Yes im aware that my search engine choice is not the best option.
Arent you using too much proton
Ecosystems which are easy to use are great for users and the reason why Google has a monopoly. If proton is a decent privacy centered alternative then more power to them.
Depends on how much privacy you need and how much tinkering to get things to work that you’re willing to put up with.
In general, using a variety of services will be more private than going with a single entity like Proton.
Bitwarden is self-hostable, which makes it potentially more private than Protonpass… assuming you actually set up the self-hosting.
Signal isn’t a good long-term plan, as it’s entirely hosted in the US. I don’t think there are currently any known compromises to the encryption model, but iirc the company can see all your communications metadata (which means the government could potentially as well). I don’t mind it for talking with friends, but I would recommend against it for extreme privacy needs (e.g. the government starts getting overzealous with who it counts as enemies of the state, and you or your friends become targets).
You got great choices, actually. I’d only recommend to be as little dependent on multiple fronts on one company. So I’d change a few of Proton to something else.
Depending on how private communications must be, Threema might be better than Signal.
Network effect is the biggest problem for messaging services, and so I would still push for Signal over the alternatives that are technically better. This guide seems like it is focussed on users who are new to the space
I agree with the Linux recommendation, but I’d offer CachyOS over pure Arch for newcomers. The limine bootloader gives a lot of peace of mind, since you can tell the user “if you get a bad update, reboot and pick an older option on the first screen”.
Arch Linux
You can break anything quite easily on arch if you don’t know what you’re doing, including security.
Lol very true, Ive been using Mint for maybe 7 years now, Ive tried Arch 3 times or more, broke evey single time ive used it. And that’s with me not doing anything out of the ordinary. (No hate to Arch btw, I just can’t figure it out)
Why is Threema better than Signal?
See here - secure messaging apps
another thing is that the Trumpist US regime allegedly got access to Signal through Israeli spyware (Paragon), or is trying to do so. (The Guardian)
The Swiss military also has publicly shifted away from Signal, as they deemed it unsafe for communications.Signal’s still subject to the CLOUD Act, while Threema is not. (Bleeping Computer).
The signal one suggests it’s a phone OS hack that can open apps so could probably do threema too.
The article you shared suggested it’s likely the result of lobbying by the company so they use a company inside the country.
See here why the link you shared isn’t a good source:
https://soatok.blog/2025/07/07/checklists-are-the-thief-of-joy/
And learn more about Threema vs. Signal:
https://soatok.blog/2021/11/05/threema-three-strikes-youre-out/
Adding my personal notes on search engines here for anyone’s interest. I personally use Qwant on Desktop and DuckDuckGo on mobile. I like Qwant because they are at least working on their own index and are EU-based. On the other hand, DuckDuckGo is faster and has a more comprehensive privacy policy. I’m really trying to use Mojeek on mobile but the search results are much worse than DuckDuckGo and Qwant in my repeated experience.
Qwant DuckDuckGo Mojeek xPrivo Kagi IP collection Yes No No No temporary Hosting FRA USA UK EU USA Index ~40% own index + ~60% Bing 100% Bing Own Own Own Direct monthly cost 0 0 0 4-7€ 5€ Passing data to third parties Search data and IP go to Microsoft separately No No No No Quality (subjective) +++ +++ + ++ ? AI summary / chat unclear optional no optional ? Speed + ++ +++ ++ ? Ecosia has a terrible privacy policy, I analysed it in the past. They are likely in violation of the GDPR, I’m currently considering to file a complaint, they’re still a lot better than Google though, but DDG is privacy-wise superior.
There is exactly zero privacy upside to be gained by moving from Mint to Debian, Fedora, OpenSUSE or Arch.
Qubes and Tails may give you an edge, but add quite dramatic convenience costs. Unless you have a very specific threat model, this is overkill.
Last time I tried qwant they don’t serve Taiwan, which is one of the points I VPN to that I cycle
I haven’t tried many other countries.
So just a head’s up to anybody reading.
SecureBlue also looks decent and brings some of the security hardening used in GrapheneOS
Isn’t google auth an OTP service? Proton Pass also supports that btw! Haven’t heard about Ente before and what purpose it replaces a gallery with, but again you can upload and view photos to Proton Drive as well. Although I have not yet tried it myself because I like to keep them local.
Kagi is one of the search engines I actually trust, but it is paid. I can give you trial if you want to try it out. Oh and it being US based might also be drawback.
Pretty solid list I’d say!
Thank you, Auth is on there because I had to import a bunch of accounts at once. I use Ente Photos since it’s a pretty nice UI, I never use their cloud storage though.
As others have said, remove all proton stuff that you can. You are just replacing one centralized service with another. Google started out good too and look where we are now. Never put too many eggs in one basket.
My answer to this is to use a custom domain with an email aliasing service.
I’ve gone through about half of the 400 accounts in my password manager and moved them over. I’ll migrate the rest over the next week or so.
So, I’m switching from Gmail to Proton for now, but if Proton starts to get worse or Tuta catches up on functionality or there’s a better provider that emerges or I decide to try to self-host, it’s one easy change at the alias provider to redirect all of my mail to a new email provider.
You should try migadu. Thats the most no-bs provider with custom Domains I could find
Thanks. Since I’m just starting my privacy journey, I’m sticking with the mainstream options for now, but using an aliasing service will make it easy easy for me to switch in the future. I’ll check it Migadu and I appreciate the suggestion.
Just recently discovered Migadu and it’s all I ever wanted!
What does Migadu do? I’m not understanding what “consolidation” means in this context. ELI5?
Typically MailProvider would let you have
<yourusername>@mailprovider.tldand sometimes a limited amount of aliases, right? With some you can bring your own domain and have<yourusername>@<yourdomain>most of the time also with a limited amount of aliases.Migadu let’s you pay a flat fee, bring as many domains as you like and use unlimited aliases. Their pricing scales with actual traffic, not arbitrary limitations on your address namespace.
Oh so you’re thinking about it from the lens of a standard mail provider, correct? I was more so asking what the difference or advantage was compared to an alias service like Addy, Simple login etc.
They have almost twice as many google apps though. Why didn’t you mention those?
There are arrows between the icons. The google ones are what they are switching away from.
Gmail - > tuta mail
Also you use way too much proton. Don’t put all your eggs in one basket
Have you heard of Privacy Guides? They have a whole community of people there and provide privacy focused software and service recommendations, with lots of details explaining their reasoning.
A big difference (for some) is that the mailbox is not fully encrypted. However I only see that as a requirement if there is an actual potential threat against you (like as a journalist).
Also, Mailbox has app passwords, so you can control which applications can access it and a simple revocation will end it. Connecting directly is not possible for security reasons.
They also offer 25 free aliases, 50 additional ones if you use your own domain. And they do make it rather easy to set up the necessary records to send via your domain. Plus throwaway addresses (which will only exist for 90 days each and can only receive emails).
Mailbox offers a secure version for your email that’s automatically encrupted, but also supports PGP for your reg email too (what I do). Proton is only encrupted when mailing other Proton users anyway, right? I say this as a former Proton Mail user.
I’m not sure about the Proton thing, but yeah, Mailbox sets up PGP for you at server-level, which means they are still unencrypted on the server but will always be sent encrypted.
The initial mode is that they will try to negotiate whether PGP is supported by the other side, with you having the option to always use it for the price of the opposite side having to encrypt them.
You can even enforce it on a case by case basis by adding “secure.” To the mailbox.org domain, however I don’t know if that is also possible when using your own domain.
First off: you’ve come a long way. Great setup, keep it up!
As others have said, I’d reduce your reliance on Proton. I’d particularly ditch their password manager in favour of something like KeepassXC and combine it with Syncthing (which you’re already using) in order to keep your passwords out of the cloud, but synced between your devices. Always think in terms of blast radius: if an attacker gets access to your Proton account (either because you fuck up or they do), they will have access to anything that’s in there. Having your e-mail + pw manager there increases blast radius dramatically and allows not only for access to, but full takeover of your accounts in case of a breach.
For Google keep replacement, check out Simple Notes Sync. I’ve been using it for a few months now 🙂
Proton Pass could be replaced by a synchronised KeePassXC/DX database.
I understand your point for Independent Password Managers. For some people this is not a solution. I would always recommend a password managers that fits your needs and know-how. My parents could not use keepass with sync without breaking or loosing shit. But protonpass, or Bitwarden or strongbox could be a viable option. In some rare cases I would even recommend Apple Passwort App. Better than nothing.
If you can figure out Linux, you can definitely use KeepassXC…
I use KeepassXC and it’s database syncs great with Syncthing.
What I don’t like about KP is it’s ui. Too many pages. Everything should be one one page like KeepassDX. I wouldn’t recommend for noobs.
Perhaps this one:
Proton Mail -> Tuta Mail
Why? I would be careful with Proton Mail b/c it presumably advocates the Swiss surveillance and security law, which allows to keep information for a longer period of time.
Didn’t see anyone else say this: DDG is certainly a great choice for search engine, though I’d recommend brave search:
- If you use bangs, it has them.
- Actually operates an independent index so the search queries aren’t reliant on Microsoft Bing.
Due to several of the companies issues (and it being chromium) I don’t recommend the browser but I do really like the search engine.
Why not Startpage?
Uses google as a backend and was also bought by an ad company.
I still use it, since google sometimes cuts deals with sites like reddit such that reddit is only scrapable by google. But it’s a last resort, after duckduckgo.
- ChatGPT -> llama.cpp
- Dropbox -> Syncthing + ZFS
- PayPal -> Atto
- Google Home -> Home Assistant
- Google Docs/Sheets -> Collabora Office
Some of these require self-hosting, so you might need Headscale or WireGuard to connect to them
Netbird is also good for connecting to them
Browser based wallet? Good god, no thx
Just to give more unique feedback (although everything you have is good) if your willing to self host, immich add immich to google photo replacements since it’ll back up photos across devices (I haven’t personally looked at ente photos) and depending on how important hiding your traffic from your ISP is, consider replacing a VPN with TrackerControl which helps to stop apps from phoning home.
