Just tried it out with my proton account. Looks great! It’s very simple, but I also like that about it. And of course being private is wonderful.
Simplicity is an underrated feature. I’m really excited to see this come out because I’m becoming a bigger fan of proton every day.
How is it private?
Today we’re announcing a new end-to-end encrypted, collaborative document editor that puts your privacy first. Docs in Proton Drive are built on the same privacy and security principles as all our services, starting with end-to-end encryption. Docs let you collaborate in real time, leave comments, add photos, and store your files securely. Best of all, it’s all private — even keystrokes and cursor movements are encrypted.
Literally the second paragraph of the post (but I’m sure you haven’t read it, since you seem so busy replying to every comment here about how Proton is becoming Microsoft or something).
So sending a company your private key and trusting their servers to do E2E encryption despite them being able to modify their code whenever they feel like it to capture your password without encryption and masked in obfuscated JavaScript is now considered security? Wow, people really are gullible.
I’m not sure what you’re talking about ? You’re not sending your private key to their server without first encrypting it first locally. Their servers are not doing the E2EE, your client is. The website front and apps are open source.
Yes they could send you a compromised front if you use it via their website, that’s a compromise you accept, otherwhise you could only use their apps which are open source.
Tell me… when you visit a website that gets updated daily, if not hourly. If it served you a different version of JavaScript than what it served someone else… would you know?
I already answered that. Yes you can’t trust a website’s content, that’s why they offer apps. It’s your choice to trust the website which is as secure as they can make it, or you simply use the apps…
Last I checked the apps are mostly just wrappers around WebView, so either way you’re getting served different content randomly without ever knowing. AND, Proton specifically prevents the desktop apps from functioning on unpaid accounts. That would be like Gmail disabling IMAP for unpaid users.
I agree with your general sentiment here (that such an arrangement is not trustworthy enough for me to feel completely private) but your delivery of said sentiment is really fucking rude, dude.
Even if it’s not secure enough for you or I to feel private, it likely exceeds the security necessary to satisfy most people’s threat models so they can not only feel private but objectively be more private than if they just used Google docs.
incremental or opportunistic privacy improvements are better than none, a fact that has seemed to be lost in elitist privacy circles these days.
He’s wrong about what he said, too. You do not send Proton your private key.
Incremental in what way? There is an illusion of privacy. If that makes people feel good then sure, you increase your illusion of privacy.
Dude, you’ve made your point on virtually every comment on this thread. We get it, you don’t trust them. The world has given all of us every reason not to blindly trust this sort of thing. But I’ve done enough digging that I’M happy with the security, and the fact they’re not feeding my private content to the AI monster.
Please, for the love of the flying spaghetti monster, don’t keep spamming EVERYONE with the same 3 points you’ve already made elsewhere.
The only open source mentioned in the post is their encryption. Not the document editing software. OP please remove your change to the article title, it’s extremely misleading.
Well, they’re not wrong. It is ‘open-source’, not Free Software.
Damn. Proton is doing a good job of stacking up W’s these days.
They act just like Microsoft. Lot’s of people think Microsoft is successful. If you think Microsoft is the champion of privacy though you might be in a cult.
I’ll tell you what. When proton ships a product that takes a screenshot of my desktop every 5 seconds and stores it in an unsecured DB any user on my computer can access, we’ll call them even.
Comparing proton with Microsoft like this is a joke.
Really? So Proton saying that they can’t open source the backend code to improve security isn’t something Microsoft would say as well? Proton sells statements, but they don’t back up those statements with proof.
Exposing their backend code to the public would be inviting bad actors to find loopholes in the logic. Your excuse for how they’re not secure is in fact one of their security features. No code is perfect, and you give enough people enough time to peruse through your software they’ll find a flaw to exploit. So they only provide their code to 3rd party audit companies they trust.
Sounds just like Microsoft to me.
Open source ? Does that mean I can host my own ? Would it be compatible with other self hosted instance ?
EDIT: the only source code I found hasn’t been maintained for 3 years.
As I’ve slowly been expanding my homelab, NextCloud caught my attention. I haven’t tried it quite yet, but it might be closer to what you’re looking for.
ooooh I love this. Proton is just winning constantly these days.
No they’re not. They can’t even finish a single solution, let alone actually make anything functional when you’re not using their proprietary servers. They’re becoming Microsoft.
They can’t finish a single solution
Gee, it’s almost as if that’s the whole point of an ever-evolving SaaS platform.
Releasing unfinished products and expect users to just make do while they launch the next product can’t be the solution either.
Then it’s a good thing all of their products are fully functional and working as advertised, I guess.
Sure, whatever you want to belief :)
Which bits are not functional? I’m using their email and calendar… they aren’t completely polished, but they’re very usable.
Drive has no Linux client, Photos is extremely barebones and locks you basically in, as there is no export function.
Pass still has no proper SimpleLogin integration, no credit card support and UX wise is the browser extension pretty bad. Funny enough, years after launch you still can’t auto fill on Reddit.
The only thing I don’t like about Mail is that you still have to create reverse aliases through SimpleLogin. Better integration would be great.
Contacts still don’t sync to you local mobile contacts. Which means you either do it manually or you have to keep two sets updated.
Calendar is good too, I’ve heard it has no offline support though. Although I haven’t verified that.
Last thing I would like to see is notification support without Play Services.
Some of those things might be super unimportant to some, but for me it makes the use of their stuff unnecessary cumbersome. Especially if you consider that those are all Proton products and should work together well.
My by far biggest problem is their communication and general development speed though. Stuff like contact sync has been requested for 5(?) years now but there hasn’t been so much as a “we’re working on it”.
It feels to me they come out with new products all the time, like the document editor now, without addressing the little things that would make their ecosystem great.
Anyway, long ramble. But I appreciate that you asked for more details without insulting me.
A SaaS solution that claims to be private but won’t provide the backend code to prove it. You don’t find it at all suspicious that they claim releasing backend code would make it less secure? What kind of security product is not open for inspection? The same kind of “security” you get from Microsoft.
I imagine it probably is inspected, just not by the public. They probably do it themselves.
And they may have contracts with certain companies specializing in this sort of security that also inspect it.
And there’s also the cybersecurity companies that test it whether they’re contracted or not. At some companies, their entire job revolves around finding bugs (especially security bugs) in other companies’ software.
Just because it’s not on GitHub doesn’t mean it’s not a good product that hasn’t been thoroughly tested.
Surely we’re not gullible enough to accept “we inspected ourselves and determined we are secure and you should use our services”?
You realize that Microsoft code is inspected as well, even more heavily and regulated… and yet they still end up with major breaches. Security evolves through open source collaboration and inspection by experts that aren’t being paid to say you’re doing a good job.
You are making a lot good points… But is there any other practical solution?
Seems this is the best a normie on budget can get
They’re not actually good points at all… Proton’s open sourcing of the clients is for the purpose of trust in terms of security and privacy. The backend doesn’t matter because the point is that the data is encrypted before it ever gets to the backend. The goal with Proton’s open sourcing is not the ability to make it self-hostable. Sure, a lot of concerns are valid, but this isn’t like Microsoft or Google. Nearly all of Proton is verifiably and provably secure. Well, at least as long as you trust the web clients being served are the ones whose code is publicly available. But again… You can’t verify that with any SaaS. Such a risk is even present with self-hosting tbh. But that’s another discussion.
Yeah because enterprises primarily use a ton of open source security tools…
ಠ_ಠ
Enterprises are using a plethora of open source tools at this point. They may still utilize closed source solutions, but they definitely have quite a bit of open source solutions tied in.
A lot of people confuse open source with community driven/governed.
If things go awry, you’ll be locked-in, married to Proton.How do you mean? You’d just export your data.
Proton drive has export?
Awesome…I can move my budget over to my proton.me account now.
I don’t think there’s a spreadsheet app yet. Hopefully soon
I like how there seems to be more and more alternatives to MS Office, even from big companies like Google. Best case scenario, this could lead to companies actually starting to use an open format, like ODF, so that all these different office applications can be used without causing issues in the file and that would pave the way for open source alternatives, like LibreOffice or OnlyOffice, to become viable alternatives for a lot more people and companies. Do Google Docs and Proton Drive use/support ODF? I’m pretty sure MS Office supports it.
I wish msoffice would just die a miserable death
Word is a pain in the ass. Resize a table column by 1px and the rest of the document gets absolutely fucked
Excel suffers from similarly frustrating UI issues, but my main problem with it is that it’s being used for things that it was never intended to be used for. On the extreme side, a company will shove all their HR info into one xlsx file and then someone will accidentally, somehow unrecoverably, delete it
More commonly, I’ve had to use it as a progress tracking/ticketing tool. An entire team adding rows, deleting rows, accidentally clearing formulas, highlighting random fucking cells, resizing columns etc. all at the same time. It’s just hell.
Abusing Excel as a crappy database is a very real and very widespread problem.
You use what ya got, and you don’t buy database software or hire a database guy until you know you need one
But access comes with office, so if you have excel you have at least a software that is intended to be used as a DB (efficacy aside)
Let’s be real, using Excel as a makeshift database is probably still better than actually using Access lol
They’re just too expensive. Like, sure, it costs money to run, but 3.49€/month (the discounted 24 month rate) for the mail only plan, 15 GB storage. (41.88€, $45.17 USD, $67.28 AUD per year)
That’s really expensive if you just want mail.
The other stuff, is also really expensive. To the point that makes you think, “there is no way google is making THIS much to make up the difference in advertising to me for a comparable plan”.
remember, it’s not just about making up the difference per user in advertising, it’s about getting and keeping as many people into their ecosystem as possible.
then they make some cash from selling data, and having more data to scrape to train their models and such. proton isnt making any off your data
it’d be great to be able to easily compare cost and expense, but companies obscure so much in the backend. rental car companies buy discounted in bulk, then sell the cars tens of thousands of miles later at a profit, and that’s before any income from rental
