dazo

joined 2 years ago
[–] dazo@infosec.exchange 2 points 10 months ago (19 children)

@helenslunch

They reply when they have something to say. They don't reply just for the case of replying.

I've received several replies from them.

@Nelizea

[–] dazo@infosec.exchange 3 points 10 months ago

@fluckx Yupp .... and this is the lamest excuse I've seen in a long time ...

This is bullshit and they try to hide it. And they know it.

That Proton logo font is unique to Proton. These guys have studied this post: https://proton.me/blog/new-visual-universe

@protonmail @protonprivacy Don't let this pass. Let these guys feel they've trespassed into the wrong garden.

[–] dazo@infosec.exchange 36 points 10 months ago (3 children)

@testeronious

You know Proton has grown big when others take the time and effort to create scams like that.

It's no longer a tiny operation which is easily ignored or forgotten.

Question is what kind of scam is it? It looks like a crypto scam on the surface. But could it be more? Password phishing? Session hijacking?

[–] dazo@infosec.exchange 1 points 10 months ago* (last edited 10 months ago)

@grapemix

Yeah kinda ... but that it can also charge other devices when not connected to a charging source.

Use case 1: Charge FP batteries
The "box" is connected to a charging source, which charges inserted batteries

Use case 2: Charge USB devices
When the batteries inside "box" are charged, connecting a USB device to this "box" will start charging the connected device

Use case 3: Swap out the FP battery from this "box" with a discharged battery in the FP

It would be a great bonus if it could also accept more generations of FP batteries. FP3 or FP4 and newer would probably be most realistic.

[–] dazo@infosec.exchange 2 points 10 months ago
[–] dazo@infosec.exchange 2 points 11 months ago

@_Atlas_)@lemmy.world @Papanca
To fork what? The Windows or macOS Proton Drive and create a Linux version?

I would expect GUI interface is the least of the problems; that's most likely Qt based across all platforms.

One step up in the difficulty level is to implement the file synchronisation right. This would most likely need to be based on macOS, as that has a file system which shares more features to most Linux file systems. However, Linux supports many file systems and there are lots of corner cases to watch out for here (extended attributes). A synchronisation should ideally also synchronise all the meta-data about files, to ensure this is restored correctly on a different host later on.

And the most difficult and most different aspect is the "access on-demand". Here files are only downloaded from Drive as they are accessed. It's like a remote file system mounted locally. From the user experience, it looks like an "external harddrive", but it accesses data stored remotely. There are many ways to do this; an own kernel module or FUSE are the most common ways. FUSE is "simplest" and quite common - but might not give the best performance in many cases. A dedicated kernel module is tricky to distribute as they are hard-bound to the running kernel version. When you multiply those efforts to the Linux distributions available and the various kernel versions each distribution ships - it gets hard to get right. DKMS based distribution is more likely the best approach, but even that has challenges (Secure Boot system requires setting up signing keys, etc).

The difficult part is most likely not the UI aspect, but the "low level" code actually doing the file synchronisation and remote file access. That is very different between each platform.

[–] dazo@infosec.exchange 8 points 11 months ago

@sasquash471 @Papanca How do you think the rclone protondrive support appeared?

https://rclone.org/protondrive/#limitations

[–] dazo@infosec.exchange 2 points 11 months ago

@8rhn6t6s There are some caching which need to be enabled with the protondrive rclone mounting. But it is still slow.

Remember that non-E2EE storages (such as Google Drive, AWS/S3, etc) can do the upload a lot faster as a starting point, as there is no client-side encryption of the data being uploaded (and the reverse; decrypting downloaded data). This decryption/encryption happens in the protondrive "module" in rclone. On top of that comes that files are split up into "chunks" which are transferred via separate HTTP calls. And I have no idea (aka "have not read the code) how the unlock key of the PGP key is handled in rclone. All of these things combined together impacts the performance.

That said, I've had a quick test on a Windows computer with Proton Drive installed. It wasn't blazingly fast there as well, but still felt faster than rclone.

My guess is that it's partly that the rclone implementation has room for improvements on how the Proton Drive server-side APIs are called and some of it is related to crypto implementation performance.

For example, I dunno if the Proton Drive APIs support HTTP/2 protocol or QUIC ... And I dunno if the rclone supports them as well. Just in this aspect there are lots of room to cut down on the "connection handshake" as HTTP/2 and QUIC supports more efficient handshakes and can also have multiple streams sending data in parallel - using a single handshake. If the native Proton Drive app on Windows implements this, that may explain some of the performance differences.

[–] dazo@infosec.exchange 9 points 11 months ago (3 children)

@Papanca @synapse1278

I've been testing out the rclone Proton Drive integration for a bit. As it is today, the rclone approach is currently too slow, especially using the "mount" approach which lets you access Drive files on-the-fly only downloading data as needed.

Using an "sync" approach (where data is stored both locally and in Drive) might be a better approach, unless you expect rapid syncing of files.

Considering the setup efforts, I cannot recommend Proton Drive for Linux in a productivity context.

Alternatives to Proton Drive on Linux there is @filen and Tresorit, which are both fully #e2ee. I've been using both for a while and both are decent.

Filen is the cheapest alternative and feature wise pretty close to Proton Drive - but they have a sync client for Linux. They do not have a possibility to access files "on-the-fly"; all data must be synced locally. And sharing data via URL need to happen via the web portal. Sharing data between Filen users was read-only access last time I checked.

Tresorit is fairly expensive, but also a lot more feature rich, especially on the sharing side. The Linux client supports both synchronising files between local storage and the cloud as well as a "drive mount" where all files in the cloud are available and only downloaded once you access it - or uploaded directly if you store something there.

Both Filen and Tresorit are fairly efficient in regards to uploading and downloading data via their sync clients. Using the web portal is slower, especially on larger files. This is naturally and not unexpected; the data is decrypted first on your device when the data has been downloaded from the cloud storage. Proton Drive is no different here.

Filen is a more properly open source based product. Tresorit is non-open source and built on top of Microsoft Azure services.

[–] dazo@infosec.exchange 2 points 1 year ago (1 children)

@Mari @governorkeagan Having a built-in Proton Mail support (via an extension/add-on) to not require the external Bridge would be really nice.

[–] dazo@infosec.exchange 3 points 1 year ago* (last edited 1 year ago)

@otter @WQMan

For my own stuff, I do prefer Bitwarden over Proton Pass. Simply because having a lot of stuff in Proton and if then ending up being locked out feels like a too high risk.

I even have some stuff in https://www.passwordstore.org/ where it's synchronised to some (encrypted) locations and internal storage servers ... especially stuff which can help me if I get locked out of Bitwarden.

Don't put all your eggs into the same basket. Avoid the SPOF.

That said, for Proton accounts where I'm the admin - I would recommend Proton Pass these days, as it provides ease of convenience. Where less technical users has only one "platform" to relate to. If these users gets locked out; I have a chance to help them recovering again.

view more: ‹ prev next ›