Remove Tahoe-LAFS

[matchboxbananasynergy]

This seems to be a legacy recommendation. Given its complexity, I don't think it really makes sense to recommend it.

Also, from my surface level understanding of it, it seems to be less about privacy, and more about ensuring data redundancy, but I may be wrong about that.

Overall, I think the rest of the options are much better/more user friendly.

[eylenburg]

Agree. It's better to add Mega.nz or Filen.io, maybe with some warnings that they're not perfect for reasons X and Y. At least they're easy to use and hence an alternative to Onedrive/Google Drive/iCloud for "normal people".

[matchboxbananasynergy]

To be perfectly honest, I wouldn't mind seeing a page on the website about how you can use OneDrive/Google Drive privately (by using things like Cryptomator). That's arguably better advice than using X lesser known and potentially less secure cloud storage provider.

By using something like Google Drive with Cryptomator, you benefit from Google's excellent security track record, while also keeping your data private from them.

That's probably an idea for a different discussion, however.

[eylenburg]

I disagree with you here. I use Cryptomator on Dropbox and it is horrible. The mobile app of Cryptomator doesn't support thumbnails for pictures and videos, and uploading is very buggy (e.g. if I want to upload a large video it may stop when I turn off the screen of switch app or the vault unlock timer runs out!). On desktop it is alright I guess.

There may also be human errors, e.g. you accidentally copy your files into the "normal" Google Drive folder rather than the Cryptomator folder in the file explorer.

Also from a philosophical perspective I don't think we should encourage people to sign up with "evil" companies such as Google or Microsoft and give them your money, when there's perfectly usable alternatives such as e.g. Mega instead. A comparison with email: We don't recommend a workaround like using GMail with OpenPGP, we recommend something like Protonmail instead.

[matchboxbananasynergy]

I wonder if the bugs you mentioned have to do with Cryptomator, or how it works with Dropbox specifically.

I haven't tested it out, so I can't really know.

Human error is definitely a factor, sure. I think Proton Drive will be a good choice for an E2EE by default cloud provider once they have desktop and mobile applications. That would be a "foolproof" solution.

Regarding your last point, I'm also not sure I quite agree. I don't think it really makes sense to approach this philosophically, but pragmatically. For all the bad Google (and other big companies) does, they also do a lot of good. I'm not going to deny myself a Google Pixel phone, for example just because it's made by Google.

My main objective is security and privacy and protecting my data. If I can achieve that with a product, I don't really care who is behind it.

Anyway, this is really off-topic now. It's probably best to stay on-topic here.

[samuel-lucas6]

@eylenburg this is why you shouldn't use MEGA. And I quote:

MEGA uses non-standardized cryptographic primitives in unusual ways in several places in their system. Some of these might be vulnerable to attacks, although we did not exploit them in the attacks presented here. Our recommendations include a transition to well-analyzed and standardized algorithms and would ensure that MEGA follows current best practices.

MEGA didn't use the recommended countermeasures as well, which is typical. Trouble is, their design is so weird that it would take a complete overhaul for them to follow best practices, leading to massive disruption given how much is being stored.

[dngray]

Indeed, I saw that Mega thing recently. Also not too keen on Filen privacyguides/privacyguides.org#345

[samuel-lucas6]

It has a good reputation, but based on the downloads page, I'm inclined to agree. The website is not what I'd call easy to navigate. They almost have too much documentation. Then you need Python.

Edit: I've just realised there's a note on PrivacyGuides saying:

Due to the complexity of the system and the amount of nodes needed to set it up, Tahoe-LAFS is only recommended for seasoned system administrators.

However, the point still stands that that's probably a very small portion of the target audience. Most people would never touch it.

[matchboxbananasynergy]

However, the point still stands that that's probably a very small portion of the target audience. Most people would never touch it.

This is my thought process as well. I'm by no means saying the software is bad or not to be trusted. I'm simply saying that it doesn't really seem to be a tool that we should be recommending to Privacy Guides' target audience.

In other words, if you know enough about this kind of thing to use this software, you know about it already, and you don't need Privacy Guides to tell you about it.

[matchboxbananasynergy]

Done in privacyguides/privacyguides.org#1483