Edit: I made a mistake, I meant to add Mailfence instead of Fastmail, but forgot to update both the icon and text
Hey everyone, here’s a follow up to my previous post, I tried to summarize all your suggestions and these are the options I have for the main Proton products I’ve been using.
I removed Bitwarden based on your feedback (basically they’re enshittifying).
I’m not including Tuta, because I dislike their UX/UI, also they seem to not apply their LLM policy to their own devs.
I’m not including Mullvlad, because of one of the founder’s donation to a far right political party in Sweden, said founder has a blog post to justify this, which links to another blog post where he claims to be a libertarian anarchist which is just another word for Ancaps which is a dealbreaker for me.
A lot of people recommended using one’s own domain for email stuff, I forgot to mention I do have a custom domain, which will make migrating a lot easier indeed. Just need to update my accounts credentials.
Let me know what you think!
Since you’re picking a new provider anyway, it’s worth thinking about how you pay. A card ties the account to your name even if the mail itself is encrypted. Tuta and addy.io both accept Monero, and Mailbox.org lets you pay by bank transfer without a card. For aliases, addy.io with any of those works really well.
@inlandempire@jlai.lu , I said I’d write about bitwarden and here I am. Trollaccount69: promises made, promises kept.
Bitwarden is good. People saying it’s bad are either mistaken from not reading news reports closely enough, completely unwilling to accept a company as opposed to a small open source project or don’t consider cloud services worthwhile when they could be self hosted.
I’ll start with the last one first.
I self host a lot of stuff. Many people have a little computer in the closet, some have mini racks, a few have full size frac racks. I have two full size racks in different physical locations separated by miles. The point of saying that is not to brag or flaunt undiagnosed mental illness but to make it 100% clear that I am not opposed to self hosting by any measure.
A few years ago I was in a natural disaster. It wasn’t predictable or common and while some of the conditions that precipitated it had a generous parry window the effects were outsized and still linger to this day.
My local server was rendered inoperable and my offsite was damaged beyond recovery. Conditions in the area prevented consistent access to the internet so my cloud backup was not an option. Afterwards I did not have power or Internet at either my home or offsite location for two weeks. Even in the case that I did, my focus was on keeping my family warm, fed and housed.
The experience immediately afterwards had a lot of what might get called second factors or one time tokens or just shit you gotta write down and every group involved wanted to mediate the process through their website or some other computer system not least of which is the us federal governments now monolothic login.gov (what a fucking name).
Maybe you see where I’m going with this.
If it weren’t for bitwardens ability to access secrets securely through a web browser on an untrusted computer I would have had a much different experience toting handwritten copies of important logins, passwords, tokens, codes and even just notes to remember in sweat soaked waterlogged pockets.
Bitwarden isn’t the only cloud password thingy that has that functionality but it’s the one with the longest history of dudes popping up to “well actually” out the way their website access works when someone says “browser? That’s not secure!”. So I’m not gonna waste your time with that. It is secure and you can do your own research and come to that conclusion yourself.
The point of writing all that is you probably would be what a disgusting race of people with bad teeth from an overcast island in the North Atlantic would describe as “proper fucked” in their nasty, brutish imitation of the English language if you couldn’t get to your selfhosted passwords. Imagine if that coincided with a bonafide cortisol experience.
Cloud services can be described as a lot of things. A safety net against local disruptions is part of that.
Alright working backwards from that mess, it’s fine to be skeptical of companies but they do represent stores of expertise and often act as the benevolent supporters of open source projects either through a direct relationship like Bitwarden, keeping the maintainers of an open source project employed so they can continue working on the project (often as part of their job responsibilities) like Bitwarden or even just using the profits to prop up the free side uh, like Bitwarden.
Off the dome, and I will not be looking this shit up, the first thing comes from people seeing some small indicator and freaking the fuck out. Recently it’s a change to an acronym that describes the companies values. Literally come on. Red hat is basically the IG Farben of open source but no one is fleeing the Linux kernel because of their involvement. Another recent freak out came from a new ceo who took on venture capital. The company intends to broaden its user base and provide its service as a trusted third party in an increasingly fractured world, that takes capital and the part no one seems to be willing to hand to ceos, leadership. There have not been tangible changes to bitwardens free service as a result of these events.
My favorite Bitwarden freak out is the tos data collection one. Someone posted the terms of service and highlighted that user data could be collected and used. Now that’s something! Wait, it was the terms of service of the website, not the service (an important legal shield in some jurisdictions) and was just boilerplate. There was no evidence ever provided that Bitwarden collected user data in any way other than that which is part of rendering a web page (how big is the viewport, what protocols do you support etc.).
If you take anything away from this, hell, if you even read down to the bottom and see this sentence: don’t discount cloud password vaults, you may end up relying on them during a trying time.
Thanks, but I never knew Americans had bad teeth
You’re a legend for delivering, I can’t read it all right now but I’ll find a moment tomorrow (Sunday), thank you for taking the time to share your toughts!!
i had enough struggle to convince my friends to switch away from google, im sure as hell not getting them to switch again. especially not when i am the one paying for the family subscription
I think it’s fine. Proton is still better than big tech. I want to move away from Proton for myself but that’s because I am not tied to an address (custom domain) and am happy to do the switch. I would still encourage Proton over big tech for regular people. We do the best we can do.
I’m confused… If you’re the one paying for it, why do you need to convince them of anything? They can come along or pay for their own services.
it was unfortunately worded. the reason they switched at all is because im paying. if i stop paxing they will just switch back
That’s their prerogative.
Why are you using the GOP logo? This isn’t an American-centric issue.
Just put a Swastika. That’s what he apparently stands for now.
I don’t think you want to include Windscribe: https://retro.social/@ifixcoinops/117526586958025535
aaaaaand one more to remove, thanks for the heads up
AirVPN is sus too, never been audited so we can’t know for sure about their logging policy.
“I still use Proton because I don’t know which alternatives are better. The problem is that when I look for ways to protect my digital privacy, almost no app seems safer than the others. There’s always something missing, which makes it hard to feel confident that a service is actually any good.”
I am kinda in the same bota. But i think mailbox.org is a solid alternative for protonmail.
My main problem is protondrive.
This site is great for finding safer alternatives. I only heard about it from a YouTuber I used to watch. Maybe there’s something there that could help you :)
What’s the thing with ChiPass vs KeepassXC?
No idea, but the chip ass (this was autocorrected but I’ll leave it :D) repo seems like a clone of KeepassXC…
They’re porting KeePassXC to Qt6 and banning LLM usage.
https://codeberg.org/ChiPassor maybe leave all the passwords in the cloud of the mozilla?
You could, but the cloud is just someone else’s computer. If mozilla messes up and deletes a bunch of people passwords, like google did a few years ago, or they have a data breach like lastpass you’re screwed.
If you choose to rely on any cloud password manager, I recommend maintaing a local database with at least any emails that will be needed for resetting passwords, 2fa recovery codes and anything else you consider essential to get through a failure of the cloud datbase.
The inverse is true for anyone running a local database. An encypted copy, of at least the essentials, should be somewhere remote they can access without needing to lookup a password from their local database.
I’ve done it. I’ve installed KeePass. I’m learning how to use it and setting it up.
Welcome to the club.
Remember the 3-2-1 backup rule. You are now directly responsible for the saftey of your database. You can’t blame big tech ai vibe coding.
For mobile android, I reccommend KeepassDX.
For ios I recommend Keepass Touch (one-time $2 for autofill & touch-id).
Most people, myslef included, use syncthing to keep the database syncronized between devices when they’re on the same wifi network.
Android is easy, the app is Syncthing Fork.
IOS is a tad harder due to the apple file management restrictions, but möbious sync works very well as a front end for syncthing (one-time $5 for unlimited sync jobs, not needed if only use it for keepass).
Both apps don’t always stay running the background (ios apps can’t even if they wanted too), so you do have to have to activly open the apps once in a while to sync.
Beacuse of that, it’s important you set syncthing (or whatever method you use) to resolve conflicts when both “sides” have been modified since the last sync have by making a new file instead of overwriting one. You can easily merge the two datbase files back into 1 on desktop through keepassXC, delete the copy and let syncthing propagate the updated folder.
Alternatively you could use a cloud provider of your choice to host the file. As long as the keepass app can access the cloud provider’s files. A “keep file offiline” feature is very helpful too. However, the same background process sync limitations will be in place. You will need to see how tge cloud provider handles conflicts, if it just picks and overwrites the loser, that could result in data lose.
Another note, automatically syncing between devices doesn’t count as a true backup. If the database file gets corrupted (or you accedeidenty delete somethingg and clear the recycle bin) and that file is synced everywhere else, what good are multiple copies of the same bad file? You should be able to go back a week or two (syncthing does do file history if enabled).
I have 2 linux PC and 1 android phone.
KeepassXC
ChiPass I installed (flatpack) but how to export all passwords from firefox and import into ChiPass?
replace KeePassXC with ChiPass, which is a fork without AI
I do love Posteo, but they explicitly do not support custom domains, as said in their FAQ. However, it is very strongly anti-AI, and has strong ethics that I think anyone in your situation would agree with.
For VPNs, I love AirVPN a lot, though I hear it can be rather slow. For me, I personally use it for downloading Linux ISOs as well as getting past wonky internet connections and it works really well for those use cases. From what I could see, Xeovo also seems to be torrent-friendly as well.
I’ve recommended Aegis to close family and have used KeePass (as well as XC and ChiPass, which is an AI-free fork of XC) in both a personal and professional capacity. I will have a look at AliasVault though, as I would like to move away from BitWarden myself.
Tbh. if they use AI but the code quality is the same I see no problem. All the code just has to be audited by humans.
yep, that’s my connundrum right now, posteo also seem to have a more generous offer for cheaper (than mailbox)
I wish there was a good one with custom domain support, unlimited aliases and good filter for tagging/moving to folder so I can move from same sender based on title
Privacy first
I personally self-host my mailbox and relay outgoing mail using Emailit.com (Czech). I have all possible addresses in my domain, and can put whatever filters I like. However, I appreciate Posteo very much, I would have used their service if not for the desire to use another domain.
I can’t switch again, for the love of god(s) I’m old and tired.
I recently made a post asking for email providers, and no one has yet mentioned Mailfence, I hadn’t heard of it until seeing this post. What are people’s thoughts on it?
I posted about it in another recent thread. Long time user and I am happy. But I only use some features despite paying. They historically had free accounts, too, but unsure what they offer now.
They still have free accounts. I tried to sign up, to do so I needed to enter a backup email. I used a simplelogin one and now I’m blocked and have to wait 24 hours to try again 🤦
Interesting! I tried creating a new account with my mailfence email and it just told me no. There was a point where I experienced places balking at me using that domain, perhaps they have had to tighten up registration.
Oh also it kept telling me my selected username was invalid, while giving no indication as to why. In the end I think it was because it had the word “host” in it (actually, it was “ghost”, but apparently they don’t allow “host”).
I’ve tried again with a different recovery email and it still said no, please contact support. But I couldn’t find a link to contact support, only a knowledgebase, so I’m probably going to go with mailbox.org instead. I have created a trial account there without issue.
Would you consider NymVPN? I’ve been using it for a few months now and it’s pretty good. It’s backed by PhD level Cryptography and it’s open source but the parent company is still for-profit. I think it’s an actual good use of blockchain too. Also it’s decentralised! Fedi should love it but I never see it mentioned.
will add it to my list, thanks for the suggestion!
What is PhD level cryptography
It’s not my area of study so I’m not too sure. I do know someone doing a PhD in cryptography and blockchain who has worked with the researchers behind Nym so it seems legit in that sense. What I mean is, I trust the protocol because actual scientists have developed it.
Is there port forwarding? I noticed they mentioned split tunneling
Not currently. I noticed they mentioned it was part of their road map last year but seem to have quietly dropped it. This year they mention working towards Nym2.0 which will contain a lot of extra features. Hopefully port forwarding! As it’s decentralised the Nym team do actively listen to the community so if there’s enough people asking for it I’m sure they’d implement it.
Thanks! I’m stuck with Proton through most of next year anyway, so I’ll keep an eye out.
Tuta had honeypot allegations. https://gizmodo.com/tuta-email-denies-connection-to-intelligence-services-1851022465
I self host vaultwarden, which uses the bitwarden app on my devices. How are they enshitifying?
Fun fact about KeepassXC: it also supports 2FA (via manually inserting totp tokens), so you could argue it’s also an alternative to Proton Authenticator assuming you don’t mind having your TOTP tokens and passwords are in the same place. Though I will say having them in the same place is at least better than not having 2FA at all, so it’s an option to consider
If you’re worried about it you could also have a seperate file for 2fa, different passwords. The embedded file and notes features are great for storing the backup/recovery codes good 2fa implementations give you.
