Edit: I made a mistake, I meant to add Mailfence instead of Fastmail, but forgot to update both the icon and text

Hey everyone, here’s a follow up to my previous post, I tried to summarize all your suggestions and these are the options I have for the main Proton products I’ve been using.

I removed Bitwarden based on your feedback (basically they’re enshittifying).

I’m not including Tuta, because I dislike their UX/UI, also they seem to not apply their LLM policy to their own devs.

I’m not including Mullvlad, because of one of the founder’s donation to a far right political party in Sweden, said founder has a blog post to justify this, which links to another blog post where he claims to be a libertarian anarchist which is just another word for Ancaps which is a dealbreaker for me.

A lot of people recommended using one’s own domain for email stuff, I forgot to mention I do have a custom domain, which will make migrating a lot easier indeed. Just need to update my accounts credentials.

Let me know what you think!

  • ᴋɪᴋɪ@lemmy.world
    4·
    1 day ago

    “I still use Proton because I don’t know which alternatives are better. The problem is that when I look for ways to protect my digital privacy, almost no app seems safer than the others. There’s always something missing, which makes it hard to feel confident that a service is actually any good.”

  • Reannlegge@lemmy.ca
    1·
    24 hours ago

    I self host vaultwarden, which uses the bitwarden app on my devices. How are they enshitifying?

  • TrollAccount69@lemmy.ml
    102·
    2 days ago

    @inlandempire@jlai.lu , I said I’d write about bitwarden and here I am. Trollaccount69: promises made, promises kept.

    Bitwarden is good. People saying it’s bad are either mistaken from not reading news reports closely enough, completely unwilling to accept a company as opposed to a small open source project or don’t consider cloud services worthwhile when they could be self hosted.

    I’ll start with the last one first.

    I self host a lot of stuff. Many people have a little computer in the closet, some have mini racks, a few have full size frac racks. I have two full size racks in different physical locations separated by miles. The point of saying that is not to brag or flaunt undiagnosed mental illness but to make it 100% clear that I am not opposed to self hosting by any measure.

    A few years ago I was in a natural disaster. It wasn’t predictable or common and while some of the conditions that precipitated it had a generous parry window the effects were outsized and still linger to this day.

    My local server was rendered inoperable and my offsite was damaged beyond recovery. Conditions in the area prevented consistent access to the internet so my cloud backup was not an option. Afterwards I did not have power or Internet at either my home or offsite location for two weeks. Even in the case that I did, my focus was on keeping my family warm, fed and housed.

    The experience immediately afterwards had a lot of what might get called second factors or one time tokens or just shit you gotta write down and every group involved wanted to mediate the process through their website or some other computer system not least of which is the us federal governments now monolothic login.gov (what a fucking name).

    Maybe you see where I’m going with this.

    If it weren’t for bitwardens ability to access secrets securely through a web browser on an untrusted computer I would have had a much different experience toting handwritten copies of important logins, passwords, tokens, codes and even just notes to remember in sweat soaked waterlogged pockets.

    Bitwarden isn’t the only cloud password thingy that has that functionality but it’s the one with the longest history of dudes popping up to “well actually” out the way their website access works when someone says “browser? That’s not secure!”. So I’m not gonna waste your time with that. It is secure and you can do your own research and come to that conclusion yourself.

    The point of writing all that is you probably would be what a disgusting race of people with bad teeth from an overcast island in the North Atlantic would describe as “proper fucked” in their nasty, brutish imitation of the English language if you couldn’t get to your selfhosted passwords. Imagine if that coincided with a bonafide cortisol experience.

    Cloud services can be described as a lot of things. A safety net against local disruptions is part of that.

    Alright working backwards from that mess, it’s fine to be skeptical of companies but they do represent stores of expertise and often act as the benevolent supporters of open source projects either through a direct relationship like Bitwarden, keeping the maintainers of an open source project employed so they can continue working on the project (often as part of their job responsibilities) like Bitwarden or even just using the profits to prop up the free side uh, like Bitwarden.

    Off the dome, and I will not be looking this shit up, the first thing comes from people seeing some small indicator and freaking the fuck out. Recently it’s a change to an acronym that describes the companies values. Literally come on. Red hat is basically the IG Farben of open source but no one is fleeing the Linux kernel because of their involvement. Another recent freak out came from a new ceo who took on venture capital. The company intends to broaden its user base and provide its service as a trusted third party in an increasingly fractured world, that takes capital and the part no one seems to be willing to hand to ceos, leadership. There have not been tangible changes to bitwardens free service as a result of these events.

    My favorite Bitwarden freak out is the tos data collection one. Someone posted the terms of service and highlighted that user data could be collected and used. Now that’s something! Wait, it was the terms of service of the website, not the service (an important legal shield in some jurisdictions) and was just boilerplate. There was no evidence ever provided that Bitwarden collected user data in any way other than that which is part of rendering a web page (how big is the viewport, what protocols do you support etc.).

    If you take anything away from this, hell, if you even read down to the bottom and see this sentence: don’t discount cloud password vaults, you may end up relying on them during a trying time.

  • notfromhere@lemmy.ml
    666·
    3 days ago

    So, guys, I’ve had a pretty great experience with GMail, from a small company… they index the Internet, whatever that means. Anyway, the sign up is free and and I don’t have to bring a domain… again, not sure what that means, but it sounds nice.

      • artifex@piefed.zipEnglish
        21·
        3 days ago

        It’s funny you should mention that, because they go out of their way to specifically say that they aren’t!

        • FineCoatMummy@sh.itjust.worksEnglish
          11·
          3 days ago

          I believe 'em. Especially after they bought a co called “doubleclick”. Not sure what that is, but they probably invented double clicking with my mouse buttons. Or sth like that. No way an evil co would be giving us stuff like that.

        • underisk@lemmy.ml
          9·
          3 days ago

          “Don’t be evil” seems like an aspirational sentiment rather than a reflective one. Like an addict writing “don’t do drugs” on their todo list.

    • anivicivokki@lemmy.zip
      5·
      3 days ago

      Also, the storage they offer increases constantly in real time. There is a counter on their page if you wanna check.

  • Pirate2377@lemmy.zipEnglish
    2·
    2 days ago

    Fun fact about KeepassXC: it also supports 2FA (via manually inserting totp tokens), so you could argue it’s also an alternative to Proton Authenticator assuming you don’t mind having your TOTP tokens and passwords are in the same place. Though I will say having them in the same place is at least better than not having 2FA at all, so it’s an option to consider

    • helpImTrappedOnline@lemmy.world
      2·
      1 day ago

      If you’re worried about it you could also have a seperate file for 2fa, different passwords. The embedded file and notes features are great for storing the backup/recovery codes good 2fa implementations give you.

  • chewypoops@lemmy.world
    153·
    3 days ago

    Why are you using the GOP logo? This isn’t an American-centric issue.

    Just put a Swastika. That’s what he apparently stands for now.

  • ☭SaltyIcetea☭ @lemmy.ml
    181·
    3 days ago

    i had enough struggle to convince my friends to switch away from google, im sure as hell not getting them to switch again. especially not when i am the one paying for the family subscription

    • Dave@lemmy.nz
      16·
      3 days ago

      I think it’s fine. Proton is still better than big tech. I want to move away from Proton for myself but that’s because I am not tied to an address (custom domain) and am happy to do the switch. I would still encourage Proton over big tech for regular people. We do the best we can do.

    • iamthetot@piefed.caEnglish
      43·
      3 days ago

      I’m confused… If you’re the one paying for it, why do you need to convince them of anything? They can come along or pay for their own services.

    • Aralakh@lemmy.ca
      1·
      2 days ago

      What’s your experience been with CryptPad? Never heard of it before, does it make sense as an alternative for someone who doesn’t need the collaborative part most of the time?

      • Axolotl.cpp@lemmy.dbzer0.com
        2·
        1 day ago

        I had a great experience except some little bugs that they fixed, it makes sense to use it even if you don’t need the collaborative part but i wouldn’t use it over LibreOffice et similiar if I don’t need the file to be on the cloud

        • Aralakh@lemmy.ca
          1·
          23 hours ago

          Thanks for sharing, appreciate it, I’ll definitely give it a look over. :)

  • tirateimas@lemmy.pt
    252·
    3 days ago

    Fastmail while an excellent product, is in a jurisdiction with “dubious” rules. I would give Tuta a second chance. Infomaniak is also a good alternative.

    • nightwatch_admin@lemmy.world
      151·
      3 days ago

      Tuta is going straight against their own policies on Ai, hard disagree on that 2nd chance. You might just as well do that with Proton then.

      • tirateimas@lemmy.pt
        71·
        3 days ago

        True, why not? it was clear that the people that work at proton were competent enough to raise the issue and make it a public discussion, I wouldn’t throw them away that easily.

    • inlandempire@jlai.luOP
      51·
      3 days ago

      That’s my mistake, I meant to add Mailfence instead of Fastmail, but forgot to update both the icon and text

    • sonstwas@sh.itjust.works
      1·
      2 days ago

      No idea, but the chip ass (this was autocorrected but I’ll leave it :D) repo seems like a clone of KeepassXC…

          • helpImTrappedOnline@lemmy.world
            2·
            1 day ago

            You could, but the cloud is just someone else’s computer. If mozilla messes up and deletes a bunch of people passwords, like google did a few years ago, or they have a data breach like lastpass you’re screwed.

            If you choose to rely on any cloud password manager, I recommend maintaing a local database with at least any emails that will be needed for resetting passwords, 2fa recovery codes and anything else you consider essential to get through a failure of the cloud datbase.

            The inverse is true for anyone running a local database. An encypted copy, of at least the essentials, should be somewhere remote they can access without needing to lookup a password from their local database.

              • helpImTrappedOnline@lemmy.world
                2·
                17 hours ago

                Welcome to the club.

                Remember the 3-2-1 backup rule. You are now directly responsible for the saftey of your database. You can’t blame big tech ai vibe coding.

                For mobile android, I reccommend KeepassDX.

                For ios I recommend Keepass Touch (one-time $2 for autofill & touch-id).

                Most people, myslef included, use syncthing to keep the database syncronized between devices when they’re on the same wifi network.

                Android is easy, the app is Syncthing Fork.

                IOS is a tad harder due to the apple file management restrictions, but möbious sync works very well as a front end for syncthing (one-time $5 for unlimited sync jobs, not needed if only use it for keepass).

                Both apps don’t always stay running the background (ios apps can’t even if they wanted too), so you do have to have to activly open the apps once in a while to sync.

                Beacuse of that, it’s important you set syncthing (or whatever method you use) to resolve conflicts when both “sides” have been modified since the last sync have by making a new file instead of overwriting one. You can easily merge the two datbase files back into 1 on desktop through keepassXC, delete the copy and let syncthing propagate the updated folder.

                Alternatively you could use a cloud provider of your choice to host the file. As long as the keepass app can access the cloud provider’s files. A “keep file offiline” feature is very helpful too. However, the same background process sync limitations will be in place. You will need to see how tge cloud provider handles conflicts, if it just picks and overwrites the loser, that could result in data lose.

                Another note, automatically syncing between devices doesn’t count as a true backup. If the database file gets corrupted (or you accedeidenty delete somethingg and clear the recycle bin) and that file is synced everywhere else, what good are multiple copies of the same bad file? You should be able to go back a week or two (syncthing does do file history if enabled).

        • norealme@lemmy.world
          1·
          2 days ago

          KeepassXC

          ChiPass I installed (flatpack) but how to export all passwords from firefox and import into ChiPass?