My holy trinity of trust : memes

[-] dingus@lemmy.ml 81 points 2 years ago* (last edited 2 years ago)

The thing is, ownership of any of these can change at any time. Bitwarden, Mullvad, and Tutanota could be sold to very different owners.

That is up to and including something like uBlock Origin, which only has one developer, and would suddenly be very different if that developer died and the project had to be forked.

You can never trust that the person who takes on the reigns has the same ideals as the people running them now.

Hell, Mullvad was abused to the point they removed access to Port Forwarding on their VPN service, which has led to many people needing to switch to crummier, shadier VPNs that still offer port forwarding access. That's not Mullvad's fault, but it is an example of them having to change their philosophy and what they offer because of abuse.

Trust should only go so far, and loss of trust should be very easy. There's not a good reason to keep "trusting" something when it has fundamentally changed from its initial ideals.

[-] r00ty@kbin.life 20 points 2 years ago

Hell, Mullvad was abused to the point they removed access to Port Forwarding on their VPN service, which has led to many people needing to switch to crummier, shadier VPNs that still offer port forwarding access. That’s not Mullvad’s fault, but it is an example of them having to change their philosophy and what they offer because of abuse.

It's a real shame too. It was a nice feature.

[-] Rayspekt@kbin.social 10 points 2 years ago

Hell, Mullvad was abused to the point they removed access to Port Forwarding on their VPN service, which has led to many people needing to switch to crummier, shadier VPNs that still offer port forwarding access.

Could you explain what happened?

[-] dingus@lemmy.ml 24 points 2 years ago

As clear as I can make it out, it seems like it was related to a search warrant that was executed on Mullvad.

https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subject-to-a-search-warrant-customer-data-not-compromised/

Because just a little over a month after the news of the failed raid, there was news of them removing port forwarding.

https://mullvad.net/en/blog/2023/5/29/removing-the-support-for-forwarded-ports/

Emphasis mine.

Unfortunately port forwarding also allows avenues for abuse, which in some cases can result in a far worse experience for the majority of our users. Regrettably individuals have frequently used this feature to host undesirable content and malicious services from ports that are forwarded from our VPN servers. This has led to law enforcement contacting us, our IPs getting blacklisted, and hosting providers cancelling us.

The result is that it affects the majority of our users negatively, because they cannot use our service without having services being blocked.

The abuse vector of port forwarding has caught up with us, and today we announce the discontinuation of support for port forwarding. This means that if you are a user of forwarded ports, you will not be able to add or modify the ports you have in use.

[-] apt_install_coffee@lemmy.ml 5 points 2 years ago

They made a smart call that has probably increased the long term privacy of their users.

People were using port forwarding to host illegal shit, and governments were getting pissed off about it. Mullvad has been able to prove in court that they don't keep logs, but that's not a perfect deterrent; a properly motivated government, perhaps if somebody is using Mullvad to host CSAM, might attempt to legally force Mullvad to put logging in and add anti-canary clauses.

Preventing port forwarding keeps customers as consumers rather than hosters, and avoids this issue.

[-] Galli@hexbear.net 8 points 2 years ago

This is true and people should always be mindful of this. Additionally you should consider not just the ownership of the companies but also the infrastructure they rely on such as their rented servers, payment processors, on-site staff etc. However commercial VPNs remain a convenient compromise for many use cases. These services are probably fine for your shitposing needs but should not be relied upon for activism for instance.

[-] SIGSEGV@waveform.social 8 points 2 years ago

Same thing just happened with IVPN :⁠-⁠\

[-] machiabelly@hexbear.net 6 points 2 years ago

I used to use proton until I saw them give info for a warrant. After that I gave up on the VPN thing. If I lived in a country with limited streaming options I might use them but shrug-outta-hecks

[-] Qkall@lemmy.ml 42 points 2 years ago

bruh, i can't be the only one confused why state farm's drive safe app was being touted...

[-] revlayle@lemm.ee 31 points 2 years ago

I love Mole, Shield and Road

[-] RootBeerGuy@discuss.tchncs.de 18 points 2 years ago

Ah, the new pokemon game that just came out.

load more comments (1 replies)

[-] darcy@sh.itjust.works 23 points 2 years ago

keepass > bitwarden

vpn providers should be reviewed regularly

email is inherintly insecure/non-private, self hosted is best

[-] ArcticLynx@feddit.de 9 points 2 years ago

why do you prefer keepass to bitwarden? has it better privacy or is it just a personal preference because you like the UI more for example?

[-] darcy@sh.itjust.works 20 points 2 years ago* (last edited 2 years ago)

keepass is a different paradigm. it uses a locally encrypted file. many frontends for it (use keepassxc and keepassdx). dont have to rely on some 3rd party, even if they say they have e2ee. theres no better privacy (and security) for an app than not using it with the internet. im not too concerned about ui for pw manager personally, the less time i spend w it unlocked the better. only (slight) problem for me: multi device usage (i just copy the file onto my phone occasionally). general rule of thumb: if it can be selfhosted, it is best to.

i think bitwarden is the best one of its type, it comes down to your needs and threat model

[-] Jonsk@lemmy.ml 29 points 2 years ago

Idk if anyone else mentioned this but bitwarden can be selfhosted.

[-] darcy@sh.itjust.works 5 points 2 years ago

good point!

[-] king_link1@feddit.dk 8 points 2 years ago

I use syncthing to sync my KeePass file, and I highly recommend it. Very easy to set up

[-] ArcticLynx@feddit.de 5 points 2 years ago* (last edited 2 years ago)

I really like the cross device sync, even tho it's a security risk of course. also, I don't know anything about self hosting (might get into it when I got the time), so bitwarden might be the best pw manager for my requirements rn.

[-] radioactiveradio@lemm.ee 5 points 2 years ago

It's possible to sync keepass using syncthing, i use it that way.

load more comments (2 replies)

load more comments (1 replies)

load more comments (5 replies)

[+] WtfEvenIsExistence@reddthat.com 21 points 2 years ago* (last edited 1 year ago)

[deleted]

[-] SmoothSurfer@lemm.ee 16 points 2 years ago

https://www.engadget.com/protonmail-climate-activist-ip-swiss-french-authorities-233004304.html

Europol requested it. Even though you think your service is not under 14 eyes there still is gonna be many other problems.

You can always find problems with the service itself.

[-] reddithalation@sopuli.xyz 5 points 2 years ago

Protonmail then went to court, and got the law changed so it doesn't happen again https://www.reuters.com/technology/proton-wins-swiss-court-appeal-over-surveillance-rules-2021-10-22/

load more comments (1 replies)

[-] palebluedot@discuss.tchncs.de 9 points 2 years ago

Five and eleven eyes doesn't matter if the service is encrypted and open sourced. Also, did you know that Switzerland has no superior privacy laws comparing to Germany? It's all marketing bluff.

load more comments (6 replies)

[-] Fazoo@lemmy.ml 17 points 2 years ago

Why do you trust a Germany based secure email over something like Proton? At least Mullvad is Sweden based.

[-] tja@sh.itjust.works 6 points 2 years ago

Because in Germany we value privacy and the protection of personal data

[-] Fazoo@lemmy.ml 11 points 2 years ago

Not more than the Swiss. Germany is part of the spy dragnet. It does not offer the same level of privacy protection.

[-] palebluedot@discuss.tchncs.de 13 points 2 years ago

Five and eleven eyes doesn't matter if the service is encrypted and open sourced. Also, did you know that Switzerland has no superior privacy laws comparing to Germany? It's all marketing bluff.

[-] TimeSquirrel@kbin.social 4 points 2 years ago

So why are my German relatives super-scared of pirating because of the government finding out, and get me to torrent all their shit for them and mail it to them on cheap hardrives?

[-] Hubi@feddit.de 13 points 2 years ago

Correction: It's not the government, it's private law firms doing this. Your IP is public when you torrent, they just have bots monitoring the most active trackers and try to extort money from the people they catch.

[-] ErwinLottemann@feddit.de 8 points 2 years ago

Piracy is not privacy

load more comments (1 replies)

[-] DarkwinDuck@feddit.de 13 points 2 years ago

I have bitwarden and mullvad, but what's the other one?

[-] marcus@lemmy.world 9 points 2 years ago

It’s Tutanota, an email service

[-] whileloop@lemmy.world 12 points 2 years ago

KeePass is also a good password manager, it's open source and you get to store the password database anywhere you like.

[-] sabreW4K3@lemmy.tf 9 points 2 years ago

tutanota is terrible though

[-] twei@feddit.de 6 points 2 years ago

Tutanota is one of the few good E-Mail services that i can think of, what's so terrible about tutanota?

load more comments (1 replies)

[+] FunzioneSperimentale@feddit.it 9 points 2 years ago* (last edited 1 year ago)

[deleted]

[-] Almace@kbin.social 12 points 2 years ago

You do also kind of put all your eggs in one basket so to speak though. I don't have anything against Proton and the pricing makes sense if you value all their services and pay for Ultimate (though by my estimate, less sense if you are only looking for a smaller handful of services). However, if you go fully into Proton for everything, you're placing your trust into an entire stack of services and it can end up a single point of failure.

load more comments (1 replies)

[-] Mr_1077@monero.town 7 points 2 years ago

For anyone still using Mullvad and wants port-forwarding, I recommend AzireVPN.

Good list! I use all of them too.

load more comments (3 replies)

[-] rambos@lemm.ee 6 points 2 years ago

I trust bitwarden, but android app doesnt trust me!

load more comments (1 replies)

[-] gvasco@discuss.tchncs.de 6 points 2 years ago

I might swap bitwarden by passbolt as it uses a more recent programming stack, although vaultwarden looks to be a good alternative too.

load more comments (3 replies)

[-] dzervas@lemmy.world 5 points 2 years ago

just a side note for everyone out there that uses bitwarden: you can reset your password with just your email. that means the admin can see your passwords. The only 3 upstream password managers that don't have that "feature" are 1Password, lastpass and keypass (not counting gpg-based script in bash n friends). Lastpass is obviously a mediocre solution (too many breaches), keypass isn't for everyone (UX). 1Password is a very solid solution and it has public security audits

I've got nothing with agilebits/1Password - i just use it after spending days researching (also I'm a former IT security engineer)

[-] Waryle@jlai.lu 14 points 2 years ago* (last edited 2 years ago)

It's so out of context it's almost untrue.

Bitwarden can't find or change your password, and their admins absolutely can't see them either.

You're talking about the "admin password reset" feature offered to organizations (and which doesn't concern lambdas users at all), which must be explicitly activated and which allows admins not to see our password, but to trigger a password reset with notification to the user.

Once the password has been reset, all you have to do is change it, and nobody else has access to it.

https://bitwarden.com/help/forgot-master-password/

https://bitwarden.com/help/account-recovery/

load more comments (3 replies)

[-] cirkuitbreaker@sh.itjust.works 5 points 2 years ago

One of these is Bitwarden. What are the other two?

[-] cefditoren@lemmy.world 4 points 2 years ago

Mullvad, Tut(o/a)nata

[-] Samsy@lemmy.ml 4 points 2 years ago

That mole is sus to me, I am more like into Snakedragons.

load more comments (1 replies)

Memes

Rules: