cross-posted from: https://lemmy.world/post/40055131

OG title: We need to talk... about the Proton ecosystem

Ecosystem is a trap. It lures you in with the promise of convenience, only to lock you inside a walled garden. Like Google and Apple. They start with a good product, but then force you to use the whole suite to get the full experience. This is dangerous.

Ecosystems are concentrating all of your data and your digital life in the hands of a single entity. An entity that grows so large and powerful that it will start making compromises against your rights only to find more ways to profit or protect their business. The larger the ecosystem, the bigger data harvester it becomes. It becomes a bigger target for hackers and the more products it offers the more data it has to give to the surveillance state.

We know that the big tech does this, because their only moral value is the shareholder value. [4] But when a private company starts quacking like a duck in the steps of the big tech, it should worry us the same way. That company is Proton. The maker of the most renowned privacy products that have always been meant as ethical alternatives to the big tech.

Today, Proton resembles more and more the ecosystems of Google and Apple than it does its noble origins of fighting the big tech. This is a problem. It’s a problem for your privacy and it’s a problem for the whole community. But you probably never of heard of this perspective, because none of this is talked about enough. There is a reason for this.

You see, most content on Proton you’ll find, is coming from sources that are sponsored or affiliated with Proton. And I know how lucrative Proton’s deals are, because Proton even tried to pay me. Of course, I refused their offer, because taking their money would incentivize me not to recommend against Proton products. I am uniquely positioned to give you a nuanced critique of Proton and how to solve this problem.


Some good points to be said. I find the overall argument a bit weak as it is mainly one of user erorr of sorts. Btw THO has some pretty good back log of videos on privacy; check out their stuff on burners phones and anonymizing yourself at a protest.

all 13 comments

sorted by: hot top controversial new old
[–] 9 points 11 months ago (2 children)

Some good points to be said. I find the overall argument a bit weak as it is mainly one of user erorr

Thematically adequate typo!

  • source
  • hideshow 2 child comments
  • [–] 9 points 11 months ago (8 children)

    Mozilla Thunderbird is about to launch Thundermail, which looks like it will be more open (no bridge to use in email clients), include a free tier eventually, and of course is owned by a nonprofit unlike Proton.

  • source
  • hideshow 8 child comments
  • [–] 1 point 10 months ago (5 children)

    Who has access to my emails at rest in Thundermail?

  • source
  • parent
  • hideshow 5 child comments
  • [–] 1 point 10 months ago (4 children)

    Similar to Proton & Tuta, they're storing it encrypted at rest. However you really only have full encryption at rest if the sender encrypts their email with your PGP Key or S/MIME Certificate. There's nothing stopping Proton or any other provider from making a copy of every email not sent using this as it arrives or sends.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 10 months ago (3 children)

    Where do they state that they're storing it encrypted at rest (in a way that they don't have access to)? I've found very little technical detail on the service.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 10 months ago (2 children)
  • [–] 1 point 10 months ago (1 child)

    Forgive me being pedantic about this, but who holds the keys? Gmail stores your emails encrypted at rest as well.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 10 months ago

    It's a good question. I think you're right in that maybe they haven't been fully clear yet on that. If the encryption at rest is based on PGP or S/MIME, that would likely be the only scenario where the keys could reside on your host if you have your private key there

  • source
  • parent
  • [–] 1 point 9 months ago

    If you were not concerned about executing subpoenas yourself, self host, even on an openwrt.

    If you have email, the Calendar, Contacts, notes/tasks, functionality can be also replicated on a shoestring budget. You might have to write some code, but you would be ok.

  • source
  • 31 comments in c/privacy@lemmy.ml view that post
    [–] 76 points 11 months ago* (last edited 11 months ago) (1 child)

    I'm also a fan of spreading eggs into multiple baskets, but I'd be happy to see someone go full Proton if it means they leave Google

  • source
  • hideshow 1 child comment
  • [–] 36 points 11 months ago (6 children)

    I don't disagree, but until I start self hosting, I would rather support the competition.

  • source
  • hideshow 6 child comments
  • [–] [S] 21 points 11 months ago (5 children)

    I would like to see Proton have more support for Linux and Fdroid. It is one reason why de-googling my email has been left to the end.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 9 points 11 months ago (1 child)

    I'm no power user. The VPN client works fine on Ubuntu. For everything else on Ubuntu I use a web browser.

    Some of the proton apps are on f-droid.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 47 points 11 months ago

    Agree but nobody forces you to use anything except ProtonMail or ProtonVPN. In fact I have a visionary account and I mostly just use ProtonMail. I do use ProtonVPN but I also have WireGuard. Also my ProtonMail addresses are behind domains I host. If tomorrow I decide to switch away from Proton, I can.

    So... sure Proton is not perfect and centralization is bad but IMHO it's like saying Firefox is imperfect so it's fine to use Chrome or Chromium browsers. Imperfect alternatives to BigTech and surveillance capitalism is better than relying on the things you hate until something "perfect" never comes along.

  • source
  • [–] 23 points 11 months ago (7 children)

    The average person is not going to sign up and pay for 10 different things, even if it's slightly more private. Proton is similar to Google in that it's free and has a lot of things with one account, but vastly different in the way the data is handled, probably the most meaningful difference. I mean the best thing you can do is self host but it's obviously not something everyone can or wants to do. So there's nothing wrong with taking the next best thing.

  • source
  • hideshow 7 child comments
  • [+] -11 points 11 months ago (6 children)

    They've been known to respond to legal requests to log IP adresses of the users of their VPN. I wouldn't trust them.

  • source
  • parent
  • hideshow 6 child comments
  • [–] -5 points 11 months ago (4 children)

    i stopped trusting them when their ceo voiced support for trump.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 12 points 11 months ago* (3 children)

    Andy Yen (the CEO) supported one single choice trump made, because he felt it would be good for little tech and bad for big tech. He never stated he supported trump or even the republican party as a whole. The whole thing got blown out of the water by redditors attacking the comment with no regard to context because every single thing a republican (and especially trump) does has to be evil, even if it's good for us. Ignoring the fact that Proton has publicly criticized trump on a number of occasions and donates millions to liberal organizations.

    Here's a great analysis made with sources and reasoning provided throughout the whole thing, with the author ultimately concluding that they believe Andy is far more likely to be a liberal than pro-trump or MAGA. Again, with actual sources and reasoning rather than one context-less tweet.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 10 months ago (2 children)

    he's the ceo that gets to decide which way to steer the company and liberals & conservatives are the two sides of this pro-capitalists clusterfuck coin that make people like trump a reality.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 10 months ago (1 child)

    Perhaps, but my only point is that the CEO likely isn't pro-trump. I've seen zero evidence for that aside from him publicly supporting a single decision the guy made.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 10 months ago

    I doubt yen is pro-trump, but I also don't doubt that he's pro-profit.

    Also, no one doubts that a high enough profile CEO speaking publicly about Trump is a big deal, but too many still doubt class solidarity is a thing despite it being out in display like a hunger games cosplay during the inauguration.

    I doubt they even invited yen. Lol

  • source
  • parent
  • [–] 16 points 11 months ago

    One big and important difference for Google and other similar ecosystems is that usually they are free and they profit of selling your data and ads. Proton is different since to use their ecosystem you have to pay to get in so they are not as incitevized to sell data since they already have that cashflow. That's not to say that can't change as we all know for profit companies tend to try other means of profit if they can.

  • source
  • [–] 12 points 11 months ago

    How do they force you? I just use them for email and VPN.

  • source
  • [–] 11 points 11 months ago*

    I stepped away from Proton as soon as they started pushing more than just mail and VPN and started bombarding me with prompts to subscribe to one of their plans.

    I dont appreciate things like my protonmail app icon being changed to say "Black Friday" on it thank you very much.

  • source
  • [–] 8 points 11 months ago

    I get where you're coming from but it was all the result of user requests. People were asking Proton to make more services and apps for years

  • source
  • [–] 15 points 11 months ago*

    Proton is targetting enterprise who would love a secure alternative to Google Workspace. A normal consumer don't need to put all eggs in one basket. I don't think Proton is forcing you either. I just use their paid email service.

  • source
  • [–] 6 points 11 months ago

    I just use them for my email and calendar.

  • source
  • [–] 9 points 11 months ago

    You're not locked in. I can transfer everything in 10 minutes.

  • source
  • [–] 12 points 11 months ago (2 children)

    I left Proton after the weird comment made by its ceo. I now have my email hosted with my own domain.

  • source
  • hideshow 2 child comments
  • [–] 6 points 11 months ago

    Since when did it become unethical to express an individual's opinion? Andy (Proton CEO) is just like any other human. He has his own flaws and opinions. What you need to look into is whether Proton products are secure and private as they claim.

    Unlike Sam Altman, who made OpenAI a for‑profit company from a non‑profit, Andy turned Proton into a non‑profit from a for‑profit. I don't see many people appreciating that. But when someone expresses a political opinion, they're canceled for life. I wish cancel culture would die away.

  • source
  • parent
  • [–] 2 points 11 months ago

    Yeah maybe... But Proton is a private company which shields them from much of the external forces the big guys are always scrambling to please. The Proton ceo can still choose not to enshitify and keep his job. Time will tell I guess.

  • source
  • [–] 1 point 10 months ago

    I totally understand the issues with having a toolset offering, but at the same time, there's no way someone that is not as concerned to privacy, or a business that uses basic office tools, to consider Proton as an alternative to Google or Microsoft. They don't have only an email and calendar, they have a full work tooling suite, which is very important to a lot of people. I believe we should work for more companies to develop their own apps and systems, even a full ecosystem. Otherwise, we might land on the same problem streamings are right now: there are so many of them, that it's again easier (not only in terms of money) to download movies and tv shows. If you have 10-20 apps you need to pay or to keep updated, add new users through a management system, you will probably not choose those tools and move to one that includes everything. I personally am sticking to Proton for mail, calendar drive, and VPN, but I'm going with OnlyOffice for office tools, and considering between keeping 1Password or moving to Bitwarden, since the cost of 1Password is high - it is totally worth it, just not currently my plan to keep that expense

  • source
  • 13 comments in c/protonprivacy@lemmy.world view that post
    [–] 31 points 11 months ago* (last edited 11 months ago)

    Historically that's all true, and good reason to keep an eye on them.

    But Proton is very much different than all the previous companies in this space. They're a non-VC funded private non-profit, with a board of trustees made up of scientists and engineers. The buisness model is funded by subscription, not ad sales. And by design, they themselves have no access to any of their users data.

    With all that in place to prevent enshittification, I don't realy see any rational reason for concern.

  • source
  • [–] 17 points 11 months ago (2 children)

    Yeah, I left recently had a family plan $20 a month, but the value ad was just not there, and then I saw them spending money on crypto and AI, and we all use Linux, so I feel like we got left out in the cold in a way, no drive client etc

  • source
  • hideshow 2 child comments
  • [–] 5 points 10 months ago

    Same, I migrated storage to nextcloud on hetzner, but I'll keep my protonmail and a cheaper proton subscription than I had before if possible, or else just the free tier. I'm just not sure their heart is in the right place. For example they have social media presence on basically all platforms including X, instagram, tiktok, linkedin, reddit, threads, facebook, whatsapp, etc, but they closed down their mastodon account because of lack of resources.

  • source
  • parent
  • [–] 7 points 11 months ago

    I use proton bridge with thunderbird. I ignore the rest of the suite of services (i wish i could pay less for stuff i dont use)

    i dont feel trapped as long as i stick to email only. I self host the rest of it (files, calendar)

  • source
  • [–] 3 points 8 months ago (1 child)

    A great thing about the Proton "ecosystem" is that it is not like Google where you need an account to access docs (or VPN on mobile!), though I agree that centralisation isn't the best thing for tech nerds like us. That's why I prefer to just use ProtonMail and VPN, and leave the other stuff like drives and password managers to other open-source projects.

    (Also, having an ecosystem may be good for those who refuse to put in as much effort as us, or those who simply do not understand as much as we do. I personally don't support centralisation, but there's a reason that non-tech nerds often do.)

  • source
  • hideshow 1 child comment
  • [–] 2 points 11 months ago

    Yeah. I'm hoping to go mostly self-hosted.

  • source
  • [–] 2 points 11 months ago (4 children)

    100%

    Proton should fire bootlicker Andy and fix their current products instead of spreading out and vibe coding as many apps as they can to grow their own centralized monopoly.

  • source
  • hideshow 4 child comments
  • [–] 6 points 11 months ago (2 children)

    He's the reason I left. Oh well. Mullvad has since been a better VPN experience, anyway, and secure email options aren't tough to find.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 11 months ago

    I think he may have doing what other companies did; kiss trumps ass to stay out of his "we need to go after these guys" radar. Trump could easily have ordered no offshore encryption allowed or some nonsense that would limit them operating in the USA

  • source
  • parent
  • 7 comments in c/privacy@lemmy.ca view that post
    [–] 16 points 11 months ago* (last edited 11 months ago) (2 children)

    There's a lot one can knock Proton for but having a comprehensive suite of features is not one of them on its own.

    The set of features is not unique, e.g. Nextcloud can do much of what Proton offers.

    If people distrust Proton solely for the fact that they are trying to have the same feature set as Google and Microsoft, then that kneecaps any potential competitor against this duopoly. If the ideal way is to pay for a VPN provider, cloud storage, email and document editor all separtely or self-host each, it's not really accessible to many either financially or in terms of technical knowledge.

  • source
  • hideshow 2 child comments
  • [–] 5 points 11 months ago (1 child)

    If people distrust Proton solely for the fact that they are trying to have the same feature set as Google and Microsoft, then that kneecaps any potential competitor against this duopoly.

    The problem is not that they are trying to have the same feature set. It's that they are enforcing using those only with theirs, not open source, tools. Last time I checked there was no way to use their mail service with mail client of ones choosing, for example. That's the golden cage

  • source
  • parent
  • hideshow 1 child comment
  • [–] 6 points 11 months ago

    Last time I checked there was no way to use their mail service with mail client of ones choosing, for example. That's the golden cage

    I looked before and IMAP is still supported for any paid plan, you are limited to webmail and 1st party apps if on a free tier.

    I understand the argument against centralization, it's part of the reason I like the Fediverse and I'm on Lemmy to begin with. But are there any other core parts of Proton that is exclusive to itself that they are needlessly locking in a walled garden?

  • source
  • parent
  • [–] 3 points 11 months ago

    I switched from Google to Proton a few years ago and am happy with it, though it's not perfect. I only really use Mail, Pass, and Drive.

    Tne thing I really wish was better is their Calendar. It has all the basics but a robust task system and extras like timetracking could make it awesome.

    Unfortunately I am still using Google calendar as it is central to my time and task organization.

  • source
  • [–] 2 points 11 months ago

    Honestly, Proton has seemed shady this whole time. I got a bogus gmail account so that it would not move all my google spam to my Proton account. Then it sent an email notification to a completely different gmail saying that I needed to check 5 new Proton emails. Like, I did not want that to be known, hence my reason for switching to Proton. It pissed me off, so now it is just my email trash can. I'll find another junk email when I pay for extra domains elsewhere.

  • source
  • [–] -3 points 11 months ago

    given how close proton and andy yen are to oppressive governments, you should trust anyone but them.

  • source