I see a lot of comparisons and stances that cause issues. I am tangentially related to the space and am interested in what could be done. I don’t know anyone who works for these companies and do not myself. Nor do I have any financial stake.
I see a lot of comparisons and stances that cause issues. I am tangentially related to the space and am interested in what could be done. I don’t know anyone who works for these companies and do not myself. Nor do I have any financial stake.
For mail, a few things I’d look for:
Standard protocol compatibility (POP/IMAP/JMAP/SMTP) so you can use a client that’s not controlled by the service provider.
Easy E2EE setup with PGP/GPG.
Custom domain support.
Email alias support (though this can be done with a third-party service, potentially).
Server-side filter rules for incoming mail.
Proton and Tuta, for example, fail on point #1. The E2EE promise really doesn’t mean a lot when the service provider ultimately controls the client. If they control the client, they could very easily exfiltrate your keys via a backdoor. This can be mitigated with open-source clients and reproducible builds, but if you’re using a web client or apps from Google/Apple stores, that’s never going to be verifiable.
For VPN:
No-logs policy.
Independent audits.
Port forwarding support.
Anonymous payment options.
These are not exhaustive lists, just off the top of my head.
vpn
Ownership is a big problem with VPNs. A bunch of them are owned by the same two or three companies, and those companies are not good.
I really have no idea what to trust nowadays. A few years ago, Mullvad and Proton were the industry darlings, but they BOTH have far-right ties. Mullvad’s founder donates to far-right organizations, and Proton’s CEO has AI psychosis and doubled down on some ridiculous comments praising Trump.
It really boggles the mind how anyone can purportedly value privacy and also support any far-right politics. Makes me think they’re all honeypots.
*1 of mullvads co-founders has far right ties, that is significantly different to “the founder”; but his actions have tarnished mullvad significantly, and I am not aware of the company doing anything about it, they do not appear to have handled it well at all, even though the other co-founder stated he does not agree with the far right sponsorship.
proton were always dodgy.
A handy, if slightly unusual link re: vpn ownership
https://embed.kumu.io/9ced55e897e74fd807be51990b26b415#vpn-company-relationships
Also VPN:
Not running all their servers on the infrastructure provided by a single provider.
I find it very concerning that almost all VPNs use mostlyM247 as their server providers.
The #1 is true - but I don’t really mind. SMTP is tragic at this - even if the egress is perfect and over TLS - Tuta & Proton are getting my mail unencrypted at the ingress and only then encrypt it with my private key for the rest of the journey. Now - I DO believe them they do so perfectly - but do I “really” know 🤔? If it was me - I am giving every phone a public ipv6 address and running mailservers directly on phones but that is everything but an elegant solution🤷.