I did read that part, but like you, I haven’t been able to independently verify it yet.

This right here. KeepassXC (PC) already had passkey support for a while, KeepassDX (Android) recently implemented support. If you use FOSS implementations, vendor lock-in and potential future corporate enshittification are non-issues.

What’s missing from this report is more detail on how exactly this attack went down. Did the attackers compromise supermarket networks and manipulate the fridges through lateral movement within the network; or were the fridges accessible from the open internet? If the latter is the case (and there’s a non-zero likelihood they were): why the fuck?

If the CEO of a privacy company supports political forces that are deeply anti-liberty and anti-privacy, that does constitute a “need” to switch, don’t you think?

people just hold on to the CEO bullshit take on US politics

…echoed and reinforced by Proton’s business account. That’s not a nothingburger. Trust is a privacy company’s greatest asset - and an asset easily destroyed if the company is found to have political leanings that are inherently adverse to privacy and freedom.

Lemmy.ml is essentially a Stalinist echo chamber.

Hello, Animal Protection Services? Yes, this guy right here.

It [IVPN] just seemed like the most similar choice

A lot of things are similar indeed, with one essential difference: the raid on Mullvad did prove their no-logs policy was no bullshit. I haven’t found anything similar on IVPN.

Nym seemed interesting, but I don’t believe they offer Wireguard configs?

Good call, they don’t. When is that relevant, though? When you want to connect a headless machine, such as a server?

I’m still running out a mullvad subscription but I’ll be switching that to IVPN when it expires.

I’m in the same boat: still on Mullvad, but eager to switch due to… things. May I ask what your main reason is to consider IVPN above all others? I’m still stuck choosing between IVPN, Proton and Nym.

Tips hat. That’s some cleverly painful poetry, good Sir!

I’ll keep it short, but provide links for further reading. First off, I don’t think proton is “bad”, or anyone is trash-talking them legitimately. Both their jurisdiction (Switzerland), dedication to FOSS and good audit results make them a solid choice.

Diversification is my main reason why I’d never go all-in on Proton. Over the years, they’ve grown an ever more complete suite of apps (e-mail, calendar, VPN, password manager, docs, AI) that does share some similarity with the Google app suite in that you’re essentially putting all eggs in one company’s basket - and a lot of trust with that. If Proton got hacked, got subverted by a three-letter agency, or just got taken advantage of by a rogue employee, the effects would be much more impactful than if it had just been your e-mail provider, just your VPN service, just your…

Also, Proton’s official social media account echoing CEO Andy Yen’s private statements on U.S. politics haven’t helped convince people that the company is, indeed, politically neutral and solely focused on privacy.

Actually, it’s also the someone that makes the distro controversial. (Spoiler: poorly veiled bigotry in link.)

Seriously though… I wouldn’t want fascists’ money anywhere near my pet distros, regardless of volume. As they say: “He who pays the piper calls the tune.”

That’s an extremely solid list, mate. You can be proud of that. May I ask how long it took you to transition to this state?

In case you’re still willing to adjust one thing or another, here’s some food for thought:

1. You’re still running a relatively Proton-heavy loadout. They’re hosting your mail, VPN, docs, calendar and AI services. In case of a breach (attacker gains access to your account) or a company employee / the company itself going rogue, you will have several eggs in that particular basket affected, and a few very sensitive ones at that. Diversification might be an option, e.g. getting a separate mail provider, running your docs and calendar through a (self-hosted?) Nextcloud instance, etc.
2. Personally, I’ve never felt comfortable with the idea of my password manager being cloud-accessible, regardless of how tight the security on the other end claims to be. KeepassXC (on Linux) and KeepassDX (on Android/GrapheneOS) work extremely well. They’ve even gained Passkey support recently. Add Syncthing to the mix for cloudless cross-device sync and you’ve got yourself an entirely offline password manager.
3. You may want to fix the “FUTO” spelling in those two headlines. ;)

For years, we’ve been wondering how to increase Signal adoption, when the solution was right in front of our eyes. The Signal Foundation needs to implement a function that on every new install, people have a chance to win free chips.

Maybe it’s because I neutered my W11 and only dual boot to launch the occasional game or Windows specific driver

Yes, it’s that. If you’d use it as your daily driver, you would notice. I do tech support at work and there’s hardly a month that goes by without a Win 11 machine sitting on my desk that has - miraculously! - fucked-up drivers or other issues after an “update”.

Oh, it “harms democracy”, doesn’t it? How about this headline: social media fuels a genocide by spreading rumors, Myanmar finds. But alas, that was 2017 and only brown people getting harmed in some far-away place, so it’s old news and nothing to hold Facebook accountable for, eh?

I appreciate you taking the time to do this write-up, OP. Unfortunately, I believe it will not do what you hope it does, i.e.: “make you a it more private”.

Think of this in terms of data points Google gets on you. As per the warning on FDroid, they get:

the apps list and system details

That alone is very likely enough to identify you, particularly if you

• use a custom ROM: this will put you into a tiny pool of users
• use any apps that not everybody has (e.g. apps for your public transport, government or financial institutions)

Let’s say you’re running GrapheneOS on a Pixel 7a and have apps installed for Swiss Rail, Bern public transport, the UBS banking app and Signal. How many people will have this particular setup? I’d wager this would already narrow the pool down to a single-digit number of users, if not “one”, and any additional app off the Play Store will narrow it down even further.

While using your native public IP will give them yet another data point to identify you, so will the use of TOR or a VPN, because, again, only a fraction of Aurora store users will do that.

On the other side of the equation, the only “threat” I can think of is: “Google will know that I use these apps”. Outside of a targeted attack (i.e. Google sending you - specifically you - an update with malicious code injected into the APK), I cannot see any truly harmful scenarios arising from this.

All in all, I don’t think there’s much to be gained here: both the effect (if it works at all) and the threat (if you don’t do anything) seem so miniscule that it’s hardly worth the time to set this up.

Instead, this time is probably spent better on this here:

When possible, use Obtanium or F-Droid instead. F-Droid has built in Tor as well.

The only way not to be tracked by Google is not to get involved with Google. The only way to truly win the game is not to play it.