Dear reader,
This is the second article of the two-part series, where I challenge the popular argument asserting that people shouldn’t put all their eggs in one basket. The first part dealt with the question of 2FA, which you can find here.
Today, I will discuss how people also use this argument in relation to ecosystems, where they regularly warn against using a single provider for everything. The biggest concern is future account compromise, which could expose a lot of your sensitive data. That is why many suggest using multiple services to limit the data that a single account compromise could put at risk.
I argue that ecosystems can provide a convenient way for users to get more familiar with privacy tools, and even potentially help reduce their attack surface since they only need to trust a single party. Simultaneously, you should be careful whose ecosystem you’re getting yourself into as some providers make it a pain to export your data. You should also choose wisely who you’re going to pick if you turn down established and secure providers like Proton since some alternatives can have questionable security practices that would probably put you into a worse place than going with the more well-known and trusted option.
It is also important to acknowledge that many people considering private ecosystems are coming from providers like Google and want a simple replacement, and something like Proton could be the perfect option for these people. Just by moving from Google to Proton, people’s privacy and security get boosted. They won’t be worse off even if they are just switching to another ecosystem.
No significant security concerns
Similar to the discussion regarding 2FA, people love to jump to an outcome of account compromise when they warn others from trusting their data with ecosystems. It is easy to argue against ecosystems when we start the discussion from the most catastrophic situation, where someone has gained access to your account and all the data that you’re storing there. I think we should discuss more how we can prevent that from happening instead of worrying too much about a scenario that is very unlikely to happen.
In reality, we still have a lot of power to prevent this scenario from happening, starting from good cyber hygiene like not clicking links in your emails and using strong passwords and 2FA. Service providers also have their own defenses we shouldn’t ignore. For example, since all Proton’s services use zero-knowledge encryption, users wouldn’t have to worry much about a potential Proton breach as long as they have used a strong account password. Even if you used multiple services for different things, getting your device infected with malware could still compromise them all.
Since a company like Proton is also so solid security-wise, there is also a risk that by dividing your data across different companies, you could choose inferior replacements security-wise. Examples include popular options like Mega (obviously), but also Filen (not as obviously). The latter I still wouldn’t trust after their early show of incompetence with their security. Regular security audits could change my mind about them, but that hasn’t happened yet.
You also need to be careful of whose ecosystem you’re entering. With some providers, such as Apple, you need to take some extra steps to remain sufficiently secure. Then there are providers like Google that don’t offer real encryption solutions for regular people, and therefore you need to trust their word that your data stays secure, which I certainly wouldn’t do. I would always prefer providers who treat security as the default option, where the user doesn’t need to take any extra steps.
The more relevant question
The much more relevant question with ecosystems relates to data portability. So, you need to consider how easy the provider has made it for you to leave if you ever decide to do that. With Apple, this is notoriously hard, but with something like Proton, it is relatively easy. With a custom domain, things would be even smoother, especially with your email.
Yet, there are even some privacy-first companies that have made leaving them difficult. While I loved using Cryptee for writing my notes at the university, I was less thrilled about their lack of proper export options and had to export everything manually. Privacy-focused companies that offer people alternatives to big tech should do better than to lock their users into their platforms.
Other concern
The other relevant concern regarding ecosystems relates to concentrating power within a few big companies, while smaller players get either marginalized or acquired. This year, I have seen some discussion about Proton in relation to this. In recent years, Proton has been buying smaller privacy companies off the market, which has made some people concerned.
Others have suggested that Proton should also acquire Ente, since its service is arguably the best there is if you want an end-to-end encrypted, open source, and cross-platform photos alternative to Google or Apple Photos. However, I don’t think this is a good idea. While it certainly would be convenient for Proton users to get access to all these great privacy services with just a single subscription, the competition would suffer if one big company bought off all of their smaller competitors.
What should you do?
For most people, ecosystems could be a potential option, but I would also make sure you can export your data in case you ever want to leave. What’s great about Proton’s ecosystem is its cross-platform nature, so almost all of their apps work on every platform, which gives you some freedom already, when compared to a situation where you were in Apple’s ecosystem.
However, I would also encourage you to look beyond the big names. Maybe you could use Tuta instead of Proton for your email and calendar, and Bitwarden is still an excellent password manager. Ente Photos blows Proton’s similar offering out of the water, and in the VPN space, Mullvad has been introducing innovative privacy features, while Proton has focused on less interesting things, such as improving their streaming support.
Ultimately, people shouldn’t dismiss ecosystems outright because this question connects to everyone’s personal threat model, so only you can decide if ecosystems are a good fit for you or not. But whatever you choose, remember to secure your account well. 🌔