I’ve cancelled my subscription yesterday, conveniently it was about to renew at the end of the week, so I have a few days to migrate from Proton, here’s what I’m thinking of, but I’d love to hear what other people are switching to
Obsidian is proprietary. It can go fuck itself.
I switch from obsidian to Joplin because it has e2ee while obsidian does not but they’re kinda cut from the same cloth
i was already using ente auth, i went straight back to bitwarden, and i was on the free tier the whole time on proton anyway
Bitwarden is pivoting towards the same enshittification path as everything else, so that’s not gonna be a good long term for a password manager. They hired a new ceo whose only noteworthy experience is prepping companies for mergers and acquisitions, and briefly removed messaging on their website about always having a free tier which they reinstated after backlash. All signs point to a sinking ship, imo.
I don’t have the answer for what to use instead since I’m still a paid subscriber with them, but I’m looking around. Probably keepassxc but I don’t know enough to host and sync my own.
I’m tired
yeah…
I’ve been using mailbox.org for a few years now and I love it.
the web client is good, and it was easy to set up on my phone alongside my other accounts.
it costs money (something like €3/year), but it’s worth it.
plus, it’s still relatively new, so if you suffer from Generic White Guy Name™ like I do, you can finally have a username/email address that’s not full of numbers.
I switched to mailbox from proton and put addy.io in front of it for custom domains and aliasing
You’re better off adding a custom domain anyway, that way you’re not vendor locked and you can move the emails with ease. It’s included in all the subs I think.
can i ask for more details about the email address and generic names thing? I’m not sure i understand whar you mean sorry
Basically there’s no way you could get an email address of just: [first][last]@gmail.com on Gmail, because there are so many users of Gmail. That’s not the case for newer services with less users.
ohhh right that makes sense thanks
Pretty funny to suggest anti-open-source Obsidian in a privacy subreddit
subreddit
A what?
Oops
Pretty funny to reference anti-open-source reddit in a privacy community
If you’re not paying for sync services and cautious about which community plugins you choose, what is the risk factor? Genuinely asking, not being a contrarian on purpose.
I’ve stuck with Obsidian for the simple reason that the file format is a folder of plain text files. So data extraction if I decide to leave to another app is easy. Joplin changes the text file names and adds metadata to each file which is no good in my use case. So I’ve skipped it.
What are some good alternatives? Preferably with a web-client. I am pretty limited in installing software at work.
I’ve been using Logseq for a couple years now and it’s great
Obsidi
Joplin would be the typical example, but silverbullet is neat.
Notesnook is an option that has a web-client as well as apps for pretty much any OS. They do have a free tier, but several features are hidden behind a paywall, so be aware of that.
I’m currently using zennotes. It has a self hosted option which is a web version.
I can’t seem to find any information on where the company is from. I’ll try to stick with European software, not necessarily because it’s better or more secure, but out of principle. My experience is that if they don’t mention where it’s from it’s most likely not US :)
The Contact section on their Cloud privacy policy has a lumarylabs.com email address, and sure enough that site says Lumary Labs is based in the US.
I’ve been using KeePassXC with Syncthing for years and it’s been great as a password manager for myself. But I don’t need to share those credentials with anyone.
Same, plus a yubikey for 2FA
Aegis is my chosen 2FA. never have been convinced on hardware keys personally.
Fair enough. I like the ease of simply touching it. It’s less of a frustration for when my wife wants to access my password manager
I’m strongly considering getting a hardware key. Is Yubikey the best choice or are the other options also worth considering?
Solokey and Nitrokey are strong alternatives, and the two I’ve been recommended by people who would know.
Solokey is good if Fido is the only thing needed.
Nitrokey has Fido and more. I keep meaning to try the other features, but haven’t gotten around to it.
I bought my yubikey at least 7-8 years ago and then stopped keeping up on comparisons. I honestly have no idea which is the best, because there are varying use cases and standards available. Yubikey works for my use case and threat model, but I have no idea what would be best for yours. I wish I could be more specific for you but also don’t want to give you misleading info.
But I don’t need to share those credentials with anyone.
Yeah, I like BitWarden because it makes sharing passwords very easy. My wife and I have a few shared accounts, and have a family vault set up. So anything we want to share just gets transferred into the family vault, and we can both easily access it. And since it even supports TOTP, we can have those directly on the shared accounts without needing to bug each other with the “hey I’m trying to log into {x}, send me your Google Authenticator code” song and dance.
Does keepass have a reputable browser extension or is the application itself all that’s used? I think that’s what moved me off Keepass initially after using it for like six years and then moving to BitWarden a few years ago
I’m not sure what you mean by reputable, but I’ve been using the official KeePassXC extension.
I assume the point of the extension is to have support for autofill, if that is the case, you should be aware that it is generally a bad idea to give your browser access to that info directly since they are the definition of internet connected apps. What I do instead of autofill with keepassxc is open the vault and press the copy to clipboard buttons which works essentially the same way as autofill just with a couple more clicks.
When you use an extension for that task it also validades the URL, which helps to not type by accident your credentials in a fake website.
This actually saved me once when a Google result was literally a phishing version of GitHub.
I’ve tried that exact setup but Syncthing kept not detecting changes or creating conflicts… So I’m still stuck with Proton Pass :/ (it’s a good password manager, but Andy Yen is being too much of a loser)
VPN is easy, just setup a Wireguard instance on either a Hetzner shared vCPU Linux VPS for €6.49 a month for or IONOS XS Linux VPS for about £2.40 a month. Wireguard takes like at most 10 commands to get running.
And then to make sure your data is anonymised give your family and trusted friends (apart from the hacky or sketchy type) a Wireguard VPN profile to connect. The more people the harder it is to pinpoint who is using it. I route my and my family’s traffic through Falkenstein, DE with @[email protected]
For password I use KeePassXC and KeePassDX, and for 2fa I use YubiKey, it can store 2FA secrets and also do hardware 2FA, very useful.
I wouldn’t trust Bitwarden anymore. I don’t believe they’ve done anything bad just yet, but they recently sold out to a private equity firm and quite literally removed “transparency” from their company values. KeePassXC is your friend.
Ahh too bad then I’ll switch to Keepass yeah
I’m not sure if you are aware, but there is a reason why it is explicitly xc instead of just keepass. Xc is the Foss one & keepass is a corporate hell hole
Oh thats good to know thanks, yeah I meant XC but was too lazy haha
But they replaced transparency with “trust” so surely we can trust them right? /s
I don’t trust bitwarden. This was very annoying: https://community.bitwarden.com/t/copying-values-brings-up-remote-desktop-window/100351/20
They claimed copying on Linux was only possible via screensharing despite literally every other app being able to copy text without that. The thread ends with “it’s linux’s fault bro” and yet the issue seems to have been fixed since then.
There’s also ChiPass if you want no vibe code: https://codeberg.org/ChiPass/ChiPass
quite literally removed “transparency” from their company values
No they didnt. Why do people keep making up this bullshit?
"Bitwarden company values spell the word “GRIT,” and stand for:
- Gratitude
- Responsibility
- Innovation
- Trust"
It used to say Inclusion and Transparency, before they sold out.
I’m tired of keeping a book of grudges everytime a CEO says something. I’ll be waiting for now.
Bitwarden’s gone private equity. I’d hold off on switching to them; maybe try to live with KeePass if you’re not on a family plan.
I switched over to vaultwarden. I am stuck on an iPhone for the time being and I don’t care for all the Keepass ios apps.
Completely valid. I myself am still on Bitwarden, waiting for the other shoe to drop, but my family is already entrenched in it.
I think if I have to move them again, I might seriously consider forking keepass, adding the features I use in bitwarden.
I do not look forward to dealing with IOS tho.
Vaultwarden is completely Bitwarden-compatible. You can export all data from Bitwarden server/service, import it into Vaultwarden server, and your family will not notice the change at all, except you’ll ask them to change address in their already installed Bitwarden app.
They don’t need to change anything else. To them, it will still be the same Bitwarden.
and your family will not notice the change at all
Here lie dragons: for as long as the private equity firm that owns Bitwarden chooses to let us use their clients.
There are non-Bitwarden Android clients around, but they lack Chrome extensions and IOS.
True, this is a possibility. But, in years of Vaultwarden’s existence, this never happened.
100% but for years of Vaultwarden’s existence, they haven’t been owned by private equity.
Just keep your eyes open and know that it could come for us. I’ve stopped counting on how many services went private->enshitify bad enough for me to bail.
Fair enough. In case we do need to move, here’s a quick tip: KeepassXC and many other password managers are able to read Bitwarden export files, so you can seamlessly move credentials there, should the need arise.
Also, Vaultwarden has a web interface, which can do as a temporary or full substitute. I used it for a while, it’s totally doable.
there’s still vaultwarden. i just self-host that and use the official bitwarden clients (android app + firefox extension). even if bitwarden itself shits the bed and takes their clients down with it, i don’t doubt there will be alternatives up and running relatively quick.
I would switch to KeePass if its sync method was more sane than “big binary file + Syncthing”, it seems like all the password manager options kindof suck in some way
aughhh dealing with syncthing and keepass was a painnnnnn. it was way too easy for things to desync. i just switched to my own vaultwarden instance and called it a day.
Yeah, there are a bunch of ways to tackle that. Chunk-Based Content-Addressable Block Storage (that weird thing where they put a folder of 0-A the folders under that with hex-based naming and small chunks of data wouldn’t be horrible keeping update sizes managable. The real problem there is dealing with Syncthing conflict files. The monobinary is either new or old. Maybe a local-only CBC with deltas delivered by syncthing so they can overwrite each other and a rollback/history option.
P2P anything is complicated. Something as damning and imporant as password management makes it so much worse.
this is exhausting
You could check posteo.de for email services, I didn’t have any issues with them since I opened the account about a year ago.
Edit: addition
I’d choose KeepasXC over Bitwarden since it has a built in 2fa which is convenient to.use and made me have much more 2fa configured over less critical services. Most critical services I have 2fa for are separated in a different 2fa method Aegis. Yubikeys and such are top level of course but they require a bit more responsibility in usage.
I thought the general consensus was to not bundle your 2fa and pwd manager. If your master password is compromised then they have both authentication methods.
FWIW, I’ve been really happy with Aegis for my 2fa needs. Still using Bitwarden but they seem to be ripe for some enshittification in the near future so I’m cautiously looking into Vaultwarden, then Keepass.
I’m too nervous to have Bitwarden be both my password manager and 2FA service
I have the same concerns. I use 2fa in the password manager only for non essential services. All essential services are on a different 2fa system, so its easy to use 2fa on most services (more protection overall) but the critical stuff would still be protected if the vault gets leaked somehow.
Posteo would have been my first choice actually but unfortunately they do not seem to support custom domains, otherwise I would switch to them instead of mailbox, on paper it sounds like they have more features for cheaper
Bitwarden is getting worse btw unless you’re running it yourself
Never understood the appeal, I’ve had my passwords in a keepass file on a Nextcloud server for years. If I’m gonna involve a third party, I night as well just use Firefox Sync (which I do for less important stuff)
I have all my passwords written down in a journal not in a computer
Yea… God I hate the world… I started using Bitwarden like… A few months ago, and they’re already going in the shitter…
It seems it hasn’t happened yet. They are still open source for now. I am still using my Vaultwarden with Bitwarden.
It seems it might be going that way though.
If it goes fully closed source then I imagine the fix will be Vaultwarden devs coding some replacement apps.
Yea they haven’t done anything yet but afaik they changed their licenses to prepare to do it… So it’s only a matter of time
they do at least make it very easy to migrate away
What did I miss?
Moving towards closed source: https://www.phoronix.com/news/Bitwarden-Open-Source-Concerns
Which takes away the only good thing about them
Wasn’t this reversed tho?
closed source security products are a contradiction in terms
I’ve switched email providers a few times, but I bought a custom domain and use that as my email address. Which makes switching providers easy. I’m sure I don’t need to mention that in a Privacy community, but figured I would anyway.
I went from an @gmail, to @proton (then bought the domain), then switched to Fastmail with same domain.
FYI: Fastmail company is on a X eyes country with server operating on the US as well. That being said, probably the least bad option now.
