I know the CEO dug himself a pretty deep hole recently.

I had been meaning to switch all the services I currently use over to proton - but his remarks gave me pause.

Is it still worth considering?

  • Océane@jlai.luFrançais
    46·
    9 hours ago

    I’m tired but:

    • you’d need to compare the checksums of their web-based cryptography at every login,
    • you could use their bridge but you’d need to give your OpenPGP passphrase to change your settings, for no reason
    • they have the CIA at their administration council,
    • they have an history of unethical behavior toward Twitter survivors,
    • they have an history of spreading conspiracy theories,
    • they have an history of contacting hosting providers asking them to remove blog posts,
    • they didn’t share the Lavabit fundraiser so they could get quietly issued a US National Security Letter (overriding the First Amendment and preventing Ladar from appealing),
    • they can access to your entire mailbox anyway, not just to the email contents,
    • this has enabled the arrest of Social and Climatic Justice activists, they replied they couldn’t resist a Swiss court order (so that’s not their fault I guess, the tech is just bad)…

    Why would you trust them for your opsec, and why would you enable them further?

    Alternatives include Disroot, Nubo, and Zaclys.

    #Proton #ProtonMail

    • 0x0
      2·
      11 hours ago

      Do you have sources for all of this?!

      • Océane@jlai.luFrançais
        1·
        10 hours ago

        Tired. In auto-pilot mode for the last 3 hours.

        Part of it is based on the OpenPGP standard itself, e.g. you only need the passphrase to decrypt your emails, not to encrypt them and certainly not to change your settings.

        Part of it is based on experience.

        Part of it actually needs a few sources; the Lavabit part is speculative but solid, there are bread crumbs all over the web.

        • haverholm@kbin.earth
          3·
          10 hours ago

          Yeah, get some sleep! I too would love to see sources and read up on this, but maybe some other kind soul will elaborate while you rest 👍

            • 0x0
              1·
              5 hours ago

              Make no mistake: any company that wants to operate above board, be it a VPN provider, a privacy-focused mail provider or whatever, always has to comply with the local law. If the “local” happens to be an oppressive regime like the US, tough luck… even in Switzerland if their gov forces a company to comply with something they will comply. Proton’s no exception.

          • Océane@jlai.luFrançais
            21·
            9 hours ago

            I was going to add sources anyway, I’ve only had 3 hours of sleep last night, but you need to understand that we don’t owe you resources. I, for one, don’t know you. I wasn’t talking to you when you approached me with a nominal sentence, and you need to acknowledge that you base your tone on the assumption that I didn’t consent to this conversation.

            So of course I’m still considering blocking you. Going this route, you would keep the same entitled, passive-offensive tone.

            As rude as it is, people will only adapt to this by drawing boundaries in a more cohesive, efficient way. You need to check your attitude, and to embrace the resource-centric nature of the internet. Improve your tooling.

            • 0x0
              1·
              5 hours ago

              So of course I’m still considering blocking you.

              👋 kthxbye

              Some issues on Proton are widely known, like their CEO’s shenanigans… If you’re gonna claim other less known issues don’t act shocked and surprised (or offended or whatever) when someone asks for evidence.
              You’re not obliged to provide such evidence nor am i obliged to believe your BS.

              Get some sleep.

              • Océane@jlai.luFrançais
                1·
                5 hours ago

                You’re missing the point. I will source my post (because I’m a nice and, frankly, jobless person) even tho I was answering to the OP, because this is a public document.

                But you’re the one coming out of the wood with baseless claims. Every serious privacy guide claims that you shouldn’t use OpenPGP for opsec, which is well beyond degoogling anyway, so why are you even recommending ProtonMail over cheaper offers like Nubo, Mailo, or any other indie mail provider? Why are you suggesting another data silo in a degoogling community?

                • 0x0
                  1·
                  4 hours ago

                  why are you even recommending ProtonMail

                  I’m not. I don’t really like it myself. I’m just allergic to source-less claims, and you’ve got a lot of them.
                  Shouldn’t you be asleep? Get some rest.

            • pirat@lemmy.studioOP
              3·
              9 hours ago

              I am genuinely curious about other sources - I tried to do digging on some but couldn’t verify all the claims. No rush, get some rest and whenever you get a chance I’d love to read / learn more.

    • pirat@lemmy.studioOP
      2·
      11 hours ago

      For being tired this outlined a lot of great points and good alternatives. Nubo has my eye and I’m going to look into starting the process with them.

      • lemmeBe@sh.itjust.works
        2·
        11 hours ago

        Nubo sounds good. However, I’m closer and closer to buying a mini PC and simply self-gosting Nextcloud. I feel that is the only way to be really sure I own my data and not get disillusioned/disappointed in some way by some of these companies.

        • pirat@lemmy.studioOP
          11·
          10 hours ago

          Yeah, been strongly considering that recently as well but I have a lot to learn.

          I really want to have a custom domain, murena seems to have everything that I’m looking for, if I wanted to have a custom domain still I’d have to self host.

          I’ve heard that self hosting can lead to a bunch of email getting snagged in spam filters. In regards to self-hostijg I’m definitly in the unconscious ignorance (I don’t know what I don’t know) phase of it.

          • 0x0
            1·
            5 hours ago

            I’ve heard that self hosting can lead to a bunch of email getting snagged in spam filters.

            Through force of numbers, the big companies have made self.hosting email a pain in the ass. DKIM, DMARC and all that, they say it’s to fight spam but it’s really just to ensure their monopolies. If it was encryption they’d be clamoring won’t someone think of the children.

            You can find people un/successfully self-hosting email so invariably YMMV. Just make sure you follow all the steps and guidelines and don’t use that address for anything relevant in the first months.
            Some people also use a proxy in Outlook or something so the outgoing email has all the legit veneer.

          • lemmeBe@sh.itjust.works
            2·
            9 hours ago

            I have a custom domain added to Tuta. Works fine for the last 2 years. If something goes haywire at any point, ⚓ up and I’m gone.

            I’m interested in self hosting a couple of services, Immich, Navidrome, Nextcloud, but email ain’t one of them. Personal one I use mostly for registrations and shopping confirmations