• sudneo@lemm.ee
    link
    fedilink
    English
    arrow-up
    9
    arrow-down
    1
    ·
    4 months ago

    You can use your own GPG key (https://proton.me/support/importing-openpgp-private-key or using the bridge), whatever tool does the signing needs the key (duh) so I am not sure what you mean by “they store your private key” (they stored it encrypted as per documentation https://proton.me/support/how-is-the-private-key-stored), their AI was specifically designed as local, exactly to be privacy friendly, plus is a feature that can be disabled (when it will reach general subscriptions).

    I don’t care about cyptocurrencies, but I suppose they started with the most popular, nothing to do with privacy as they just let you store your currencies.

    Anyway, use what you like the most, of course, but yours don’t look very solid motivations, quite a lot of incorrect information, I hope you didn’t take your decision based on it.

    • asudox@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      arrow-down
      1
      ·
      edit-2
      4 months ago

      You upload your private key to the cloud. Encrypted or not, this is a bad idea. No thanks. I can do the signing locally and then I’ll do the decryption with my own private key locally without them storing it as well.

      Edit: mixed public keys with private keys

      • sudneo@lemm.ee
        link
        fedilink
        English
        arrow-up
        6
        ·
        4 months ago

        You upload your private key to the cloud. Encrypted or not, this is a bad idea.

        An encrypted key is a useless blob. What matters is the decryption key for that key, which is your password (or a key derived from it, I assume), which is client side.

        They can do the signing and encryption with my public key

        They can’t sign with your public key. Signing is done using your private one, otherwise nobody can verify the signature.

        Either way:

        and then I’ll do the decryption with my own private key locally without them storing it.

        You can do it using the bridge, exactly like you would with any client-side tooling.