Due to the recent announcement of Proton moving to a non-profit structure (although not becoming fully non-profit) I’ve decided to take another look at them and really, Proton Unlimited is an enticing offer. However, the fact of everything from mail, to accounts, to storage being in one place is somewhat disconcerting. Also I recall them being decent, but not particularly outstanding at refusing to provide data to outside sources, there was a situation a while back where they handed over information of a climate activist.
To be fair, mail is insecure by default and if you’re going so far as to write to another Protonmail user you might as well use something actually secure and I am not exactly planning on breaking the law so I’m not too worried about data being handed over to authorities, yet it still leaves a bitter taste in my mouth and with the state of politics where I live there certainly is a concern that, being queer, I should also be a bit weary of governing bodies as well, as laws may change in the future.
Basically, by switching to Proton I’d be putting a lot of trust in them, instead of splitting it up between things like Mullvad, Bitwarden, etc. and besides a password manager (and to some extent my email provider), while dramatic, a single failure at any point wouldn’t be a total disaster. Are they trustworthy enough for the convenience benefits to be worth it to any of you?
For my threat model, yes they are trustworthy enough. I am not concerned about concealing my identity from a government investigating me for some alleged crime, but rather just transitioning away from Google and investing my time and money into a company that better respects my privacy. As a result, the centralisation doesn’t concern me as much as it does others and I am fine using Proton for VPN, email, calendar and storage. I also use SimpleLogin, which is now owned by Proton. All their applications are well designed and reliable for basic use in my experience, and it is more affordable for me to bundle these services together. I would definitely recommend them to people like myself, but your threat model sounds a little more complicated so you might want to do some further research and see what else is out there.
claims to be secure
closed source
total snakeoil
Man, would taking a few seconds to verify stuff kill you? All Proton applications are open source.
cool can you point me at the repo for their server software then? and the f-droid reproducible build of their android app, or the sideloadable iOS app?
Self hosting
You don’t have to use all services. I have the Unlimited plan and use mail with custom domains (+ the included SimpleLogin account) and VPN mostly, and Drive for backup (no Linux client yet makes it a no-go for daily use, but I have my own Nextcloud server that serves my purpose fine). Pass I have not tried (I use another manager), and Calendar I also don’t use.
I still feel I am getting my money’s worth.
https://flathub.org/apps/com.hunterwittenborn.Celeste
Pass is awesome
Calendar is good but can’t speak caldav which makes it useless for android and linux.
Why does the lack of CalDAV make it useless for Android? The app works just the same as Google Calendar on my phone.
It doesn’t integrate with android or linux. You are vendor locked in. You can only use proton’s app. Usually carddav and caldav go together, my tasks (and now kanban board. thank you jtx) and my calendar are very well integrated.
They’re referring to the quality of integrations with third-party systems, like the built-in CalDAV support basically every OS has. For some people, using just the calendar app is fine, but others want that deeper integration so they don’t have to rely entirely on Proton to provide features in their frontends that OS apps might already handle.
For example, on Android I might want to let other apps access information from my calendar (e.g. my launcher so it can show me events from within its built-in schedule widget). Same goes for my Thunderbird client on Linux, it’d be nice to have the calendar events be integrated there too. Unfortunately, they currently only support a mail bridge, but the official Proton account on Reddit has made a few comments stating that they’re “looking into” adding CalDAV support to Bridge, but there’s no official timeline on when or if that’ll actually happen. I’m willing to bet it eventually will, but I’ll say I’d definitely appreciate it if they did.
Nice, didn’t know about Celeste. Will check it out :)
Use it but don’t rely on it. Celeste uses rclone. The rclone support was temporarily disabled from Proton’s end a while back and also, the rclone backend still has a bunch of bugs and the developer seems to have gone missing
Wait, it doesn’t support caldav? That really kills the appeal of the convenience they provide as a one-stop-shop, as I’d have to deal with hosting my calendars in another way. I guess at that point I could just get SimpleLogin and use the rest as I have it, even if that gets close to proton unlimited price-wise…
Yes. I host my own nextcloud, I don’t need their calendar. But that also means I don’t need their drive. I only need the VPN and the mail and simplelogin is a nice bonus.
I’m pretty much in the same boat, you think it’s worth subscribing only for the vpn and email?
Tough question, but I guess yes. It’s 10 bucks a motnh iirc, and I don’t pay for streaming services
Yeah I suppose that’s not too expensive, although it feels like a waste when I’m not using all the services provided
Their changing their business structure (or just changed it). I guess you could say now that it’s also a donation to the whole system itself. Like donations to EEF or so. The more (financial) power proton has the better compared to other services.
Been using Proton stuff for years. Some things are super annoying and just don‘t work. Their software engineers are mediocre at best. This made me move everything away from Proton a couple of years ago. Funny enough, all the other privacy focused providers annoyed me even more. So after 1-2 years without Proton, I moved everything back :D
Don‘t expect too much and you will be fine. Simple features you know from other services might be missing. Support is meh, but you rarely have to use it.
One service provider, single point of failure. After google bullshit and how long it took me to get away, i aint cornering myself again. I will pay for the extra fee for mobility and choice.
I’ve been using Proton for several years now, and paying for their Mail and VPN features. Proton Mail is definitely better than Gmail, but other than the privacy features, it’s just a basic email service. Their VPN also is just a basic service. If that’s what you need, then by all means, I’ve always had a good experience with them.
That being said, I do run a competing email service called Port87 that (IMHO) has better features for organization and spam protection, so take what I say with the knowledge that I am technically their competitor (although my user base is tiny compared to them). Really, I see them more as an ally against Gmail and MS Exchange, because I’ve never experienced any sort of anti-competitive behavior from them like I have with both Google and Microsoft.
Supporting smaller players in the email space is what keeps email open, so the more people move away from Gmail and Exchange/MS 365, the better.
You don’t have to use all the services, most of them have an excellent free tier. My setup is paying for VPN, using the free tier of pass and self hosting my email and cloud storage.
Legally they (and every other company) are required to hand over data to the police, however they can try to have as little data as possible. While Proton doesn’t take as extreme measures to protect your privacy as for example mullvad, they have no log policy and such. I believe the case where they had to collect data (IP address, which they normally don’t collect) they received a legally binding order from the Swiss government which normally is used for serious crimes. Every company has to follow these orders, so this isn’t a proton thing but rather a Swiss law thing.
I think they’re trustworthy, but not the best in all those categories - I think tuta is better for mail (no dependence on google services), mullvad is better for vpn (linux app actually works with wireguard, and doesn’t have a hard dependence on networkmanager), and keepassxc + syncthing is better for passwords, although to be fair I haven’t tried proton pass
mullvad is better for vpn
Except if you torrent and have poor upload speeds, as it doesn’t support port forwarding.
Anymore yeah they used to allow it. A even better option for uploading is seeding to I2P. the bigger we can get i2P the better.
You’re talking about this, right?
That sounds promising. Know any good sites that can help me get started, or at least learn more?
The official site is best to get started. Personally i find it the most easy to run a container and configure a secondary Firefox profile: https://geti2p.net/en/
This is my opinion exactly. Plus they don’t have a way to upgrade storage without a family or business plan. I just want a google drive alternative for the sake of migrating away from google, not security, though it’s a nice bonus. Right now you can’t increase the storage on the basic plan, you can upgrade to unlimited but it only gets you 500 gb but costs a lot more. If they had a $5/month plan for 2 tb of storage and no other services I’d sign up right now.
I really love Proton, but I’m only using Mail, VPN, and Calendar. I kept BitWarden - already had it for a bit before Pass came about.
Oh: I’m also using SimpleLogin. Love that.
FYI: Bitwarden has integrations for SimpleLogin, Addy.io, FastMail, etc. for their username generator, so you can easily generate aliases for every site, regardless of what alias provider you use.
Yes
Others have touched on whether its trustworthy, but let me paste a comment I made a while back about why I like it so much from a functionality standpoint.
Let me tell you why I like it. It lets you generate a new email alias and password instantly whenever you make a new online account somewhere. Or just whenever you want. I’ve been slowly changing all my accounts over to their own unique email alias that can’t be tied back to my main email. My main address is known by nobody at all.
The main benefits are if someone steals a password, the email address that comes with it will only be useful for that one account. (I don’t need to go over the benefits of a standard password manager.) and so if that email is leaked or added to a spam list, I simply delete that address after changing the address for the single account it was used for. I can tell exactly which address is getting spam easily. 0 spam. Ever. Spam email has been solved for me.
Proton remembers which sites use which email/password as well.
Other than that, it’s just good for privacy. Having a different email for each account makes it harder to track a user across accounts.
These addresses are somewhat auto generated, with the name of the site along with a random word and a few numbers. But if you want to create another email address, you get a handful of custom ones for free with the subscription too. You can revoke these the same way, so you can have a professional looking email to hand out to people that’s not auto generated, without giving out your account’s root email address.
Edit: I also want to specify that while all of this is technically possible through other means, Proton makes it easier than any other option. Plus access to a good vpn, a nice replacement for Google drive (for storage and basic editing, at least) in addition to the email service and password manager mentioned above. A very good deal, in my opinion.
Edit 2: it sure sounds like I’m a paid shill but I can assure you I just really fucking love Proton and I get too excited about things.
I am asking here because it sounds like you might have first hand knowledge. I currently use LastPass for a password manager and I really like it’s integratiom with the Android phone and using it within app and on websites.
How is the integration of Proton into the phone? I don’t want to have to open a different app and copy/ paste the password.
Thank you.
Lastpass is the last password manager you should be using. They’ve had tons of data stolen, bitwarden is decent on android so I just stick to that. Should probably change passwords after switching over.
You need to take all your passwords out of LastPass and move to anything else. Bitwarden, ProtonPass, KeyPass, even Nextcloud, but run away from LastPass as soon as humanly possible. That shit and screaming your credentials at the top of your lungs while someone records it is the same crap.
It’s actually great. How it works most of the time is you highlight the text box in whatever app, and if proton thinks its a login box (it has like 90% accuracy) it will make a button pop up above the keyboard. Tap it, it opens proton and suggests the account it thinks this app uses. You can tap fill or search for another account. You can then tell it to always use this account for this app, or only this time. Then it goes back to the app you were in automatically and fills it. Next time you fill it there, it doesn’t need to open the app, it will just fill it.
This requires that you give it screen reading permissions IIRC but you can disable that. If you dont want this feature. Also, if you have auto lock enabled it will ask you for your password or biometric (if enabled) before auto filling or opening automatically.
I used to use dash lane and I’ve found that proton works a bit better than that on my pixel 7.
Oh and if you’re using a browser it will not ask “every time for this app” and will try to use the website you’re connected to instead. I think.
Thank you for your detailed answer. I’ll have to give it a try.
But if you want to create another email address, you get a handful of custom ones for free with the subscription too. You can revoke these the same way, so you can have a professional looking email to hand out to people that’s not auto generated, without giving out your account’s root email address.
These addresses are not as easily revoked, you have to contact support if you want to remove them.
Ah, I am mistaken then. I thought they were just as easy. Good to know you can still revoke them if need be, though.
I use Proton services (among others) since years and i think that they are pretty trustworth with stable services and fair conditions.
I’ve been using their services for the last 2 years and have no complaints. I started on the free plan and have moved up to the family plan with custom domains and aliases for everything.
Use a custom domain for your important accounts. That way, if you decide you don’t like Proton, you can move to Tuta or a different provider and recreate your addresses there. That way, the only thing you have to change is some DNS records.
I’m currently testing the paid version of tuta and proton.
Regarding the other services, as other said, keep things separate. Personally I use self hosted bitwarden for passwords and Synology drive for well, drive.
