Skip Navigation
116 comments

  • I started testing out alternatives immediately after discovering his post. I understand they're saying this was a mistake and was meant to have been posted from his official account and not the company account, but that is still a bit off putting to me. As others have mentioned, this also made me aware of how many eggs I have in this basket, and after trying out alternatives for a few days I made the full switch away from ProtonMail, Calendar and VPN to Tuta + Mullvad.

    Unfortunately, my Unlimited plan renewed in November and customer service has stated they will not refund me for the remaining time, as 30 days has passed. Oh well, I can at least cancel my auto-renewal :)

  • Yes, I canceled my Ultimate account. Andy can believe whatever he wants in private, but publicly stepping outside of non-partisan policy advocacy at this exact moment in time was a red flag, doubly so because he espoused his personal politics through an official business account in his response to the Reddit thread.

    Email/calendar went to Tuta, AirVPN for VPN, BitWarden for passwords. Everything is encouragingly smooth so far.

    Fair warning: Tuta's email import is very new and only available on the more expensive tier at the moment (not sure if that's permanent). I didn't have any problems, but there were some issues a few weeks ago.

    I do think people are over-reacting to Andy's words and assigning him political views he didn't express. He didn't endorse Trump or the Republican party at large, and definitely didn't "go full MAGA" or express Nazi sympathies. His statements about Democrats I partially agree with and partially disagree. His remarks about the priorities and actions of Republicans, though, were pure tailpipe-huffing fantasy. Being able to say these absurd things in public--under an official business account no less--shows poor judgement and implies he might believe other absurd things he isn't willing to say publicly.

    Another factor in my decision: Proton's privacy policy specifies they can modify the policy at any time with no notification to users, and deems continued use of the services as agreement to the updated terms. The updated terms they didn't notify you about.

    That being said, no service provider is perfect. I don't think Proton stores enough data to really be a concern if they turned over everything they have. But this whole thing is based on trust. Even with their clients being open-source software, you're trusting that they always serve the same browser scripts that they published. You trust that the password you provide at key generation or login isn't ever passed back to their servers. You trust that they don't keep unencrypted copies of your emails, files, or VPN activity. You trust that they aren't going to modify their privacy policy and quietly undo protections you thought you had.

    The way Andy responded was enough to question my trust in the company with him at the helm. I didn't leave as a heavy rebuke, just as a "do better". There are plenty of other companies which provide equivalent services. That's the risk companies take when a major part of their market is ideological people: if you chafe their ideology they're more likely to put the effort into leaving.

  • I highly-valued the cohesion and simplicity of having a suite of tools provided by a single vendor and all on a single bill, despite how often this turns into a vendor-lock-in strategy

    Proton was part of my attempt to de-Google, precisely because it offered email (with custom CNAMEs), calendar, and storage, and because they open-sourced their clients and tools

    Despite the UX and feature set being quite bare, I was okay with justifying this with the added privacy (which was a nice-to-have but not a deal-breaker for me)

    It seems like all the alternatives are either less open-source, have even fewer features, are even less cohesive (indeed, I'd have to select entirely separate solutions and give up all integrations) or seem to have even fewer resources for development and project sustainability

  • I still like and trust Proton and won't be switching. They've built up enough good will. Hopefully they don't keep burning through it though. I'm still sour over the lack of feature parity, linux support, reliance on Google for notifications, etc.

  • I've got Keepass for password manager and Mullvad for VPN, and both have worked out really well for me so far. What I haven't been able to find is a good alternative to Proton Drive. For aliases I use Firefox Relay.

    • Tresorit is a bit pricey but very privacy focused and based in Switzerland.

  • You know what would be really great? If Thunderbird actually had its own email service (@thunderbird.net) and not just a client. When they were switching K9 Mail over to Thunderbird mobile, it seemed like there might have been the slightest hint on their blog that they were at least considering it (or maybe I dreamed it). Might be a good source of income for Mozilla too...🤔

  • Personally I switched off of VPN to mullvad at least, and am looking into self hosting bitwarden and using tuta (and now addy.io too thanks to a comment here). Honestly I'd been considering switching for a bit anyway just to be less reliant on a single service for everything, so this kinda validated that since even if this specifically isn't a dealbreaker something else could definitely end up as one. Even if I don't fully move off of proton because moving emails is so annoying, it will still be nice to at least have some other options set up.

  • I know this is lazy of me, but no. I was going to, downloaded tuta and everything, but I just switched this year and finally have it where I want it. I have my stuff forwarded from my old emails, and most of my important stuff has the email. I also failed to vary my programs, so it's also my VPN and password manager. Even just getting starting with the email was giving me a headache.

    And, honestly, the vpn is better than mullvad (to me). When I was attempting to switch, I started with mullvad, but it was so much slower. And I had issues on sites I normally had no issues with. I'll keep the resources and maybe start transferring little by little as time goes on.

  • I'm grandfathered in to the old pricing for Proton Unlimited. I ain't cancelling until they pry the service from my cold, dead hands.

  • Me +wife were seriously considering switching to proton, but we had been "considering" for like half a year. So while the transfer now has been officially put on hold indefinitely, that's in practice no different from how it was before :)

    Have considered tuta but there are several reasons I'm not sold on that service - primarily that they manage to give me (who isn't a techie!) the impression (I might be wrong...) of a walled garden where all the benefits /convenience of the service evaporate (??) as soon as you need to talk to a non-tuta user.(??)

    • From your description it sounds like the feature you might be thinking of as walled-garden-ing is end-to-end encrypted (e2ee) emails, which they call "confidential". The idea is that you can encrypt a message and send it to someone. The message they receive is actually just a link to a publicly-accessible page that Tuta hosts. You give the other person a password that they can enter on that page to read the email you sent and respond to it. If your recipient is also using Tuta, though, when you send an encrypted email it just shows up in their inbox like a regular email.

      This is the standard way to handle secure emails, and it's actually a limitation of the email protocol. The way you would send an encrypted message to someone on another email server is to encrypt the email with your recipient's public key. Then the message goes to their email inbox like a regular email and they can use their private key to decrypt it (which is what Tuta does if you're sending an encrypted email to another Tuta user--they already have the recipient's public key). Email servers don't have a standard way to send each other public keys for accounts, so if you want to encrypt an email you either have to get the recipient's public key yourself and tell your email software to encrypt the message with it, or have your provider send a password protected link.

      I actually just switched to Tuta. You can still get and receive normal unencrypted emails. The encryption is optional and not enabled by default. I don't have strong feelings one way or the other yet on the service as a whole. They just added the ability to import emails exported from another service, which is usually something email providers do pretty early on. Currently it's only available at the $8/month tier, but it's speculated that they'll roll it out to the $3/month tier once it's stable. That'll be a non-starter for a lot of people. The client UI is simple but functional. It was easy to set up my domain so I don't have to go into each account and update my email address. Yeah, no complaints so far, but also nothing that blows me away. There's a free tier if you wanted to just poke around.

      • Of course, bolting security on top of email is going to be a challenge, and require trade-offs between convenience and security.

        It's likely that there are aspects of how Tuta works that I have misunderstood, but based on my understandings, this is my take:

        For my use case, I believe tuta's choice of increased security isn't worth the added inconvenience for the people I'm communicating with who have to access our communications through a separate webpage instead of within their normal email inbox. (Perhaps they can export the emails from that site, but if so, they'd be unencrypted on their machine unless the user took manual steps to reenceypt, no?)

        Secondly, I do not, IRL, know anybody else who uses Tuta, but I know a handful of people who do use PGP (for example through Proton). That would mean that communications with them would need to be unencrypted, or go through Tuta's portal, just as if they were regular gmail users. In contrast, if I were to choose a PGP based encryption, communicating with them - encrypted - would be more convenient. Less secure? Yes, but as I said above, that's a trade-off that I'm willing to make. Not to mention, if I no longer liked the service next year I ought be able to move on without ruining access to old emails, or really, even seeing an interruption in ongoing email conversations. Yes, that does require a custom domain to work in practice - I've set that as a precondition for whatever service I'm going to sign up for.

        Thirdly, I mentioned a walled garden. Assume I were to use Tuta for a couple of years. People I regularly exchange encrypted mail with have gotten frustrated by having to use the portal and signed up for Tuta as well. One day, I decide that I would like to move elsewhere for whatever reason. Now I'm the one who have to use Tuta's portal whenever I want to communicate with my friends, because there's no other service that I can go to, that's compatible with Tuta's encryption. That's why I consider Tuta to be a walled garden.

        I am glad that they finally did add import/export. When I took the service for a spin maybe a year and a half ago, import and export wasn't yet possible and a another reason too why I didn't join them already in mid 2023.

        (BTW, have they fixed the Linux desktop app so that it can be used on a hi-dpi (4k) screen without a magnifying glass? Back then, that app refused to listen to any display scaling commands. I had to reconfigure the display resolution from 4k to 2k to be able to interact with the app.)

  • Just uninstalled the app.

    If I’m honest I did use it much because my friends mostly don’t encrypt emails.

    I did manage to get them all on to Signal, so mostly use that for comms now.

    Still use Gmail for email because I’m a corpo bootlicker like my friends.

116 comments