So this has been hashed 100 times… What I read was that the agency found out, or guessed the address.
However… on that point…
and while I’m not saying the article is right or wrong, or you are correct or incorrect, but as stated by @jantinzi , one needs to comb through all the features, and tighten to the point of feeling safe. That is the end-user’s responsibility. Not Proton’s. Personally, for my need, Proton is just fine.
The article I read when like this… A couple of years ago, Proton was served, to provide access to an email account that some agency who wanted access to. Proton has to comply, by law, even even in their own country. So they provided that access (and probably data), in it’s full encrypted state, and without the user’s knowledge, which was also part of the order.
Well, that agency was able to get into that data, because of some of the settings the user had setup on the account, specifically with Recovery.
If you go into your Proton account, you will find a section related to YOUR RECOVERY OPTIONS. In those options, there are places where you can place recovery emails, and recovery phone numbers. By using those options, or by guessing those options, and getting court ordered access to those items as well (without the user’s knowledge) , the agency was able to access the data via those recovery options. This was a failure on the user’s part, not Proton. They have to give what they know, or what their users put into the account.
This is what their page says, and I have to believe it’s true.
Personally, I remove ALL recovery options with the exception of codes. That’s my one recovery method. No phone, no email address.