I see a lot of comparisons and stances that cause issues. I am tangentially related to the space and am interested in what could be done. I don’t know anyone who works for these companies and do not myself. Nor do I have any financial stake.
Vpn: Mullvad but Port Forwarding is back.
No.
Different services offer different things for different customers.
Proton offers everything under one banner, a turnkey replacement for google. Seems great until you consider the person who doesn’t want kyc pii for all that stuff under one roof.
Mullvad has no password and keeps as little information about the user as possible. Seems great till you consider the user who wants to gate access by accounts with passwords.
People want different things out of the services they use.
For mail, a few things I’d look for:
-
Standard protocol compatibility (POP/IMAP/JMAP/SMTP) so you can use a client that’s not controlled by the service provider.
-
Easy E2EE setup with PGP/GPG.
-
Custom domain support.
-
Email alias support (though this can be done with a third-party service, potentially).
-
Server-side filter rules for incoming mail.
Proton and Tuta, for example, fail on point #1. The E2EE promise really doesn’t mean a lot when the service provider ultimately controls the client. If they control the client, they could very easily exfiltrate your keys via a backdoor. This can be mitigated with open-source clients and reproducible builds, but if you’re using a web client or apps from Google/Apple stores, that’s never going to be verifiable.
For VPN:
-
No-logs policy.
-
Independent audits.
-
Port forwarding support.
-
Anonymous payment options.
These are not exhaustive lists, just off the top of my head.
vpn
- preferably also outside of 5, 9, 14 eyes
- not owned by kape
- not owned, or run by a right wing, or pro ai ahole.
Ownership is a big problem with VPNs. A bunch of them are owned by the same two or three companies, and those companies are not good.
I really have no idea what to trust nowadays. A few years ago, Mullvad and Proton were the industry darlings, but they BOTH have far-right ties. Mullvad’s founder donates to far-right organizations, and Proton’s CEO has AI psychosis and doubled down on some ridiculous comments praising Trump.
It really boggles the mind how anyone can purportedly value privacy and also support any far-right politics. Makes me think they’re all honeypots.
*1 of mullvads co-founders has far right ties, that is significantly different to “the founder”; but his actions have tarnished mullvad significantly, and I am not aware of the company doing anything about it, they do not appear to have handled it well at all, even though the other co-founder stated he does not agree with the far right sponsorship.
proton were always dodgy.
A handy, if slightly unusual link re: vpn ownership
https://embed.kumu.io/9ced55e897e74fd807be51990b26b415#vpn-company-relationships
Also VPN:
Not running all their servers on the infrastructure provided by a single provider.
I find it very concerning that almost all VPNs use mostlyM247 as their server providers.
The #1 is true - but I don’t really mind. SMTP is tragic at this - even if the egress is perfect and over TLS - Tuta & Proton are getting my mail unencrypted at the ingress and only then encrypt it with my private key for the rest of the journey. Now - I DO believe them they do so perfectly - but do I “really” know 🤔? If it was me - I am giving every phone a public ipv6 address and running mailservers directly on phones but that is everything but an elegant solution🤷.
-
The issue with VPNs is there is no way to verify their claims.
Typically, you want VPNs to promise not to collect data about you, or what sites you visit. They can promise to delete or never store data, but there’s no way to verify they are doing what they say.
Many, many VPNs have claimed they don’t store user data or allow traffic sniffing, only to later have been compromised by a government or other entity to track everything you do and hand it over to a hostile government after a subpoena / information request.
This is a more important issue than any feature or service they may provide.
But there are independent audits aren’t there? Mullvad has passed loads of these.
You want one with a canary on their website
Do the canaries really work though,nothing stopping a state sponsor saying do not remove any terms and conditions or other information that may expose an operation.
No, warrant canaries don’t work.
You gotta look at things that have happened.
I post it all the time but mullvad doesn’t have port forwarding anymore because Interpol got together with all the cdns and blacklisted their servers after the company was unwilling to backdoor their systems to catch csam traders and raids didn’t turn anything up. The police had wanted to surveil the company’s systems so they could identify people using port forwarding to trade files using windows file sharing (bonkers). When that failed they turned to a cdn block of all their server ips so either the company would discontinue port forwarding or dissolve, flushing the csam trading into less private or secure channels.
Mullvad ended up ditching port forwarding rather than work with the police. They took a huge hit for it too, lots of people left for ivpn or air.
What the other person is saying about trust is true. Ultimately you’re trusting the provider of the service. I trust mullvad because they don’t have port forwarding anymore.
It all boils down to trust in the end. Trust they don’t keep records, trust they don’t share your info, trust the canary is real, … There’s always someone else you have to trust.
Quis custodiet ipsos custodes?
Quite frequently, the companies responsible for being watchdogs are in bed or compromised. One example of “trusted” companies caught flat out lying about the very thing they should have been warning everyone about are the Credit Rating Agencies:
https://en.wikipedia.org/wiki/Credit_rating_agencies_and_the_subprime_crisis
