this post was submitted on 10 Apr 2024

66 points (93.4% liked)

Privacy

31431 readers

1228 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

Chat rooms

[Matrix/Element]Dead
Discord

much thanks to @gary_host_laptop for the logo design :)

founded 4 years ago

MODERATORS

[email protected]

Standard notes: what about don’t put all your eggs in one basket rule? (discuss.tchncs.de)

submitted 5 months ago* (last edited 5 months ago) by [email protected] to c/[email protected]

34 comments fedilink hide all child comments

If the owner of the standard notes will now be a proton, doesn't that contradict this principle? I have a proton email account but I don't want it linked to my standard notes account. I don't strongly trust companies that offer packaged services like google or Microsoft. I prefer to have one service from one company. I am afraid that now I will have to change where I save my notes. What do you guys think about this?

top 34 comments

sorted by: hot top controversial new old

[–] [email protected] 20 points 5 months ago (3 children)

Syncthing + your text editor (orgzly revived is great)

[–] [email protected] 4 points 5 months ago (1 children)

I've been using orgzly for years and this is the first I've heard of revived. Looks promising.

[–] [email protected] 3 points 5 months ago

Same! I used orgzly for a good while, might have to get back to it.

[–] [email protected] 1 points 5 months ago (2 children)

And there is orgzly for linux or something?

[–] [email protected] 2 points 5 months ago

You activated my trap card!

It's entierly based on the excellent org-mode for Emacs.

[–] [email protected] 2 points 5 months ago

A simple text editor does the job on PC, I use kate (kde) but perhaps a markdown editor might be better.

[–] [email protected] 1 points 5 months ago

Zim

[–] [email protected] 17 points 5 months ago

Average Joe wants an easy all-in-one solution. That's what Google, Apple and Microsoft offer. An ecosystem. If you want to fight that, you need to be able to offer that. So that's what Proton is doing.

Of course it's better to have it seperated. And the security and privacy nerds will likely keep doing that anyways. But Average Joe doesn't want to take a hassle and rather looses privacy than do that.

Issue is, things are only as secure as the least secure point. Average Joe using Google and Microsoft means your data also goes there when interacting. When Average Joe is swayed by a place that is privacy-friendly ánd convinient, it makes your weakest link also stronger.

Meanwhile, Average Joe is also more save then when he was using Google or Microsoft services. Even when he would be less save than if he had his stuff seperated.

It helps everyone.

With that in mind, I applaud it. But I won't use it. I use Proton for mail, Joplin for notes (encrypting them in Joplin and syncing with NextCloud), and my passwords are also elsewhere than ProtonPass.

[–] [email protected] 12 points 5 months ago* (last edited 5 months ago) (3 children)

I've been self-hosting Standard Notes for a while, and if you think it's something you can pull off, I'd recommend it. Especially if you can get by without folders, (too many) fancy editors, or some of the extra cloud stuff they have been offering.

If you don't feel like self-hosting, there are other options too, like

The non-self-hostable but E2EE-encrypted and open-source Notesnook
The closed source but extensible Obsidian, which doesn't seem very interested in locking you into any tying
The somewhat clunky but powerful and open-source Joplin

[–] [email protected] 5 points 5 months ago

I’ve been self-hosting Standard Notes for a while, and if you think it’s something you can pull off, I’d recommend it.

Too bad it requires 2GB of RAM. Joplin is "perfect" but the UI is ugly.

[–] [email protected] 3 points 5 months ago (1 children)

I know these apps but none of them is as good as standard notes in my opinion. Notesnook seems fine but I don't like fact that it is based in Pakistan. I used Joplin before buying a sub for standard notes so I know it.

Currently I have also subscription on Crypt.ee for photos but there is also a notes app integrated. Maybe I'll start using it. Developer of cryptee was very active on reddit and he seems like a man who values privacy and security.

But I hope that simply proton will not force the migration of standard notes accounts to proton accounts and for old users everything will be as before.

[–] [email protected] 3 points 5 months ago (1 children)

Is there anything won't with the company itself being in Pakistan, if it's explicitly hosting your data in Germany? I'm not aware of any nation-level threat going on over there, and their client is open-source on all platforms, so I don't imagine there's much that would be compromised.

[–] [email protected] 2 points 5 months ago (1 children)

Idk, maybe I'm wrong. Notesnook is recommended by privacyguides at all. All my mistrust comes from the fact that such countries are not famous for respecting human rights. What if the government forces the owners to give up the keys? Maybe it's an unrealistic scenario cause data is encrypted.

[–] [email protected] 2 points 5 months ago (1 children)

You're asking the right questions.

Regarding keys: they never store those. If they did, that would be a problem from the beginning. The whole point of E2EE encryption is that the servers and server owners should never be able to access your data even if you wanted them to.

[–] [email protected] 1 points 5 months ago* (last edited 5 months ago) (2 children)

Yes, you had me cause I write only about keys, but I thought also about backdoors on gov demand.

[–] [email protected] 4 points 5 months ago

If you're worried about backdoors, you can build every client from source and verify the code. IIRC they haven't paid for an audit, but if they failed to protect your passwords/keys that'd be really bad for their reputation. And considering their target demographic, it's pretty important to keep that part of the reputation alive.

[–] [email protected] 2 points 5 months ago

Notesnook is open source and you can check (if you have the knowledge) if there are any issues. They're working on making the server self-hostable (also fully open source) so there's that.

[–] [email protected] 1 points 5 months ago (1 children)

What's the upside over self-hosted (and encrypted) Trilium, which is what I currently use? (I ask this not as a challenge, but out of curiosity.)

[–] [email protected] 2 points 5 months ago (1 children)

From the looks of it, Trillium is halfway between Standard Notes and hosting your own wiki.

If you're happy with Trillium, I'd say stick with it. It looks pretty good, TBH. Standard Notes is self-hostable more as an afterthought, which is to its detriment.

[–] [email protected] 1 points 5 months ago

Thanks, appreciate it!

[–] [email protected] -3 points 5 months ago

Just create another account. What's the problem?

[+] [email protected] -10 points 5 months ago (1 children)

If the owner of the standard notes will now be a proton, doesn’t that contradict this principle?

There's no principle... Standard Notes was never about having an open solution or going against the big co. it was about creating something that could be monetized.

Let’s see what Proton does with this, but I personally believe they’ll just integrate it in Proton and further close things even more. The current subscription-based model, docker container and whatnot might disappear as well. Proton is a greedy company that doesn’t like interoperability and likes to add features designed in a way to keep people locked their Web UI and applications.

Standard Notes for self-hosting was already mostly dead due to the obnoxious subscription price, but it is a well designed App with good cross-platform support and I just wish the Joplin guy would take a clue on how to design UIs from them instead of whatever they’re doing now that is ugly and barely usable.

[–] [email protected] 13 points 5 months ago* (last edited 5 months ago) (2 children)

Proton is a greedy company that doesn’t like interoperability and likes to add features designed in a way to keep people locked their Web UI and applications.

That's nonsense. Proton has built everything around PGP and allows uploading public keys for users not using Proton Mail so that you can messaging them with Proton's PGP system automatically.

https://proton.me/blog/openpgp-crypto-refresh

There's 0 vendor lock in (in the entire Proton ecosystem) and there's tons of open sourced code.

[–] [email protected] -1 points 5 months ago (1 children)

There's 0 vendor lock in (in the entire Proton ecosystem)

What definition are you using for lock-in? Because I'm pretty sure the Proton ecosystem qualifies to some degree.

[–] [email protected] 16 points 5 months ago* (last edited 5 months ago)

Q: Can I get the information I put into Proton back out and move to another service without paying Proton any money or extreme hardship?

A: Yes.

[–] [email protected] -3 points 5 months ago* (last edited 5 months ago) (1 children)

There’s no vendor lock in until you realize your emails are essentially hostage of their apps and a bridge that may be shutdown at any point. If you can’t simply setup a regular email client then there’s vendor lock in, not even Microsoft does that.

[–] [email protected] 10 points 5 months ago (1 children)

By that argument Microsoft could just shut down their IMAP servers tomorrow.

The fact of the matter is, Proton does currently provide tools to get your emails out of their ecosystem, that you can use today. Including a free tool (https://proton.me/support/proton-mail-export-tool) that creates EML files that can be imported elsewhere via Thunderbird.

[+] [email protected] -7 points 5 months ago (1 children)

Yes, but you can reliable use their service with a generic email client, specially on iOS for instance. The bridge doesn’t even provide everything a IMAP server does and there’s isn’t a way to get get calendars and contacts.

That bridge and the fact they don’t use generic IMAP/SMTP/CardDav/CalDav is a form of vendor lock-in. Other providers are also capable of encrypting email with PGP on a open manner and still use those generic protocols.

[–] [email protected] 7 points 5 months ago* (last edited 5 months ago) (1 children)

Other providers will return garbage to your mail client. The mail client itself must have PGP capability (plenty don't).

The bridge doesn’t even provide everything a IMAP server does

I've yet to find any functionality missing from the bridge's IMAP server that's present in any other IMAP server.

and there’s isn’t a way to get get calendars and contacts.

https://proton.me/support/protoncalendar-calendars -- see "Export a calendar" no page anchor for this one
https://proton.me/support/proton-contacts#export-contacts

There's not currently a real time way to get that data, but it's hardly "vendor lockin."

specially on iOS for instance

There's something ironic to me about chewing Proton out for alleged vendor lock in while using iOS / Apple products.

[–] [email protected] 0 points 5 months ago* (last edited 5 months ago) (1 children)

There’s not currently a real time way to get that data, but it’s hardly “vendor lockin.”

You got there yourself, that's one of the problems.

There’s something ironic to me about chewing Proton out for alleged vendor lock in while using iOS / Apple products.

I used iOS as an example, for Android you can get a bridge but that's just going to be one more thing going for your battery.

Now, consider this, there's a TON of situation where having a standard SMTP-capable provider is interesting. Maybe you're running in iOS, maybe you want to have an ESP32 to send a few emails, or some custom software in your computer. All those use cases are impossible or require more coding and more non-standard solutions just because Proton decided to be the first provider ever not to use standard protocols.

What Proton is doing to e-mail is about the same that WhatsApp, Messenger and others did to messaging - instead of just using an open protocol like XMPP they opted for their closed thing in order to lock people into their apps. People in this community seem to be okay with this just because they sell the “privacy” cool-aid.

[–] [email protected] 1 points 5 months ago* (last edited 5 months ago) (1 children)

instead of just using an open protocol like XMPP they opted for their closed thing in order to lock people into their apps

That's just not true, you're severely misinformed on this.

Proton took the established practice of PGP encrypted email and put it in a nice package. That's why you can add public keys and just message somebody that's using Thunderbird.

There is no "open protocol for end to end encrypted email", XMPP is not applicable here. There's no "IMAP for PGP" there's just IMAP, so they made a bridge so you can use IMAP even if your mail client doesn't support PGP.

Could they have made an IMAP server that returns the PGP emails and requires your mail client to handle the decryption? Yes. However, that goes against a major selling point of the product which is that it manages all that encryption for you (like a password manager). Nobody in their right mind would use that.

This isn't some matter of privacy coolaid and fanboyism; they did the open interoperable thing. You can even (as an example use case) if you're a new customer that was doing PGP email on your own, upload your own existing PGP key, and use that with Proton if you don't want to change the PGP public key people use to send you email.

Edit: Perhaps you've been confused by some falsehoods coming from Tutanota or confused the two https://proton.me/blog/proton-vs-tuta-encryption

[–] [email protected] 0 points 5 months ago (1 children)

I wasn't even aware of those alleged falsehoods coming from Tutanota...

IMAP server that returns the PGP emails and requires your mail client to handle the decryption? Yes.

Essentially my point.

. However, that goes against a major selling point of the product which is that it manages all that encryption for you (like a password manager). Nobody in their right mind would use that.

Why not, if they actually do everything with open standards and by the book, why can't they provide IMAP/SMTP access to everyone who wants BUT add the disclaimer that you've to use a PGP compatible e-mail client and configure it to deal with the encryption... but they don't and that is a red flag. Most of their users are tech savvy people wouldn't oppose setting that up.

[–] [email protected] 1 points 5 months ago* (last edited 5 months ago) (1 children)

Because you're paying them so you don't have to do that. Why would you pay them a premium if you're just going to do it yourself anyways?

Also that costs money to develop, maintain, and run. Which takes money/resources away from things most customers care about.

There aren't red flags here, everything is open source, this is all verifiable information. You're just refusing to accept that.

[–] [email protected] 2 points 5 months ago

Why would you pay them a premium if you’re just going to do it yourself anyways?

Because they can provide other assurances with their service even if I've to setup the PGP in my e-mail client. Like knowing the entre thing is actually managed with privacy in mind, like not logging more than they should etc.