I keep hearing bad stuff about proton, but I don’t really get most of it. Could someone please explain all of the controversy to me. Lastly, what are the best alternatives to all of their services?
What’s so bad about proton, and is there alternatives to all of their services?
3 days ago by 1121219165 to c/privacy
I keep hearing bad stuff about proton, but I don’t really get most of it. Could someone please explain all of the controversy to me. Lastly, what are the best alternatives to all of their services?
What's insufficient about PGP?
Its crypto from the 90s and email is not meant to be secure. Some examples:
Only the mail body is protected, headers and metadata arent, so an attacker still knows with who you are talking about what.
Replies contain the full thread, if one person messes up once, the entire chain is unencrypted.
No ephemeral keys, no cleanly defined rotation mechanism. If someone gets your key, all past messages are also accessible.
TY for informing me. Is there a better alternative to PGP even with the other downsides of email you listed?
Signal is probably best, since it has volume to hide in, and it's difficult/ impossible to screw up. Partly because it's centralized. Which is the problem with e.g mateix protocol - each node can configure thi gs a bit differently. Also why you should use the official app imo.
This is a decent walk through: https://www.privacyguides.org/...
But simple duckduckgoing can provide much more
https://5blockchains.com/posts/pgp-vs-signal/
https://ubos.tech/... (feels a bit clanker like - but info is legit)
I would say Signal is the best like mainstream normie friendly option but if you want the most reliable privacy imo your better off with Briar. It's less convenient for sure, but it requires no phone number, has no centralized servers, can route messages over TOR, Bluetooth, LAN, etc. Messages are end to end encrypted peer to peer. And even when stored on your device are encrypted. Downside is you need the other person to have an android there is no iOS app. But upside is it has a flatpak!
I like briar for sure. Mostly because it might work if the internet goes blip, and you only have p2p. But... It's in maintenance mode, exactly because its not easy to use.
It doesn't bother me much. I've actually kind of always wished more software would just stop changing things and go into maintenence mode. I do hope they continue getting funding for the security updates tho.
@lemmy.ml
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
much thanks to @gary_host_laptop for the logo design :)
go to feed...
@lemmy.ml
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
much thanks to @gary_host_laptop for the logo design :)
go to feed...
Yes. There is controversy about the CEO. But mostly for me: is security theater. And in don't trust them. Email will never work as a secure communication layer. Stop pretending it will. There a reasons which is tied to the protocol level, that make pgp non sufficient. There are also the pgp technology it self (no forward secrecy, no deniability, key management etc). Then there is the obvious fact about an email from proton to gmail, and 99% of other email providers, simply not being secure/encrypted. So you buy a privacy tool, which neglects to tell you: we actually don't provide privacy at all - unless you treat proton emails as proton chat - strictly proton to proton.. at which point youd be better of with e g signal.
If you insist: mailfence.org allows you to upload and control you own pgp keys. That's interoprational with proton. Simarly priced i think, also Schweiz, and a bit more honest and strict imap (no bridge). But honestly.. stop treating email as secure.
save