RFI: Personal information security - Apps, devices and practices

[schüler]

Is this still a valid choice? I got a new laptop and I need to backup the old one and transfer files. I'd like to backup to the cloud and then make that an ongoing practice (something I should have been doing all along) and would like to do that without compromising privacy. Thanks.

ETA: IDrive is offering a deal at $6.95 for the first year and also says they don't store encryption keys, etc. Plus, it allows mobile device backup. This seems like an obvious choice to try. Is it? https://www.idrive.com/

I would look at the big picture for yourself - storage size, use across several different platforms, easy setup, easy interface, etc. If you're not already using things like end-to-end encrypted email, VPN and so forth... then IDrive is a decent choice. There are a lot of helpful "X" vs. "Y" reviews of online storage services.

I still use SpiderOak paid account for its privacy/simplicity. I don't need to backup terabytes of data, I don't need to sync a bazillion files between several devices and I'm fine with the slightly kludgy Windows app. I actually appreciate the granular aspect. The Android app is a far cry from polished products like DropBox/Sync but it's OK for my infrequent use. The Hive hot sync directory across my devices works fine. And it's just me saving the data for myself. I no longer use DropBox, Sync, etc. for anything.

IN OTHER NEWS,

Purism is shipping development models of their Linux-based phone, the Librem 5. VERY basic functionality and they're still working on basics such as call audio quality, power efficiency and way more. But it's ALIVE! A phone built with zero closed sourcecode chipsets, 100% their own code (open source - they're uploading all their code to the public as they develop it), discrete baseband module and of course discrete hardware kill switches for baseband, wifi/bluetooth, mic, etc. They were made from the start to act as portable workstations - support for full size monitor/keyboard.

Blocky size due to modular separation of the wireless modem, storage... and no aftermarket support (yet?).

Their regular phone is $700. They offer an all-USA-assembly pre-order for $2k. Pretty freakin' neat.

I think the closest competitor is still the Pinephone, but that is built on closed sourcecode chips.

[Erik]

Thanks. I appreciate it. This has been a really useful thread for me.

[RJ]

Whelp, today seemed as good a day as any to start this.

I've had a free Proton Mail account for a couple months, seems to work ok. Today I upgraded to the Plus package, and added the VPN service. I have five email addresses, and can protect five devices with Proton VPN. I went ahead and bought an annual package, which brought the price to 115 EUR / 134 USD one time charge.

I added the Proton VPN client to my iPhone, and activated it. I used Speedtest to check down load here at the Apt. Normally I see 115M up, 11 down, and with the VPN active it seems to be about 48M up /8 down. I think for the protection of having VPN all the time, especially when we are traveling, it's worth it. I've activated the ProtonMail VPN widget off the home screen to keep an eye on it while it's running. Hopefully it will do it's thing in the background with no further interaction (which is kinda how I envision this working.)

I'll continue to monitor. I have to add Mrs. RJ's phone as well as our Windows and Linux boxes, and an iPad Mini to the account. Will report back any additional observations.

[RJ]

Got the iOS client downloaded and running on my iPad Mini.

I did some investigating on what the "Use Secure Core" slider button meant. Apparently this adds security with a double hop through the Proton servers:

https://protonvpn.com/support/secure-core-vpn/

I am not sure I need that, so I disabled it for now.



I think disabling this feature should speed up the connection. I did the same on my iPhone 12, and noticed speeds went way up; they are now around 102 M down, 10 M up, or almost back to what's "normal" for my internet connection. I did notice that my Spectrum TV app (I watch TV sometimes from a device) doesn't work with the VPN connection enabled. But not sure I'll need that, since this is primarily a security enhancement for me at least when we are traveling or on the road.

[RJ]

So, one negative comment on ProtonMail so far.

I opted to purchase the "Proton Plus" package for around $135 or so annual fee. This is touted as having up to "five email addresses" as part of the package.

Well I was mentally thinking, ok, five email addresses, that will work; I need an address for me, one for Mrs. RJ, and we use one for common accounts or other things where we need to pool the info. I've set up this pooled address on several clients so we each have access to it. This approach works very well for us.

Protonmail doesn't operate that way. In fact, what they really should say is they have "five email aliases", which you can use with your (single) primary account. Yes, you can send email to "appear" as another email address@protonmail.com, but they don't have a concept of an individual email account and storage for user 1, another for user 2, and so on. They just have one big pool of email for the "one" user.

So it's not like you are buying five separate emails. You really are buying one, with the option to "appear" or alias yourself with another email address.

I was not very happy with this. But since I've gone ahead and bought the package, what I ended up doing was to set up three incoming email filters. If the email filter contains "user 1" as the recipient, I moved the email to a folder called "user 1". Same for "user 2" and same for "user 3".

After setting up these filters, I installed the Protonmail Client on my wife's iPhone, and confirmed with some back and forth to gmail that this indeed does work. She has the same client I have, meaning she can see all "my" email, as I can see all "her" as well, and we can both see the "shared" email, each in their respective folders.

We are ok with this, as our relationship is transparent; we don't have a me/your financial relationship so everything is in one pot anyway (ok actually well I tell a lie: we share the money 50:50: I put it in, she takes it out ).

But if you were looking to get true "multi user" with the basic Proton Plus package, it won't do it.

[RJ]

Ok, I got the VPN installed on both our Windoze box and my Linux Mint laptop.

Windows was easy; just login to Proton VPN, go to the download area, download the app, then open it and follow the install prompts. Once the app is unpacked and started, you log in with your credentials, select "start with windows" and it starts. I picked the "fastest connection" standard profile, and it connected to a server in Miami. And that should be it.

Linux was a bit trickier. I followed their instructions for Linux/Mint here:

https://protonvpn.com/support/linux-vpn-tool/

One tricky bit was I had to go figure out what my "openVPN" credentials were. They are obvious, but over in the Account settings area. They are both like 26 character strings automagically generated by the Proton people. Thankfully they give you a "copy" box, so you can just copy and paste them into the Linux text window when you need to login to setup your profile.

To install, I followed the command line "sudo" commands listed at the link for Mint. I had created a GitHub account for a WiFi driver I needed, but I didn't need it to install this package. In Mint, Proton VPN is controlled by a command line interface. I got it running, but I will have to remember how to include a process to start it automatically when Linux starts; like a cron job or something.

Interestingly, there's no Proton VPN package available in the "software" manager that's available; so yeah you have to follow their guidelines.

[RJ]

One minor comment on ProtonVPN; with my iPad Mini running through the VPN, I can no longer connect YouTube app on the iPad to the YouTube App on my Samsung (Android based?) TV. I would imagine even though they are on the "same" network (the iPad Mini is on the 5G side of my WiFi network, the TV is wired direct to a 4 port switch, along with my Sonos sound bar, then via a 10/100 ethernet cable to a port on the back of the router) since packets out of the iPad through the VPN are encrypted it can't see the TV. If I disconnect the iPad from the VPN temporarily the YouTube app will connect to the TV fine.

It's not a yuge deal; but I do find it useful to control the TV from my iPad for watching random videos at night.

[Chance]

I would imagine even though they are on the "same" network (the iPad Mini is on the 5G side of my WiFi network, the TV is wired direct to a 4 port switch, along with my Sonos sound bar, then via a 10/100 ethernet cable to a port on the back of the router) since packets out of the iPad through the VPN are encrypted it can't see the TV.

When you run a VPN on an end-system, it isolates that end-system from the rest of the network. That's the whole idea. You can check to see if your router will connect to the VPN so your external traffic is protected and your internal traffic works as usual, but that can create issues everyone on your network has to deal with.

[perlslacker]

I got it running, but I will have to remember how to include a process to start it automatically when Linux starts; like a cron job or something.

I did a quick google and it looks like you can just set NetworkManager to autoconnect your VPN, assuming Mint uses NetworkManager. You could use systemd too I guess but that would be more involved.

EDIT: in case you don't want to click the link, run the command 'nm-connection-editor.' There will be an option for your connection called "Automatically connect to VPN."

cron is for running tasks periodically (like every hour or every day), not for making sure they happen on startup.

[CleverNickname]

If you do configure your laptop to autostart the VPN upon connecting your network interface, realize that many public Wifi APs require that you authenticate through some web page before you're granted access to the internet, even if just to click a checkbox saying that you're agreeing to the ToS of whoever's running that AP. If properly set up, your VPN would block access to that page, so it'd probably be easier to set up your VPN to not connect automatically, and then manually connect the VPN as soon as you're authenticated, but before you do anything else.