I’ve cancelled my subscription yesterday, conveniently it was about to renew at the end of the week, so I have a few days to migrate from Proton, here’s what I’m thinking of, but I’d love to hear what other people are switching to
If you are on iOS I recommend KeeForge as there are no payments aside from donations and it supports KeePassXC and KBDX formats
Bitwarden is pivoting towards the same enshittification path as everything else, so that’s not gonna be a good long term for a password manager. They hired a new ceo whose only noteworthy experience is prepping companies for mergers and acquisitions, and briefly removed messaging on their website about always having a free tier which they reinstated after backlash. All signs point to a sinking ship, imo.
I don’t have the answer for what to use instead since I’m still a paid subscriber with them, but I’m looking around. Probably keepassxc but I don’t know enough to host and sync my own.
Vaultwarden is a great alternative.
However, Vaultwarden only implements the webvault, the client apps are still only supplied by Bitwarden, which they could make incompatible with Vaultwarden at some point.
the client apps are still only supplied by Bitwarden
Not true. You could also use Keyguard.
Which is a proprietary crap.
Their github page is public and you can review the code if you want to. What are you talking about?
I’m talking about the license. It is proprietary.
What is it exactly that you want to do but can’t? Anyone can audit the code, you could see if they were doing something sketchy. Sounds lile you just want to complain.
Source available does not mean the same thing as Open Source.
Re-read my comment. Did I say “open source”? Also, I reiterate my question, what does it being source available entail for you? Is there anything more insecure? Is there something you can’t do? This sounds more like a pet peeve than an actual problem.
That is what gives me pause with vaultwarden… the need for bitwarden proprietary apps.
Edit: i stand corrected they are not proprietary. Dont know if they could kill compatibility for vaultwarden if they chose to. That is a better explanation of my concern.
Dont know if they could kill compatibility for vaultwarden if they chose to.
Well bitwarden.com has made changes that broke compatibility with rbw for certain things, but the main problem here IMO is rbw not getting updated
Are they proprietary?
They are not. They are GPL licensed.
My mistake. Sorry
Indeed, and I do not like that I have to have another repository just for the bitwarden app.
I am not really worried though. If they completely fuck up, a fork of the app will be a matter of seconds.
KeepassDX on android. Any keepass .kdbx file opener on every OS. .kdbx file saved on a local network shared folder on an always on raspberry pi. Access the folder on all devices, open the file with keepass app.
No sync, no extra sync software, no dangling copies, changes are immediate, decryption happens on device not over the network. Step up to network share over sftp. Tailscale tunnel to access when away from home.
- don’t forget backups (standard advice for any storage but more so here)
this is the way.
bonus: put it on your NAS in a file-sync folder.
Which file opener on iOS?
AFAIK the concept behind keepassxc is that it’s an encrypted
.kdbxfile that you sync yourself among your devices by any means you can. There are official apps for Windows/Linux/Mac, browser extensions for Firefox/Chrome/Chromium/Vivaldi, there’s integration with ssh-agent, and 3rd-party apps for Android and iOS.I don’t think Keepass does syncing. I just leave the database in my Nextcloud sync folder on my desktop, and I can always pull the latest version to my phone. It’d be a bit more annoying if I routinely added new entries from my phone since Android won’t let the NC app maintain bidirectional sync, but I pretty much always do it from my desktop, so the workflow is fine for me personally. If you do it on your phone, you can upload the changed version, but I think you’d have to do it manually, so not a great flow, but if it’s a rarity, not too big a deal to me.
write a bash script that rsyncs your keepass database to your other devices and run it once in a while. i have seen way too many online password vaults get hacked to ever bother with them.
better to use p2p multi-device/os synchronization software like syncthing or syncspirit (disclaimer: I’m the author)
Bitwarden is pivoting towards the same enshittification path as everything else
Yeah… I’ve noticed as well… also interested in a good alternative.
Yah for now keeping Proton Pass only for that reason. And still on Gmail because I’d tried thrice migrating all to Proton but something always annoyed me.
I’m tired
yeah…
I wouldn’t trust Bitwarden anymore. I don’t believe they’ve done anything bad just yet, but they recently sold out to a private equity firm and quite literally removed “transparency” from their company values. KeePassXC is your friend.
Ahh too bad then I’ll switch to Keepass yeah
I’m not sure if you are aware, but there is a reason why it is explicitly xc instead of just keepass. Xc is the Foss one & keepass is a corporate hell hole
Oh thats good to know thanks, yeah I meant XC but was too lazy haha
But they replaced transparency with “trust” so surely we can trust them right? /s
I don’t trust bitwarden. This was very annoying: https://community.bitwarden.com/t/copying-values-brings-up-remote-desktop-window/100351/20
They claimed copying on Linux was only possible via screensharing despite literally every other app being able to copy text without that. The thread ends with “it’s linux’s fault bro” and yet the issue seems to have been fixed since then.
quite literally removed “transparency” from their company values
No they didnt. Why do people keep making up this bullshit?
"Bitwarden company values spell the word “GRIT,” and stand for:
- Gratitude
- Responsibility
- Innovation
- Trust"
It used to say Inclusion and Transparency, before they sold out.
I’m tired of keeping a book of grudges everytime a CEO says something. I’ll be waiting for now.
Like, it’s my business email, it’s on my cards and my site and pretty much everything else related to the business. Just change all that!?
Your business email is a @proton.me address?
You mentioned a website, wouldn’t you rather have an address @ your website domain?
Site is hosted by the accounting software I use, template based and I do no e-commerce.
Proton Mail is free and reasonably secure/not fucking Google, and I don’t computer enough to host my own site.
I cut lawns and maintain gardens, I just need to be reachable.
I don’t computer enough to host my own site.
You mean savvy or cost?
If it’s cost, you can have a simple site and email with your own domain for something like $30 a year.
I cut lawns and maintain gardens,
Do you own your rake and gloves or rent/borrow them?
It’s the same thing having a domain. Really basic but essential tool that it makes sense to own it and have no surprises or changes at anybody else’s whim.
Honestly, keep it regardless. None of your emails are encrypted anyway once they’re sent. It has to be another proton user or pgp or similar. 🤷
Unless you’re doing some illegal gardening or mowing someone down (literally & pun intended), there’s no reason to switch.
A movie about illegal gardening would be worth watching. We can call it root of all evil.
Have my angry upvote. Ill go out on a limb and say youve got more where that came from.
:D well yeah, but the others didn’t sound as good
this is exhausting
Don’t worry, it’ll keep going. There are so few exceptions to multi-product companies becoming shit in the long term
It is. I just made the switch last year and spent forever making hide-my-e-mail adresses for every service , web page and online store I had subscribed to. My Proton subscription just renewed so I guess I’ll wait another 11 months to see how this pans out before I make a decision.
I started with those, but then thankfully quickly realized it’s a great form of vendor lock.
It’ll still be a pain to migrate, but at least not AS bad as it could have been.
Hide-my-emails keep working after you leave proton if you have your own domain. I left proton last year and the alias I created there still point to my email address. But you have to have it point to a custom domain email address
IVPN is a well-established private VPN provider, with a strong track record.
Windscribe is also of note, being part of the cross-promotional circle of agreements with other established and trusted services such as Tuta, and Addy.io
Obscura is also worth a look for the especially privacy minded approach they take to running a VPN, essentially severing the entry and exit points of your network traffic across providers so that even if Obscura or their partners were to fail a user’s privacy, there wouldn’t be anything lost.
Mullvad is also a longstanding and respected VPN but I believe there’s been pretty severe controversy around them recently, and that should be looked into before considering them. They were essentially the gold-standard up until recently.
All of these providers have a variety of anonymous payment methods, to varying degrees of convinience and anonimity.
IVPN speeds are pretty bad IME, check if it works for you before committing to it
wow thanks for all those details!!
Felt like giving a little list off the top of my head instead of just going ‘use what I use!’
If you want any assistance, I’m always open to help out :)
Yeah that’s really good, thank you so much I’ll ping you or DM you if something comes up that I can’t solve on my own if you don’t mind
👍
I’ve known someone who uses both Proton’s VPN and the Mullvad one. From what I saw when I tested theirs, the Proton one manages to get through and works with frontends, whereas Mullvad doesn’t always, but it’s got more finetuning.
Mullvad’s co-founder funds the Swedish alt-right
That’s the part that confuses me. Mullvad has distanced itself from his stance. As for the party…:
My analysis
The party he supports has been claimed to be Marxist, and elements of that can be seen in it favouring a 30-hour workweek, strong secularism, making public transit free of charge, as well expanding social housing.
However, it (falsely) aligns workers with the business class, thus showing elements of favouring the bourgeoise rather than the proletariat; it also is nationalist in character, rather than internationalist, and wishes to deport fellow labourers. Moreover, it disfavours green energy and is thus a tool of the global capitalist coal and petrol companies. It also opposes liberating the worker from gender-based negative discrimination, because it wants to abolish quotas.
Since their policies don’t support inherent change of power structures, nor liberate the worker from discrimination, I would label them as revisionist marxists due to their alliance with the oligarchs.
Proton on the other hand, has confirmed donations that tend to be for organisations which I’d label as broadly progressive, but generally towards the centre-left. However, their CEO is obsessed by AI and has supported a statement of Trump. So it’s really crazy.
they’re populists, and their policy is whatever gets them the most votes at the moment.
Yes, yes he does. 😏
I don’t know if I’d still suggest Bitwarden with the dual-licensing drama from not too long ago and the new CEO.
Bitwarden is getting worse btw unless you’re running it yourself
Yea… God I hate the world… I started using Bitwarden like… A few months ago, and they’re already going in the shitter…
It seems it hasn’t happened yet. They are still open source for now. I am still using my Vaultwarden with Bitwarden.
It seems it might be going that way though.
If it goes fully closed source then I imagine the fix will be Vaultwarden devs coding some replacement apps.
Yea they haven’t done anything yet but afaik they changed their licenses to prepare to do it… So it’s only a matter of time
they do at least make it very easy to migrate away
Never understood the appeal, I’ve had my passwords in a keepass file on a Nextcloud server for years. If I’m gonna involve a third party, I night as well just use Firefox Sync (which I do for less important stuff)
I have all my passwords written down in a journal not in a computer
What did I miss?
Moving towards closed source: https://www.phoronix.com/news/Bitwarden-Open-Source-Concerns
Which takes away the only good thing about them
closed source security products are a contradiction in terms
Wasn’t this reversed tho?
Obsidian is proprietary. It can go fuck itself.
I switch from obsidian to Joplin because it has e2ee while obsidian does not but they’re kinda cut from the same cloth
You could also use Vaultwarden an open source fork of Bitwarden. It works with the official app and don’t know why you need Ente for 2FA as Bitwarden/Vaultwarden also covers that AFAIK
Vaultwarden is not a fork, it’s a reimplementation of the server.
Usually the point of 2fa is to protect the account if the password is comprimised, so not keeping the password and the 2fa in the same place seems logicalOkay but this also implies that Vaultwarden with your passwords was compromised. I understand your point having passwords and 2FA in two separate places but in the end having 2FA at all is better than not having it even if you have it in the same place.
Password manager is too important for me to self-host IMO
Well, for me, a password manager is too important to entrust to a for-profit company.
Bitwarden keeps a copy of your vault on clients.
So even if you lose your Vaultwarden/Bitwarden server files, you will have a local copy on every device you use.
I second vaultwarden Rec I’ve been using it for a while. It doesn’t have TOTP or other 2FA features tho as far as I’m aware so I do vaultwarden + Ente and it works well
It does have 2FA: https://github.com/dani-garcia/vaultwarden#features
Have people stopped trying Mullvad VPN for some reason? Is it no longer the best privacy focused one?
There was some drama after one of Mullvad’s cofounders was outed for donating considerable sums of money to right wing organizations. It’s fallen out of favour as the default recommendation as a result
Ah, I had no idea. Are any of the others anywhere near as private and secure?
I’m not sure. Mullvad is still a good product, but what it funds is not.
If I’m entirely honest, I mostly see VPN services as a predatory market, inflated by their own marketing campaigns about the risk of personal privacy. There are some products who are true to their word, like Mullvad, but most are looking for a quick buck from the average user who might forget they have a running subscription if they keep the cost low enough.
Frankly, after seeing what’s happened with Proton and Mullvad, I’m not inclined to believe anyone in this market amounts to more than a paranoid libertarian at best.
I switched from Mullvad to IVPN, no complaints
Closest I’ve found to it, so far, is Windscribe
If you’re gonna downvote, could someone at least tell me why Windscribe isn’t a good replacement? I’m not claiming to be an authority on the subject
https://meet.jit.si/ for free meetings replacements.
O.o They allowed meetings without registration again? That’s nice!
Last time I checked (long time ago), they reguired an account for a meeting, however their platform didn’t support registrations… which made no sense.
btw i remember there were lots of unofficial instances. Where did they all go?
Pretty funny to suggest anti-open-source Obsidian in a privacy subreddit
subreddit
A what?
Pretty funny to reference anti-open-source reddit in a privacy community
Oops
What are some good alternatives? Preferably with a web-client. I am pretty limited in installing software at work.
Obsidi
Joplin would be the typical example, but silverbullet is neat.
I’m currently using zennotes. It has a self hosted option which is a web version.
I can’t seem to find any information on where the company is from. I’ll try to stick with European software, not necessarily because it’s better or more secure, but out of principle. My experience is that if they don’t mention where it’s from it’s most likely not US :)
The Contact section on their Cloud privacy policy has a lumarylabs.com email address, and sure enough that site says Lumary Labs is based in the US.
I’ve been using Logseq for a couple years now and it’s great
Notesnook is an option that has a web-client as well as apps for pretty much any OS. They do have a free tier, but several features are hidden behind a paywall, so be aware of that.
If you’re not paying for sync services and cautious about which community plugins you choose, what is the risk factor? Genuinely asking, not being a contrarian on purpose.
I’ve stuck with Obsidian for the simple reason that the file format is a folder of plain text files. So data extraction if I decide to leave to another app is easy. Joplin changes the text file names and adds metadata to each file which is no good in my use case. So I’ve skipped it.
It’s not realistic right now to recommend an offline LLM due to average hardware. Sounds nice though.
If you can selfhost but don’t have the hardware for running the LLM itself. I currently have OpenWebUI setup linked to openrouter. Definitely not fully private but I’ve chosen only “Zero Data Retention” providers. Then on top of that be vary careful what you’re asking.
I have a lower-end GPU (8GB VRAM) and I can still run smaller models on it with decent performance.
Dumb question: what do people use those local LLMs even for?
Not much, but you can use it for basically anything people use frontier models for, it’ll just be somewhat dumber. I occasionally run LLMs for proof-reading important things that I’ve already hand-written and edited. Sometimes for bouncing off ideas. Sometimes for the kinds of questions I’d normally chuck at a forum but I can get a quicker answer if I ask an LLM. No, I don’t “trust” the answers; anything where I can’t just use my own judgement, the LLM will have given me enough to perform my own research to fact-check it.
What does “lower-end” mean in this case? 8GB VRAM could be anything from a 2014 Radeon R9 290X to a 2026 RTX 5060.
Radeon RX 7600, but yes, you’re right, it’s relative. It’s good enough for any gaming I do, which is not an awful lot. I think it’s considered mid-range for its generation, I guess I was just thinking of the GPUs I see people mention they have which seem much beefier than mine lol.
I’m no AI expert but when I looked into it, it seemed that VRAM was the biggest factor being mentioned in discussions of GPUs, hence why I mentioned it.
I’m no AI expert but when I looked into it, it seemed that VRAM was the biggest factor being mentioned in discussions of GPUs, hence why I mentioned it.
I could be wrong, but I think there are differences not just in FLOPS but perhaps more importantly in what kinds of functions are supported (with newer GPUs becoming gradually more general-purpose), so I’m not sure if the GPU from 2014 is capable of running AI models at all (slowly or otherwise).
I actually kinda want to find out, because my old GPU is a Vega 56 (which is also 8GB) and I’m not sure if it would be useful or not.
I’m sure you’re probably right. I haven’t looked into how things like clock speed/FLOPS/etc affect LLM performance.
The main thing is you need ROCm/CUDA/Vulkan support. If you do then just try running some models that fit into your VRAM and see how they perform? On my card, it takes maybe a minute or two to generate an answer, sometimes several minutes if the answer is long. I use small models that are <8GB in size, so not the best open-weight ones, but I don’t use LLMs for anything particularly complex anyway so the dumb ones do the trick for me.
I’ve been using Atomic Chat on my archaic iPhone 11 and it works well enough for my needs. Haven’t had much luck with several others, but that one works fine.
Strata makes it workable with low vram cards like 8 or 12gb.
