As a (previous) customer of Proton from many years and a user of their drive product, you should be aware that earlier this year the drive API endpoints began to block their own VPN egress quite often for rate limiting. They also block many cloud provider’s egress. They also don’t officially support rclone, and their changing API spec often breaks the compatibility.
I saw the writing on the wall and migrated rapidly earlier this year ahead of crypto product launches ahead of the email fiasco. It was hard to get data back out, even then.
Proton still stands for privacy. But the dark patterns for lock-in I can do without.
Hetzner Storage boxes with rclone and the “crypt” option are a drop-in replacement, at ~$40 for 20TB. That’s where I went instead.
A non technical person would probably Google “Hetzner Storage Box”, click the first link, and read the page that answers all of those questions.
There is many free software suites that Hetzner Storage box supports, up to and including official support for rclone (the free tool used in the post we’re replying to).
Why do you need cloud, if you don’t need public sharing?
You can connect to a 2-bay NAS with 20 TB of storage at home with a VPN. That much storage will be very expensive in the cloud. Proton is like 120$/year for 500GB.
I keep a home server for exactly that reason but I still use cloud for some things to have an off site copy as well. There are some things I don't want to risk losing over burst pipes, a fire, burglary, power surges, etc.
Support for proton drive on rclone is still on beta [1], Proton, AFAIK, doesn't provide documented official APIs for accessing their Drive. Much of the work on the rclone plugin was made via reverse engineering and reading Proton's open source projects code
My rclone for proton stopped working this week and I just cannot get it working. It's looking likely the support will be dropped as the dev is no longer working on it and it's not finished.
Hopefully proton will hurry up with their SDK. Through the rclone GUI I can access and mount the folders and files but I cannot get any auto rclone commands to actually transfer any files.
You might be interested in Peergos [0][1] which is E2EE, fully open source (including the server), and self hostable. We've been audited by Cure53 and Radically Open Security.
My suggestion, if you can, would be to host the data on your own hardware. The Internet was initially conceived with this kind of decentralization in mind -- most people/organizations hosting their own websites/email/files/etc. And this is what we must go back to if we want to retake control from "cloud" providers.
Technically, this could be as simple as a Samba server behind Wireguard, but you could also, or in addition, look into other projects like Nextcloud especially if you are interested in sharing files with people.
I work on a project Blobcache, a content addressed store for exposing and consuming storage over the network.
It supports full end to end encryption, and offers a minimal API to prevent applications from leaking data.
You can persist arbitrary hash-linked data structures in Blobcache volumes.
One such data structure is the Git-Like Filesystem, which supports the usual files and trees.
Proton’s product changes over the last couple years are the exact opposite of that. I think they’re the only credible game in town for an email/drive service in the cloud that doesn’t have AI data mining risks.
Of course, and I didnt intend to downplay the efforts of those projects. Just pointing out that they don't meet the requirements of most threat models.
Joking of course, but I am playing around with a similar setup, I should try it over the actual internet and see how much it sucks.
Now I am arguing with myself if you would want to run it over an encrypted tunnel. Theoretically no, but drive encryption is not really designed to protect data in transit who knows what sidechannel data would leak, so maybe... and the tunnel probably has better authentication than iscsi
Is it possible to "just sync some files" to Proton Drive in user space without root access? As a paying Proton Mail customer I am annoyed about situation with Proton Drive and non-existing official support for Linux. On the other hand, they will probably drop some kind of electron wrapper of few hundred megabytes, and that won't be useful either.
What about alternatives? Should I just use Filen instead?
As a (previous) customer of Proton from many years and a user of their drive product, you should be aware that earlier this year the drive API endpoints began to block their own VPN egress quite often for rate limiting. They also block many cloud provider’s egress. They also don’t officially support rclone, and their changing API spec often breaks the compatibility.
I saw the writing on the wall and migrated rapidly earlier this year ahead of crypto product launches ahead of the email fiasco. It was hard to get data back out, even then.
Proton still stands for privacy. But the dark patterns for lock-in I can do without.
Hetzner Storage boxes with rclone and the “crypt” option are a drop-in replacement, at ~$40 for 20TB. That’s where I went instead.
I wish Hetzner made storage boxes available in their US regions.
As a current (avid) user of Proton VPN and Drive, I have never seen issues with interactions between proton drive and their vpn.
How can someone not familiar with the technical details use the alternative you suggest? Is there software (even if paid) that can sync to it?
A non technical person would probably Google “Hetzner Storage Box”, click the first link, and read the page that answers all of those questions.
There is many free software suites that Hetzner Storage box supports, up to and including official support for rclone (the free tool used in the post we’re replying to).
https://docs.hetzner.com/storage/storage-box
How would you handle end to end encryption?
Probably using rclone (the free tool used in the post we’re replying to).
Why do you need cloud, if you don’t need public sharing?
You can connect to a 2-bay NAS with 20 TB of storage at home with a VPN. That much storage will be very expensive in the cloud. Proton is like 120$/year for 500GB.
I keep a home server for exactly that reason but I still use cloud for some things to have an off site copy as well. There are some things I don't want to risk losing over burst pipes, a fire, burglary, power surges, etc.
Support for proton drive on rclone is still on beta [1], Proton, AFAIK, doesn't provide documented official APIs for accessing their Drive. Much of the work on the rclone plugin was made via reverse engineering and reading Proton's open source projects code
[1]: https://rclone.org/protondrive/
They are working on an SDK, which they will use for their own Linux client: https://proton.me/blog/proton-drive-sdk-preview
My rclone for proton stopped working this week and I just cannot get it working. It's looking likely the support will be dropped as the dev is no longer working on it and it's not finished.
Hopefully proton will hurry up with their SDK. Through the rclone GUI I can access and mount the folders and files but I cannot get any auto rclone commands to actually transfer any files.
Surely there's better technological solutions for encrypting block data in the cloud with lower risks of service ensh*tification?
You might be interested in Peergos [0][1] which is E2EE, fully open source (including the server), and self hostable. We've been audited by Cure53 and Radically Open Security.
[0] https://peergos.org
[1] https://github.com/peergos/peergos
My suggestion, if you can, would be to host the data on your own hardware. The Internet was initially conceived with this kind of decentralization in mind -- most people/organizations hosting their own websites/email/files/etc. And this is what we must go back to if we want to retake control from "cloud" providers.
Technically, this could be as simple as a Samba server behind Wireguard, but you could also, or in addition, look into other projects like Nextcloud especially if you are interested in sharing files with people.
I work on a project Blobcache, a content addressed store for exposing and consuming storage over the network. It supports full end to end encryption, and offers a minimal API to prevent applications from leaking data.
https://github.com/blobcache/blobcache/blob/master/doc/0.2_W...
You can persist arbitrary hash-linked data structures in Blobcache volumes. One such data structure is the Git-Like Filesystem, which supports the usual files and trees.
https://github.com/blobcache/blobcache/blob/master/doc/8.5_G...
Proton’s product changes over the last couple years are the exact opposite of that. I think they’re the only credible game in town for an email/drive service in the cloud that doesn’t have AI data mining risks.
The state of things isn't great IMHO. Im not sure I trust any of EncFS, CryFS, and gocryptfs.
Many leak metadata and/or have serious security concerns.
Metadata leakage is a fundamental issue when you go from block to object. I can think of some schemes that would help but they’re all kinda nasty lol
Of course, and I didnt intend to downplay the efforts of those projects. Just pointing out that they don't meet the requirements of most threat models.
Can you detail the current metadata and security problems with CryFS? Do they also extend/apply to securefs?
luks on an iscsi drive
Joking of course, but I am playing around with a similar setup, I should try it over the actual internet and see how much it sucks.
Now I am arguing with myself if you would want to run it over an encrypted tunnel. Theoretically no, but drive encryption is not really designed to protect data in transit who knows what sidechannel data would leak, so maybe... and the tunnel probably has better authentication than iscsi
Is it possible to "just sync some files" to Proton Drive in user space without root access? As a paying Proton Mail customer I am annoyed about situation with Proton Drive and non-existing official support for Linux. On the other hand, they will probably drop some kind of electron wrapper of few hundred megabytes, and that won't be useful either. What about alternatives? Should I just use Filen instead?
Neat. I did just buy one of their packages so this will be useful