The inner circle so to speak

  • Hot Saucerman@lemmy.ml
    link
    fedilink
    English
    arrow-up
    102
    arrow-down
    1
    ·
    edit-2
    1 year ago

    The thing is, ownership of any of these can change at any time. Bitwarden, Mullvad, and Tutanota could be sold to very different owners.

    That is up to and including something like uBlock Origin, which only has one developer, and would suddenly be very different if that developer died and the project had to be forked.

    You can never trust that the person who takes on the reigns has the same ideals as the people running them now.

    Hell, Mullvad was abused to the point they removed access to Port Forwarding on their VPN service, which has led to many people needing to switch to crummier, shadier VPNs that still offer port forwarding access. That’s not Mullvad’s fault, but it is an example of them having to change their philosophy and what they offer because of abuse.

    Trust should only go so far, and loss of trust should be very easy. There’s not a good reason to keep “trusting” something when it has fundamentally changed from its initial ideals.

    • r00ty@kbin.life
      link
      fedilink
      arrow-up
      23
      ·
      1 year ago

      Hell, Mullvad was abused to the point they removed access to Port Forwarding on their VPN service, which has led to many people needing to switch to crummier, shadier VPNs that still offer port forwarding access. That’s not Mullvad’s fault, but it is an example of them having to change their philosophy and what they offer because of abuse.

      It’s a real shame too. It was a nice feature.

    • Rayspekt@kbin.social
      link
      fedilink
      arrow-up
      11
      arrow-down
      1
      ·
      1 year ago

      Hell, Mullvad was abused to the point they removed access to Port Forwarding on their VPN service, which has led to many people needing to switch to crummier, shadier VPNs that still offer port forwarding access.

      Could you explain what happened?

      • Hot Saucerman@lemmy.ml
        link
        fedilink
        English
        arrow-up
        29
        arrow-down
        2
        ·
        1 year ago

        As clear as I can make it out, it seems like it was related to a search warrant that was executed on Mullvad.

        https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subject-to-a-search-warrant-customer-data-not-compromised/

        Because just a little over a month after the news of the failed raid, there was news of them removing port forwarding.

        https://mullvad.net/en/blog/2023/5/29/removing-the-support-for-forwarded-ports/

        Emphasis mine.

        Unfortunately port forwarding also allows avenues for abuse, which in some cases can result in a far worse experience for the majority of our users. Regrettably individuals have frequently used this feature to host undesirable content and malicious services from ports that are forwarded from our VPN servers. This has led to law enforcement contacting us, our IPs getting blacklisted, and hosting providers cancelling us.

        The result is that it affects the majority of our users negatively, because they cannot use our service without having services being blocked.

        The abuse vector of port forwarding has caught up with us, and today we announce the discontinuation of support for port forwarding. This means that if you are a user of forwarded ports, you will not be able to add or modify the ports you have in use.

      • apt_install_coffee@lemmy.ml
        link
        fedilink
        arrow-up
        5
        ·
        1 year ago

        They made a smart call that has probably increased the long term privacy of their users.

        People were using port forwarding to host illegal shit, and governments were getting pissed off about it. Mullvad has been able to prove in court that they don’t keep logs, but that’s not a perfect deterrent; a properly motivated government, perhaps if somebody is using Mullvad to host CSAM, might attempt to legally force Mullvad to put logging in and add anti-canary clauses.

        Preventing port forwarding keeps customers as consumers rather than hosters, and avoids this issue.

  • Qkall@lemmy.ml
    link
    fedilink
    arrow-up
    50
    arrow-down
    1
    ·
    1 year ago

    bruh, i can’t be the only one confused why state farm’s drive safe app was being touted…

    • Udonezo@lemmy.world
      link
      fedilink
      arrow-up
      7
      ·
      edit-2
      1 year ago

      allows their car insurance to spy on their location data and driving habits Is curious about privacy

      Okay buddy

  • Fazoo@lemmy.ml
    link
    fedilink
    arrow-up
    34
    arrow-down
    6
    ·
    1 year ago

    Why do you trust a Germany based secure email over something like Proton? At least Mullvad is Sweden based.

  • whileloop@lemmy.world
    link
    fedilink
    arrow-up
    17
    ·
    1 year ago

    KeePass is also a good password manager, it’s open source and you get to store the password database anywhere you like.

  • darcy@sh.itjust.works
    link
    fedilink
    arrow-up
    22
    arrow-down
    9
    ·
    1 year ago

    keepass > bitwarden

    vpn providers should be reviewed regularly

    email is inherintly insecure/non-private, self hosted is best

    • ArcticLynx@feddit.de
      link
      fedilink
      English
      arrow-up
      9
      ·
      1 year ago

      why do you prefer keepass to bitwarden? has it better privacy or is it just a personal preference because you like the UI more for example?

      • darcy@sh.itjust.works
        link
        fedilink
        arrow-up
        20
        ·
        edit-2
        1 year ago

        keepass is a different paradigm. it uses a locally encrypted file. many frontends for it (use keepassxc and keepassdx). dont have to rely on some 3rd party, even if they say they have e2ee. theres no better privacy (and security) for an app than not using it with the internet. im not too concerned about ui for pw manager personally, the less time i spend w it unlocked the better. only (slight) problem for me: multi device usage (i just copy the file onto my phone occasionally). general rule of thumb: if it can be selfhosted, it is best to.

        i think bitwarden is the best one of its type, it comes down to your needs and threat model

        • ErwinLottemann@feddit.de
          link
          fedilink
          arrow-up
          6
          ·
          1 year ago

          You can selfhost bitwarden, there’s also vaultwarden, an open bitearden api implementation. You could host this on an internal-only server. But you also can sync your single password file with a lot devices and use keepass, I just find that a bit annoying. You also cannot share some passwords with your relatives easily that way.

          • Radioactive Radio@lemm.ee
            link
            fedilink
            arrow-up
            2
            ·
            1 year ago

            Hey it’s fine if you trust them, it’s a very convenient service and from what I found it’s pretty secure, since there’s no way to recover logins if you forget your master pass. But i personally don’t like the idea of having passwords on someone else’s server and I’m too stoopid to set-up my own instance on a docker container server thingy. Syncthing just works for me, got GUI and everything.

      • Rooki@lemmy.world
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        its more user friendly. Just a file you have to have. You can encrypt that double and tripple on bitwarden nope.

    • Almace@kbin.social
      link
      fedilink
      arrow-up
      21
      ·
      1 year ago

      You do also kind of put all your eggs in one basket so to speak though. I don’t have anything against Proton and the pricing makes sense if you value all their services and pay for Ultimate (though by my estimate, less sense if you are only looking for a smaller handful of services). However, if you go fully into Proton for everything, you’re placing your trust into an entire stack of services and it can end up a single point of failure.

      • retro@infosec.pub
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        I trust their privacy claims but if you backup your email and calendar you can just as easily move elsewhere if Proton does go down. Having only one provider can make things a lot easier to manage.

    • Cliffjumper@lemmy.world
      link
      fedilink
      arrow-up
      1
      ·
      1 year ago

      Still can’t bring myself to use proton pass. I’ll be much happier when proton drive better integrates with desktop machines as well but calendar, VPN, email and the bonus simplelogin premium are way too useful.

  • Mr_1077@monero.town
    link
    fedilink
    English
    arrow-up
    7
    ·
    1 year ago

    For anyone still using Mullvad and wants port-forwarding, I recommend AzireVPN.

    Good list! I use all of them too.

  • GVasco@discuss.tchncs.de
    link
    fedilink
    arrow-up
    5
    ·
    1 year ago

    I might swap bitwarden by passbolt as it uses a more recent programming stack, although vaultwarden looks to be a good alternative too.

  • Gnubyte@lemdit.com
    link
    fedilink
    English
    arrow-up
    3
    arrow-down
    1
    ·
    1 year ago

    As a US consumer, I can’t use a lot of these VPNs. When you dig into how local governments are trying to break encryption in many countries overseas it makes you slow to sign up for services. The worst case would be you use a service, get invested and a few weeks later new legislation you’re not following/in the know about gets passed and some of your data is now in some foreign governments jurisdiction more so than it was before.

    It’s not that Germany or Sweden in particular do that today but I also haven’t quite looked into its bounds, if five-eyes alliance reaches them, etc. There is a lot you have to be cognizant of.

    Also I like Bitwarden but Vaultwarden is the way to go; just make sure to donate/pay somehow for bitwarden if you use its clients.