encrypted, and proton claims that the chat history is stored locally on your device and is blindly encrypted at rest on their servers, same as in their email system.
The individual messages do have to be decrypted for inference option arrival, but really there isn't another option.
What I'd like to see is evidence of 3rd party audits on this scheme in addition to more information on the models used.
They really don't help themselves. Their target customer is not the same as Gmail users.
It is tho. It is exactly that. People that have no clue about security and open source, but want to get away from google stuff.
Deleted by moderator
MothraAre you on their VPN? What service will you go for if so?
Mullvad vpn is prob the next closest.
Iirc it might also be the only and last decent one left around, but I'm not really keeping up with news. My Proton subscription will also lapse in a couple months so I might have to ask for Lemmy's advice on the matter again.
nfreakI recently switched to their VPN for torrenting because Mullvad doesn't support port forwarding but the company as a whole really rubs me the wrong way for so many reasons.
I'll probably just say fuck it and go back to Mullvad when the subscription expires, now that I built the bulk of my local library I can deal with losing port forwarding.
Jerry on PieFedThe author is trying a too hard to make a point based on their belief that Proton Mail is never unencrypted at rest. That the company never allowed such a thing. And launches an attack based on this premise.
However, it's just not true.
The Proton Mail bridge which has been around for quite some time, will leave email unencrypted at rest just by the nature that it integrates with email tools like Thunderbird and X1 Search.
So this premise, "but Proton’s email famously does not work like that. There is never plain text at rest" that is used to prove the Proton is allowing unencrypted text under certain conditions solely because they consider making money more important than privacy is a false premise. Proton never made money on the bridge, for example, but it's one case where they allowed users to decide whether it was OK to have copies of emails unencrypted at rest.
My conclusion is that the author just wants to rant against Proton.
The author, if I remember correctly from a while ago, is a lemmy user, and since this place is mostly against AI. He posts exactly what gets people riled up in here. Must have a lot of alts too, I'm guessing.
The mail bridge would run on your own computer correct? I think the author was saying the emails are never in plain text when on Proton's servers.
huppakeeLast two paragraphs of the article:
For most people this‘ll be, so what? — they still trust Google and Microsoft with all their stuff. But Proton’s whole pitch was much more than that. And Lumo walks that back a long way.
Proton’s Lumo chatbot is a pile of openwashing and securitywashing using Proton Mail’s previously solid reputation to sell you something where the security is: cross your fingers and trust us.
ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86
Following proton's recent development has been like seeing a friend become way too interested in gas station drugs
I used protonmail in its early days but stopped after they started putting resources to pursuing cryptocurrency when their mail service was still not totally complete and while they also had ambitious plans for a whole office ecosystem as an alternative to Google docs etc. Seeing the zeal for this cryptocurrency angle at the time evaporated any trust I had in their product decision-making.
That and I remember a lot of their marketing being around the fact that they had ex-CERN employees but IIRC they weren't working on anything cryptography or security related at CERN so it sounded like they were just assuming scientists are smart so people will just assume their product is safer, which was a bit sus.
This chatbot thing is totally in line with that so I guess they haven't really changed.
Unrelated to protonmail, but related to getting the wrong guy for the job. The telegram CEO said that the cryptography of telegram was coded by his brother. (The CEO is also famously not a persona non grata in Russia which likely means the FSB has access to telegram (And if they have access, more people can have it))
Nikolai Durov has two Ph.Ds in maths, and is convinced he is the smartest man in the world, and Telegram's cryptography follows directly
i made the stupid mistake of doing math, then cs
surrounded by
constantly
Fuck
How hard is it to actually have a company that provides a useful product and doesn't veer off into insanity at the first possible occasion. Why does it always end up like this.
Because a company has to be x more valuable than it was last quarter. Then it has to be done again, and again, and again, forever.
No it doesn't though. Like it literally doesn't. Who says it does? Proton isn't even publicly listed so there's literally no reason for that.
This is just a con by Big Growth to sell more charts with lines going up.
This is not actually true when using Proton's web mail interface, because the encryption and decryption is performed by javascript which is sent from Proton's server to the (signed-in, easy to identify) user every time they load the page. So, when the government comes calling, they can simply ask Proton to send certain users some slightly different javascript once which exfiltrates the targeted users' keys to them. sadtrombone.mp3
that’s utterly trivial for a sufficiently paranoid user’s browser to detect, and damning for proton if it is (not to mention, pushing hostile JavaScript doesn’t work for users on the imap bridge or using mobile apps they update via methods that can’t easily be tracked like Obtainium on Android)
the mechanisms proton uses to exfiltrate encrypted data and get their users arrested are far more subtle and deniable than that basic shit. specifically, they’ve been silently overcomplying with law enforcement data requests for years, which has led to documented arrests of activists, and all of their LLM features represent a significant data leak, as all of them are implemented in a way that sends cleartext to proton’s servers while maintaining the illusion that the feature is more secure than it is.
I wouldn’t be at all surprised if they were doing more evil shit than the above, but I would be very surprised if any of it were in the form of JavaScript that the user could, you know, deobfuscate and read
How many of their users do you think are sufficiently paranoid?
And if it is utterly trivial, I am curious how you think a sufficiently paranoid user actually would go about detecting such an attack, much less detecting it prior to running the malicious javascript and having their keys exfiltrated. For detecting it after the code has already run, ok, I know how to use mitm proxy to record the javascript being sent to my browser. (Which is the first step of detecting an attack... the next steps involve analyzing the legitimate changes to the code and discerning them from malicious changes.)
I could also imagine a variety of ways (using mitm proxy, or a browser extension) to try to avoid running new javascript before seeing it and having a chance to analyze it - but all of the ways I can imagine would require a substantial amount of work, including writing new software.
Do you know of any existing browser extension or other software which sufficiently paranoid protonmail users can/should/do use to detect and/or actually prevent the type of targeted attack I'm describing?
Yes that is why i said "when using Proton's web mail interface" - which I expect 100% of users of other interfaces also sometimes log in to.
for fucking Proton of all things? come the fuck off it.
the rest of your post is wrong, but in a really boring way? like, you get that there’s a bunch of ways to catch this shit but want me to do the labor of proving that it’s possible for some reason? no, fuck off, go cosplay as a privacy expert elsewhere.
and for the users at home playing the drinking game: of course this weird fuck’s been giving dangerously bad advice on privacy lemmy, why wouldn’t he be
I ain’t gonna dig any deeper to find out if privacy Typhoid Mary over here has a uniquely bad gpg setup he loves but if anyone does: that’s another shot
e: also lol @ coming into TechTakes with an account named after the fucking cypherpunks mailing list
weird fuck's post reads to me as the mistake of thinking web/js is uniquely capable of dynamic code loading
what is stopping a desktop or mobile client from running new/different code? the only solution im aware of (we're in halting problem territory here, probably, though grapheneos has "prevent DCL from storage/memory" toggles so idk) is to inspect the code to make sure it does what they say and then cryptographically sign it
exactly, it’s not a problem that’s unique to the web. I’d argue that as an execution environment, the browser has properties that make it slightly easier to catch this class of attack (though as you said, we’re in halting problem territory so there’s no universal check for this kind of thing):
- there’s browser plugins (for Firefox at least, I don’t care about chrome) that alert you if the JavaScript you’ve been sent has changed and provide some tools to evaluate what specifically changed
- you can examine JS memory in depth with a variety of tools, all of which come with the browser
- you get a running log of network requests
- as our intrepid cypherpunk visitor noted, you can mitmproxy it if you really want to? they seem to think it’ll be too late to do anything by then but like, losing your keys to an SLA doesn’t instantly dissolve you in a vat of acid or anything. they’ve still left forensic evidence of an attack in your browser’s cache and the potential for you to catch it and make a terrible lot of noise about it, and they really didn’t need to — Proton’s security is compromised enough by entirely silent server-side cleartext leaks, metadata logging (they turn it on silently on law enforcement requests; their no-logs policy is a legal no-op), and other evil fuckery
and I do have to emphasize that last bit. I’m not here to praise Proton, I’m here to bury it correctly. if the worst thing you’ve got to say about proton is that an SLA could request a custom JS exploit be sent to your browser, then it’s probably still a perfectly fine service to use if you’re just chatting with your grandma and your drug dealer, depending on your threat model. I’d argue that Proton isn’t suitable for anybody, because the class of attacks they’ve enabled allow for quiet mass surveillance, rather than the motivated (and loud) targeted kind.