I've just decided I've had enough of Proton. Too many problems, too much work to troubleshoot with Help.
I was about to sign up* with Filen, but then I noticed that they do not have gpg signatures for their clients.
This is all too common in the major cloud services:
- Proton Linux client has no gpg signatures
- Filen has no gpg signatures
- Mega has out-of-date instructions for its signatures, now that
apt-key has been deprecated. I can't get it to work.
Why isn't the market - i.e. users - communicating back to these companies that its just not good enough not to have signed and verifiable packages?
End-to-end encryption is really important. But if you can't trust the client - what happens pre- and post- encryption - its useless.
In fact, its worse than useless. You are permitting unvetted software on your system - it has access to EVERYTHING. That's crazy! And if that's you, why are you even bothering with Graphene? (Although, in fairness, its not a corporate surveillance issue probably).
And no, SHAsums are not adequate.
So, what options do GrapheneOS users recommend that:
- have verifiable clients (with clear instructions?) - no, no builds please.
- support Linux and Android/GrapheneOS (integration with reputable packages e.g. RClone (I think) also okay, as long as making it work is not technically demanding).
- functional: a solid cloud based drive that can integrate into both platforms. Calendar, email, etc are superfluous.
- credible - looks like a real company that isn't 'doing the dodg'. EU hosting a plus.
Is it the impossible idea?
- Actually, I did sign up to Filen (based on positive recommendations here), discovered the gpg problem and then requested a refund. They were brilliant: they acknowledged the issue and refunded me with minutes. Kudos.