For context, in my password manager I had tried formatting some of my entrees so that it would contain the usual username and password, but instead of creating whole new entrees for the security questions for the same account, I just added additional fields in the same entree in order to keep things a little more tidy.

I was not expecting that doing so would result in later being shaken down by Proton to pay even more money just to access the same few bytes of fucking text I had trusted them with. This is sleazy as fuck and I am dropping these idiots entirely.

Sleazy Proton

top 84 comments

sorted by: hot top controversial new old
[–] 64 points 9 months ago (7 children)

KeepassXC + Syncthing has worked fine for me for a few years. Sure, it's a bit of a hassle and not exactly perfect, but nothing is. I have control over my data and I don't have to pay anyone anything, that's enough for me.

Also, tasty entrees 🤤

  • source
  • hideshow 7 child comments
  • [–] [S] 9 points 9 months ago

    This is the route I'm taking. Keepass has always been tried and true. I switched from Keepass to Proton Pass for a while, and in more ways than this one complaint it has been very much a downgrade.

    Proton does not know how to make quality software.

  • source
  • parent
  • [–] 7 points 9 months ago (1 child)

    Hassle? What hassle? Adding a new device to the syncthing swarm and adding the folder where your database is stored?

    I also have been using KeepassXC and syncthing for years. Best thing I have ever done!

  • source
  • parent
  • hideshow 1 child comment
  • [–] 106 points 9 months ago (25 children)

    Download BitWarden and be done with it.

  • source
  • hideshow 25 child comments
  • [–] 39 points 9 months ago (17 children)

    If you can, just self-host vault warden (compatible with bit warden and supported). Gets your data out of the cloud entirely.

  • source
  • parent
  • hideshow 17 child comments
  • [–] 47 points 9 months ago (12 children)

    I’m with you, but the hosted subscription is miles more secure than I can make my installation, and at $10 per year probably cheaper than the electricity to self host. Plus it supports the devs.

    But I do make regular backups in case I need to migrate.

  • source
  • parent
  • hideshow 12 child comments
  • [–] 12 points 9 months ago (8 children)

    I think their prices have increased, but it's still a good deal

    https://bitwarden.com/pricing/

  • source
  • parent
  • hideshow 8 child comments
  • [–] 8 points 9 months ago (2 children)

    Apparently the price increase happened yesterday; I hadn't heard anything about it until just now. Gave me the push I needed to switch to self-hosted vaultwarden in like 15 minutes. Very pleased with how simple the docker compose and export->import were. I'll note that I'm running it privately on my local network, which I'm assuming should work fine as my devices enter that network semi-frequently and should keep everything synced up(?).

  • source
  • parent
  • hideshow 2 child comments
  • [–] 5 points 9 months ago

    If you want a nice way to elevate the usability of your setup use Tailscale (or self-host Headscale) and run your devices on a VPN.

    My devices are never not on my "LAN", they maintain a VPN connection and access my local services as if they're wired in. Remote pihole, multimedia streaming, password management etc are all covered by this one solution without needing to deal with reverse proxies and certificates.

  • source
  • parent
  • [–] 2 points 9 months ago

    Yeah, it'll work fine. It syncs occasionally but you can also force a sync. Just make sure you backup somewhere (with an encrypted backup you can do it anywhere, even Google drive without privacy issues) incase of fire or wtv. If you'd like online access you could also setup wireguard with a route to it.

  • source
  • parent
  • [–] 9 points 9 months ago (3 children)
  • [–] 2 points 9 months ago (1 child)

    What is your backup process like? Still haven't figured this one out. Not sure if it makes sense to export encrypted where I can only access My vault with the same account, or unencrypted but then leaving it open and exposed somewhere or in multiple places.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 9 months ago*

    Your first point is debatable. You still have to trust them to be that secure, and you can't verify that. If they are ever breached, it's literally the worst case scenario. You can self-host their solution, but only in the enterprise tier (6$ per user per month). Also BitWarden is a target woth attacking, I am not. BitWarden hosts thousands of instances worthy of being attacked individually. A personal VaultWarden instance of "Mike and Molly Peterson" isn't exactly an attractive target. I do think they are pretty secure, but a single mistake with these stakes can have immense consequences. LastPass was also breached repeatedly, with a similar buiseness model.

    The second point about electricity wouldn't be true in my particular case, as the server for self-hosting it is running anyway. Running VaultWarden or not doesn't change the power usage noticably. Obviously this is different for someone who doesn't just have a server at home running anyway.

    Side note: I'm not actually running a personal VaultWarden instance, as my personal requirements are being met just fine with KeePass files. We do run an instance at work, but it isn't world-accessible (internal access only).

  • source
  • parent
  • [–] 9 points 9 months ago (3 children)

    Why are you suggesting self hosting vaultwarden instead of self hosting bitwarden?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 3 points 9 months ago*

    Self hosting BitWarden still means it's accessbile for them and/or from them. You also have no way to audit their security from what I understand. VaultWarden is FOSS, if you want to, you can go check. And it does get checked by people with the competence to check this do every now and then. [Edit: I forgot that BitWarden is actually souce-available as well, while not being FOSS that's still better than most solutions]. I just prefer full FOSS whenever possible. I prefer it not be a black bos I just happen to run on my own server.

    If you self host VaultWarden, the instance can just be not accessible from the internet, and only from behing a VPN. Obviously this is inherently much safer. If that's possible with the self-host option I don't know, but even just for licensing the local instance will have to be able to reach their servers (possibly be reachable from their servers, too). I did see they got an "offline deployment" option for air-gapped servers, but haven't looked into what limitations that entails.

    Additionally, you're still within their licensing model. So for certain features you need to have a not-free account (like even just more than 2 people).

    And like others said, VaultWarden is much lighter on resources in general and you aren't limited in what you can and can't do (users, collecitons, auth-options, ...).

  • source
  • parent
  • [–] -2 points 9 months ago* (3 children)

    Bitwarden doesn't do any of the stuff that makes proton pass extremely usable. You can't easily manage logins and create them on the fly with custom emails in bit/vaultwarden. That is by far the most valuable feature of proton pass IMO, the seamless integration with simplelogin is just so damn convenient.

  • source
  • parent
  • hideshow 3 child comments
  • load more comments (1 reply)
  • [–] 24 points 9 months ago (2 children)

    Bitwarden offers this feature for free using custom fields, although 2FA is paid unless you self-host IIRC

  • source
  • hideshow 2 child comments
  • [–] 21 points 9 months ago

    OMG I thought I was the only child of Mr and Mrs Upgrade, of Upgrade street, Upgrade! Maybe we're related?

  • source
  • [–] 18 points 9 months ago (4 children)

    Howdy. For the clarity of users such as myself, can you please clarify which "Proton" you're referring to.

  • source
  • hideshow 4 child comments
  • [–] 15 points 9 months ago (3 children)
  • [–] 6 points 9 months ago (2 children)
  • [–] 19 points 9 months ago (1 child)

    Eh. I am very happy with thwir service, but I didn't opt for the free tier. It has replaced my old VPN service provider, 1Password, google's 2FA, Google Drive, and the office suite is useful.

    Since i was paying for other services that offered no privacy, switching to a single paid service with privacy ended up saving me money, so no complaints.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 11 points 9 months ago

    I too am happy. i migrated from Firefox password manager, google mail, Cisco duo (kill it with fire please for the love of Turing and Tesla), and several other services. the only thing they don't have that I really want at the moment is collaborative document editing but I'm pretty sure that's on the docket of "things to add".

  • source
  • parent
  • [–] 15 points 9 months ago (3 children)

    Bitwarden ! Host it yourself.

  • source
  • hideshow 3 child comments
  • [–] 16 points 9 months ago (2 children)
  • [–] 2 points 9 months ago (1 child)

    Will host that myself eventually, but a little scared by hardware prices. All I have is a desktop PC with a 700W PSU, probably unsuitable as a home lab.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 9 months ago

    I've been homelabbing for a couple years now, and it's still just a desktop PC with a 450W PSU, it even has a Jellyfin server with some light transcoding. I'd highly recommend trying out a server you don't mind breaking and play around, you'd be surprised what you can do!

  • source
  • parent
  • [–] 27 points 9 months ago (3 children)

    I know someone that signed up for an account with them, they froze it immediately for suspicious activity. He does nothing with that IP address, reads, social media, that's it. No way to get off the shit list without giving up personal information like a phone number and or alternate email and no guarentee that would fix it.

    Their IP was on a blacklist from some shady company for some strange reason. But other companies let you write the company and plead your case, proton does not.

    They further suspended a bunch of accounts based on some half baked unproven accusations by the government(s) if I recall.

    They aren't trustworthy, they will give you up at the first sign of friction it appears.

  • source
  • hideshow 3 child comments
  • [+] 7 points 9 months ago (2 children)
  • [–] 9 points 9 months ago (1 child)

    Can you still access the info by hitting edit? It was possible last time I checked. Even so, yeah, I'm thinking a transition to bitwarden is not a bad idea.

  • source
  • hideshow 1 child comment
  • [–] [S] 7 points 9 months ago

    According to other comments in this thread, Bitwarden does similar crap. I went back to Keepass.

    As for the data, luckily it was for an account I don't need or use anymore, so I just deleted everything and moved on.

  • source
  • parent
  • [–] 7 points 9 months ago* (last edited 9 months ago) (2 children)

    But I don't understand, were you already a premium member when you were prompted to pay more?

  • source
  • hideshow 2 child comments
  • [–] [S] 2 points 9 months ago (1 child)

    I had to look into it again because their pricing models are weird and confusing. My current plan is something called Proton Plus, $4.99 per month, and evidently the benefits do not extend to Pass.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 9 months ago*

    Oh yeah, this is a very annoying pricing model. Proportionally very expensive for each individual part/product, but then a proportionally lower price for the whole thing. But in absolute amounts, more money was payed.

    The closest example I can think of is fast food cup sizes.

    What they want is for you to think "Hmm I need a VPN and an email, but it's cheaper to just buy the whole unlimited package"

  • source
  • parent
  • [–] 29 points 9 months ago (6 children)

    shaken down by Proton to pay even more money

    What are you paying for currently?

  • source
  • hideshow 6 child comments
  • [–] [S] 4 points 9 months ago (5 children)

    I had to look into it, because their pricing plans seem to have changed now. Evidently I have something called Proton Plus, $4.99 per month. It looks like that plans benefits do not extend to additional Proton Pass features.

    I'm going to be transferring accounts away from Proton and then closing my accounts entirely. Already moved all my passwords back to Keepass. My main email address has been on posteo(.de), which has been great. Super reliable service from a company who appears to actually get the ethos of FOSS. I only pay, I think $12 per year for their service.

  • source
  • parent
  • hideshow 5 child comments
  • [–] -2 points 9 months ago (4 children)

    Yeah I thought so. If ya don't pay for it, ya don't get to complain about it, bud.

  • source
  • parent
  • hideshow 4 child comments
  • [–] [S] 3 points 9 months ago (3 children)

    I'm sorry, but what? Number one, we're talking about text. Bytes of data, which costs next to nothing to store. If you think that it is in any way fair for a company to allow a person to enter information into an account, and then unexpectedly charge them to access that same data, you are insane. If you paid for a storage rental, moved your belongings into it, and then found that the company changed the lock and decided you had to pay more to get your stuff - would you continue renting that storage?

    Go back to reddit, corposhill.

  • source
  • parent
  • hideshow 3 child comments
  • [–] -2 points 9 months ago (2 children)

    we're talking about text. Bytes of data, which costs next to nothing to store.

    No but your files are not stored as text files. That's not what you're paying for. You're paying for the development of the software used to create, store and fill them at the appropriate times and places. If you don't care about that, just keep them stored as text files on your computer. Boom, problem solved.

    If you paid for a storage rental, moved your belongings into it, and then found that the company changed the lock and decided you had to pay more to get your stuff

    You keep using that phrase. You are not "paying more" because you never paid anything in the first place.

    Go back to reddit, corposhill.

    If you think Reddit is the only place that's going to call you out for being a choosy beggar, you're in for a surprise.

  • source
  • parent
  • hideshow 2 child comments
  • [–] [S] 0 points 9 months ago (1 child)

    No but your files are not stored as text files. That’s not what you’re paying for. You’re paying for the development of the software used to create, store and fill them at the appropriate times and places. If you don’t care about that, just keep them stored as text files on your computer. Boom, problem solved.

    But you say just below this that I never paid for anything in the first place? In any case, whether paid or not, they still have to compete with other options including free ones like Keepass. Why would I pay for Proton over the free Keepass if Proton is basically ransomware?

    You keep using that phrase. You are not “paying more” because you never paid anything in the first place.

    Untrue. I was paying for it, and they required that I pay even more just to access the data that their system allowed me to enter.

    If you think Reddit is the only place that’s going to call you out for being a choosy beggar, you’re in for a surprise.

    You rn:

  • source
  • parent
  • hideshow 1 child comment
  • [–] 0 points 9 months ago

    you say just below this that I never paid for anything in the first place?

    Excuse me, let me correct myself: That's what you're not paying for. Better? Does that make you anymore correct?

    Why would I pay for Proton over the free Keepass if Proton is basically ransomware?

    KeePass is local storage. It's not managed. But by all means, If you don't see the value, use KeePass. Not sure what you're complaining here for.

    I was paying for it

    Okay, so you stopped paying for it. That's why you can no longer access it. You can still export your data and import it into KeePass. So go do it.

    You rn:

    1. Proton is most certainly not a multi-billion dollar corporation, moron.
    2. Your argument suggest that corporations aren't possibly able to hold a valid argument. I'm not siding with the corporations, I'm siding with basic logic and reason. It's not complicated. You are not entitled to anything they offer if you don't pay for it.
  • source
  • parent
  • [–] 37 points 9 months ago (8 children)

    I tried protonmail not for the privacy purpose but just to have a normal web email client.

    After wasting an hour before finding out you can't disable the "sent from protonmail" footer without manually deleting it in each draft you make, I said screw it and deployed my own email server with stalwart lol.

    It's receive only because outgoing SMTP is a pain to make reliable these days and my ISP blocks outgoing SMTP anyway, but for everything else I now use Thunderbird.

  • source
  • hideshow 8 child comments
  • [+] 21 points 9 months ago (5 children)
  • [–] 16 points 9 months ago (4 children)

    IIRC free users don't have that option.

  • source
  • parent
  • hideshow 4 child comments
  • [+] 27 points 9 months ago (1 child)
  • [–] 5 points 9 months ago

    Yeah I wanted to complain about it, but when the service is free I don't have any right to. I will say that I upgraded to paid and still ran into a limitation. On Gmail, I use the Snooze and Schedule Send options a lot. In Gmail I have scheduled financial reminders for literally years in the future. Proton only lets you schedule 90 days into the future, that's it. I gotta wonder about the logic of that. At the very least, let me schedule messages until the end of my subscription.

  • source
  • parent
  • [–] 7 points 9 months ago* (last edited 9 months ago) (1 child)

    It might have changed but there is a setting for it now.

    Pretty annoying that I'm just learning setting no signature did nothing since they added a second signature option for when sending from mobile and enabled it by default.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 12 points 9 months ago

    I have always hated this, the signature settings need to be unified. Why would I ever want a different signature to alert people that I am on my phome. Gmail allows ios to match their web signature but not android.

    Sent from my fucking phone.

  • source
  • parent
  • [–] 13 points 9 months ago (4 children)

    ??? I use Proton mail and I never saw something like this. Account with nick, other mail, password and go.

  • source
  • hideshow 4 child comments
  • [–] [S] 17 points 9 months ago (3 children)

    It's in Proton Pass. When you create an account entree, there is an option to create additional fields that you can name and fill out, kind of like multiple notes in one file. Somehow I was able to create those fields on my account just fine, but then to be given access to that data it turned out that I had to upgrade my account. In other words they duped me into entering data at no extra cost, but then charged me to access that same data later on.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 9 points 9 months ago* (2 children)

    What tier do you pay for now? Did you ever downgrade your tier?

  • source
  • hideshow 2 child comments
  • [–] [S] 2 points 9 months ago (1 child)

    I am on Proton Plus, $4.99 per month, which I now see does not appear to extend to Pass benefits. I've switched password managers already, and am going to be moving everything else over to other apps and services and cancelling my Proton accounts entirely.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 4 points 9 months ago*

    Use keepassXC instead. You don't need any kind of cloud for a password manager. Keepass database can by synchronized between devices with syncthing. Safer and free forever

  • source
  • [–] 7 points 9 months ago (2 children)

    I don't think that's where entrees go.

  • source
  • hideshow 2 child comments
  • [–] 3 points 9 months ago

    Answer for all

    "yourmom"

  • source
  • [–] 3 points 9 months ago (1 child)

    For the password and passkeys manager I went with a selfhosted solution: AliasVault on an VPS and it's really great! If you have a domain name you can have unlimited aliases with it's built in email server (with a subdomain and for receiving email only so you don't have to worry about being blacklisted)

    The installation script is making everything for you, even fetching the TLS certificate from "let's encrypt"

    There's Android and iOs support as well as add-ons for most browsers

  • source
  • hideshow 1 child comment
  • load more comments
    view more: next ›