I currently self-host NextCloud and run TailScale to access my home network and use as an exit node for a secure connection when I'm out and about ¯\_(ツ)_/¯
this post was submitted on 27 Feb 2025
128 points (93.8% liked)
Privacy
34362 readers
741 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
So the whole "we encrypt your life" thing is pretty nice. But in reality look at what you're actually doing... You have super secure encrypted email to do what? Send unencrypted emails to your friends...
It makes no sense to me... Like, you need an encrypted calendar? Why? What are you getting with encryption that you can't get with using a VPN to connect to your local network and access a self-hosted calendar. In what was is that less secure?
Drive? Sure. VPN? Sure. Password manager? Sure. Documents? Sure. I see the value in having H/A for services like this, but all of that can be self-hosted on an rPi in your basement with a rProxy and a domain.
One reason is to prevent targeted advertisement.
It doesn't, though. Not even a little bit. Using encrypted services doesn't stop tracking cookies. That too has to be handled client side. So you would use a browser that lets you use host files via extensions (firefox, etc) and other tracking blocking extensions, or you can setup network wide protection via Adguard Home, etc.
It does. You need both. Even if you have cookies disabled, Gmail can read all of your emails and use that information.
You need both.
For the third time now--not if the service/device you're using contains both the password and the 2FA... How is this not getting through?
If someone gets into my Bitwarden install, and gets access to both my passwords and my 2FA seeds, in what way does 2FA protect me? I kept all the family jewels in one place. That's the exact situation two factor authentication is designed to prevent by forcing you to have an additional and separate device/key/passcode/password.
Say it a fourth time if you want to continue feigning ignorance. You're assuming that the only way your credentials could be compromised is if your password manager it compromised. 2FA would not protect that specific use case if you store both authentication methods in your password manager. However, it does still protect your services from other types of compromises, which is better than no 2FA at all.
The whole universe
I remember when the Chick-fil-A CEO got a lot of flack. While I disagree with him, I still eat at CFA. Until I feel like the quality of the service is or will be compromised, I do not plan on migrating off of Proton.
I honestly don't see the big deal with people hating on proton. It's still open source it's still encrypted and doesn't mine your data that seams to check most of the boxes for me. The only problem I had with it was the default main client which shows upgrades to go unlimited all the time but I just use Thunderbird now.
The hate for proton is because the CEO Andy Yen retweeted Trump announcing his pick for assistant attorney general for antitrust cases. His retweet included commentary fawning over Republicans as “standing for the little guys.” When criticized the company doubled down and supported him but then said they wouldn’t be making any more comments because it was a distraction.
If that isn’t enough, someone noticed that CEO Andy’s Reddit username is ”andy1011000.” The numbers at the end are binary for “88” - a well known pro-Nazi dog whistle. He says this is only a coincidence and is meant to refer to being born in 1988.
So in summary he is publicly praising fascists and has a username which coincidentally has a pro-Nazi reference.
According to Wikipedia pages 14, 18, 1488, 8814 are also common Nazi's symbols. I personally feel the birthday explanation more likely as I see a lot of people doing that (without the nerdy base 2).
But yeah, I'm not sure of anything now, if you told me a few years ago that dozens of billionaires would go full on highlander on 2025 I wouldn't have believed you...
I agree it could be a coincidence. It’s just a really unfortunate coincidence in light of his public statements and the fact that so many other corporations are doing an any% evil speed run right now. Folks are right to ask questions and be wary.
I get the controversy about the CEO being controversial but the services that proton make are still very good for the most part. And since they're open source and encrypted you don't need to trust proton anyway (aside from the VPN).
Self host email and nextcloud. Keepass for pw manager. I use davx5 and fossify calendar for mobile calendar. Nextcloud mobile just manages your files and doesn't have the other Nextcloud apps.
Idc about Proton either way though. Imo if proton was fine for you before then it's fine for you now. I just prefer to have control over my own services.
What assurances do you have they won’t go full proton in the future?
Absolutely none. That applies to all services that exist now or in the future. The only way around that is self-hosting but that path has its own issues including a very steep learning curve if you want to be secure as well as private. Maybe this could be a longer term project to work towards?
For services:
- Mail - Mailbox.org seems the best option right now
- Calendar - don't know.
- Drive - either Cryptomator used with literally any service or a dedicated service like Filen
- VPN - Mullvad
- Password Manager - Bitwarden
- Documents - I just use LibreOffice offline or CryptPad occasionally if I'm collabing with someone.
In truth none of these are perfect. Privacy has got a lot harder recently as Proton and StartMail/StartPage have politically shit the bed and the UK seems determined to kill encryption which means I have to avoid really good services like IceDrive just because they're in the UK.
EDIT: Calendars. Mailbox.org's included one works fine. You can sync using CalDAV. The process for Thunderbird (desktop) is here.
The process for mobile is a little more complicated. First you need Davx5 to actually get the data, but thats all that app does. It's not a Calendar app. It does work with the native Android Calendar but I used FossifyCalendar.
So install both of those then login to your Mailbox account in a browser and create a Calendar (or use an existing one). Get its unique URL by looking under the heading 'My Calendars', clicking the three bars icon, click 'Properties' and you can then copy your CalDAV URL.
On your Android device open Davx5, tap the plus icon then specify 'login with URL and username' tap 'continue' then paste in the URL you copied earlier, your email address and your email account password, tap 'login' and that should work.
Now, switch to your Calendar app. I used Fossify Calendar so if you are too, open that up, go to Settings, scroll down to the CALDAV section and turn on CalDAV sync. It might switch to your new Mailbox calendar now, but if it doesn't, tap 'Manage synced calendars' and activate it there.
Can you provide any link for what Startpage has done wrong? I’m familiar with the Proton situation but hadn’t heard anything about Startpage. I’ve actively been looking for non-US based search engines.
Regarding Password Managers, you can put a little extra effort into setup with KeePass + SyncThing to avoid using 3rd parties at all.
Highly recommend not relying on a cloud provider for this kind of thing. You're just asking for one of two things to happen:
- Their servers get compromised
- They decide to shut down
I know you can self-host with vaultwarden, but if you're not a self-hoster then it's a little bit simpler to setup SyncThing and use the kdbx format.
Thats a good point, I might set that up myself!
At the moment I do a once-a-week encrypted export from BitWarden and Aegis (authenticator) and put those exports onto an encrypted USB pen drive to avoid the issues you mention but I think your way is probably better.
You mentioned another excellent tool, Aegis!
I use it too, and I have it set to auto-export every time I add a new OTP provider to my SyncThing system. Since you can encrypt the exports, it fits nicely and have my OTPs available everywhere.
I can personally recommend fruux for calendars and contacts, but their free accounts are rather limited.
Tuta is a great german alternative with e-mail and calendar. For Drive there is many options but I don't feel recommanding one now For VPN there is Mullvad, IVPN and NymVPN(beta) For Password Manager there is BitWarden or any popular KeePass clients but sync is mainly on you. For Documents there is CryptPad
I wholeheartedly agree with Tuta over Proton Mail!
And to add to password manager, KeePass + SyncThing is excellent if you need to access your vault on multiple devices without any 3rd parties involved.
It does not offer all the options from proton but I bought my own domain from OVH provider (France). Can configure email addresses in their admin user interface. I have one main account that I do not disclose. So when I need to create an account somewhere, I just go to OVH web interface and create a new alias for my main email.
The day OVH goes dark, I’ll just have to move my domain somewhere else.
Check out Addy.io. This would make your email alias creation much easier and manageable from your phone. They even have an api and direct integration into various password managers.
I did not know about Addy.io. I’ll definitely have a look. Thank you!
I like fastmail
There are no viable package solutions, that’s the thing. If you want to make sure your service supplier shares your values, there’s nothing but self-hosting left.
As others have said no all-in-one solution, but Privacy Guides has good recommendations for each use case
Crypt.ee looks like a solid option to replace proton drive and docs(only for solo use) if you don't mind their UI/UX. It also gives me confidence in them when I read their FAQ/Privacy policy and listen to the podcasts episodes the CEO has been intertwined in.
Podcast episodes
https://neat.tube/videos/watch/cf2d43d7-56ab-42d6-82af-a0375ab7f8ca or on odysee https://odysee.com/@techlore:3/developing-privacy-tools-with-john-ozbay:3
https://neat.tube/videos/watch/2d5e2d92-f440-498b-ad1c-c2fa3d3c720b or on odysee https://odysee.com/@techlore:3/how-secure-is-big-tech-other-digital:0
https://neat.tube/videos/watch/4a279d2f-dbf3-4cb9-b5e0-377950dd702f or on odysee https://odysee.com/@techlore:3/privacy-dilemmas-education%2C-toxicity%2C:c
Tuta -- https://tuta.com/
Includes mail and calendar and contacts. No files, or password management. But worth a look, if you want an encrypted solution and you're OK with using their client apps. I do, and I am and it's great, IMO.
Their blogs say they're pro-privacy, and anti-BS, if you believe them: https://tuta.com/blog
mailbox.org but i dont put all my eggs in one basket. I only mailbox for mail.
Tuta for mail & calendar, CryptPad for cloud docs and spreadsheets, Mullvad for VPN, plus a few other random things like Disroot which offers email and some other services. There’s some overlap and duplication but I don’t want to keep all my shit in one place any more. The Tuta app is blocky but acceptable. Everything else I only view in browsers.
Proton's probably the best mail.
Calendar: paper
Documents: cryptpad
ENTE for photo storage: https://ente.io/
Crypt.ee is also an option.
Have a look at: https://www.privacyguides.org/en/tools/
Things I have changed to or plan to
Tutamail for e-mail and calendar
Plan to change Filen for cloud services
F-secure's Freedome for VPN
For the rest I'm looking for good solutions as well and also opinions on Filen or if there's other alternatives that might be better
Custom domain + migadu.com
Mail and calendar I'm still trying to figure out. VPN you don't need as long as you use HTTPS everywhere.
password manager
documents
Collabora Office + LibreOffice
What are the pros and cons relative to proton?
Pros: free, open source, and 100% offline with no intermediary company. Your file security is entirely in your own hands.
Cons: you must devise your own cross-device sync system. I use Syncthing + Syncthing-Fork.
What are the mobile apps like?
Collabora is currently just bad lol. It's best reserved for really simple edits, if not just for viewing, with all major changes made on a desktop/laptop computer. KeePassDX isn't terrible but it can't view all the fields that the KeePassXC desktop platform can, and getting it to take PIN instead of password for vault-unlocking is really convoluted (although you'd only have to do it once).
What assurances do you have they won't go full proton in the future?
They're all open-source so anyone dissatisfied with the direction that the maintainers go in can fork them at any time.
I can second most of the suggestions. I do not host an office suite (for now?) but I am syncing my keepass dbs over syncthing along with my notes and important documents. I think since 2016 or so. It works well.
Before I had a server I just synced them in a triangle between my phone, laptop and desktop. Most things had 3 copies this way. Any device could offload changes to another. Now I have a central node and the option to sync as before if the server is down. With Tailscale, I don't need to be on the same wifi now eiter.
The keepassDX limitations are not a big deal if all you need is basic autofill.
Mail providers are hard to chose. I am leaving proton for the lack of easy smtp and their locked in nature. Get your oen domain and you will be able to switch more easily in the future.
Tuta?
I just synced them in a triangle between my phone, laptop and desktop.
This is precisely my setup, haha! But I don't even use my desktop often enough to merit a server...
Yeah, I tried tuta. I have (overall less but) the same issue with proton. I just want to use my own client apps of choice.
I have registered with mailbox.org and while the trial period is very limited, the web ui is minimalistic and basic looking. You could say outdated. I seriously consider paying for a "team" account for me and my wife. The price is unbeatable. Aside from the gui, the features I need are there.
I just need the Wife's approval. She'd be migrating from yahoo of all places.
Honestly you could easily selfhost all of that except mail and maybe a VPN.
Baikal for calendar. Vaultwarden for passwords.
I can vouch for Vaultwarden and Baikal. Two great essential programs I use.
Incoming mail: my own server and my own domain (Postfix). Sufficient to receive confirmation mails and notifications.
Outgoing mail: no good/reliable solution yet. I have to send personal e-mail very very rarely.
Calendar: Tasks.org app, used offline (not synced).
Drive: 1TB external HDDs. GPG encrypted backups of important stuff are uploaded regularly to one of the VPSes I have.
VPN: Tor
Password manager: KeepassXC (with backups at 3 places).
Documents: Stored on computer, important ones are backed up. Confidential ones are stored on an encrypted LUKS volume which I only mount when I need something.
In general things I need on the go (e.g Calendar) is on my phone, the rest is at home at my computer. If I need to move data between devices I simply use USB drives. I don't need no cloud sync of anything.
view more: next ›