Private Gmail and Docs alternatives: Proton, Skiff, and more
fastcompany.com
fastcompany.com
If ads on Gmail are a concern, it is mentioned briefly in the article, you can get Google Workspace for yourself as a single user. It is way cheaper than the alternatives as well and after trying out Hey last year, I personally prefer Gmail.
Here is an excerpt from Google's workspace page (https://workspace.google.com/security):
> No ads, ever. Google does not collect, scan, or use your data in Google Workspace services for advertising purposes and we do not display ads in Google Workspace. We use your data to provide Google Workspace services, and for system support, such as spam filtering, virus detection, spell-checking, capacity planning, traffic routing, and the ability to search for emails and files within an individual account.
We looked at Hey and really liked it. However, they lacked a calendar and we felt training some of our less technical users would be too much effort.
We tried ProtonMail (Business account) but ran into these issues: - no shared Calendar - no way to enforce MFA - no way to enforce a password policy - no way to forward emails (except manually) so we can use Zapier - no way to help employees with password resets
In the end we just stayed with Google as we couldn’t find a competitor with matching services.
Gapps is very good. It does probably 100% of what 90% of the people need. Same for Office.
My only grip with Office is that in Android, the integration seems to be less polished than that of Google.
The advantage for Office is the family plan that for about 50~100 euros per year gives you 6 accounts. Something similar for Google Workspace will be 300~360.
And if you must have office desktop, that is the cheapest way.
It’s one of those rare products you can feel that they have been crafted with a lot of love.
Also, we're trying to move away from these “suite” type offerings that come with a ton of tools. We just want email and calendar.
Off topic: I wish Fastmail provided SSO (IdP) services. I want to move my small business over to it but lack of SSO is a blocker. I guess I’ll just continue to use it for personal.
Really appreciate you noticing my comment and responding. I really love your company for its values (and it doesn't hurt that you have the best webmail interface I've ever used ... and I've used them all).
Essentially, I have a small company of 11 employees. All remote. We have no on-premise infrastructure, cloud for everything. The vast majority of my team use: Github, Zendesk, Zoom, and Slack daily.
Whenever I hire a new employee, without SSO (and identity management), I have setup a multiple account credentials just for that single employee (and off boarding employees to deactivate access is a whole bigger issue).
It's not uncommon that an employee of mine might have 8-10 different username and passwords for all the various systems they use daily. Because of differing username or password retention policies, the usernames might be different and/or the passwords become out of synch because one provider is on a 90 day password change when another is on a 60 day password change. It's a mess and I'm sure people have sticky notes with their username/password written down just to keep up with all of their various username/passwords.
By having SSO/IdP provided by our email provider, I can eliminate all of these problems. Note: I'm not saying for you to accept SSO from a 3rd party - I'm suggesting that Fastmail be the Identity Provider (IdP) for my employees so that they can use their Fastmail (my domain) account with Github/Slack/Zendesk/etc.
Here's some SSO documentation from common 3rd party services we use.
Again, thanks so much for considering this. I would LOVE it if you became an IdP/SSO provider. Happy to answer any more questions.
EDIT: I should mention that I've looked into Okta in the past but for sites that don't support SSO, what Okta does is essentially a formfill/Lastpass like feature. Which kind of makes me uncomfortable. But if Fastmail allow SSO, Okta becomes more appealing (though not required)
EDIT2: this might be more heavy weight that you're looking for but I know at one time the gold standard for open source SSO offerings is OpenAM (it's the forked SSO offering that was from Sun back in the day and Sun at the time was the IAM leader). https://github.com/OpenIdentityPlatform/OpenAM/
[1] https://docs.github.com/en/github/authenticating-to-github/a...
[2] https://slack.com/help/articles/203772216-SAML-single-sign-o...
[3] https://support.zendesk.com/hc/en-us/articles/203663826-Sing...
We have a similar issue in terms of onboarding and offboarding - we have a rather large checklist which has migrated from Dropbox Paper to being a Notion template these days - but it still has a large set of checkboxes and we edit it at least as often as we on-and-offboard people (and try to remember to update it in between as well, if something changes).
So I'm seeing two possible requests here:
1) become an ID provider that can be used by other sites; or
2) support Okta (I've had a call with them, and we're looking into the OpenId Connect stuff and what would be involved in allowing that to mint sessions safely)
No promises on timelines of course, but we know that this is something of value to small businesses! And we'd probably use it ourselves if we had it, which is also great because dogfooding is important.
Hope more folks use you guys.
They're also based in [edit: I thought Protonmail was Russian based, but they're not]. I think that's probably worse from a country level.
Encrypted email is a bad way to do private communication - services that pretend otherwise set off alarms for me.
The main advantage of Fastmail vs. Google is that it's a separate service focused on providing you a good experience with custom domain support. The business model is not ad driven so incentives are more aligned and it lets you leave Google services.
The privacy people's faith in proton is misplaced (imo).
If your concern is with state-level actors with the ability to do mass spying on emails in transit and collection from many different providers, then no, Protonmail won't be that useful. If your concern is with someone getting access to your email archive, possibly years after the emails have been sent, then Protonmail does offer something: even if its own data storage is compromised, your emails should be secure. I suspect the latter is actually a much more common problem than the former, as we've seen with data ransoming lately.
Unfortunately, Protonmail's implementation is rather clunky. I actually would consider using a self-hosted system that did something similar: get clear-text emails, but immediately encrypt them with a key that the server doesn't have the private key for, and still allow searching and notifications in some way.
My personal approach is to treat email as public communication and to delete archives aggressively.
I recognize that this isn't something most people do.
No, they’re based in Australia. They’ve been blocked in Russia recently though.
I'm not even sure I want to check the actual content anymore.
I'd like to see this leverage decentralisation and/or open standards rather than see each of these companies building interoperable walled gardens. I think this dream is unlikely because sadly it's less obvious as an option for monetisation which, at the end of the day, is why each of these companies exist.
javascript:let i, elements = document.querySelectorAll('body *'); for (i = 0; i < elements.length; i++) { if(getComputedStyle(elements[i]).position === 'fixed' || getComputedStyle(elements[i]).position === 'sticky'){ elements[i].parentNode.removeChild(elements[i]); } }
* End to end encrypted
* Fully collaborative via CRDTs
* Mobile clients
Next Wednesday they'll have a very technical deep dive into all the inner workings https://www.meetup.com/Security-Meetup-by-SBA-Research/event...
And I believe the source is available if you care to audit it yourself!
It would be great to know if Skiff could be an alternative for folks who rely on extensions to make document creation/editing more enjoyable and accessible.
Strangely enough, the in-Google-Doc search function works just fine on Chrome.
I recognize that it sounds somewhat paranoid, but I strongly suspect this is a deliberate attempt to push people to use Chrome over other browsers.
Apple has hinted at privacy enhanced email with personal domain names. I am not sure what will happen there. I will stay a paying ProtonMail customer but I really hope iCloud+ gets more secure services.
I keep medical records and tax notes in encrypted Apple Pages documents. I think the encryption is good enough for me.
What is their trick for this?
Why haven't I done it?
Well, for one, to this day their pricing and feature structure is utterly unattractive, orders of magnitude more expensive than competitors (especially Gsuite/Google Workspace and Microsoft 365) and thoroughly confusing.
Some examples:
- Want to put your whole family on the "visionary plan" (~$350/year)? Tough luck, it's limited to 6 users, so your wife's parents are out.
- No multi-user support in tiers below "Professional", i.e. a family of 7 (incl. e.g. grandma) pays at least $560 per year.
- Work as a consultant, juggling several projects or startups? Tough luck, 2 custom domains and 5 measly aliases included only, even on the professional plan (~$90/user)! Also a mere 5 GB of storage. Google offered twice that 10 years ago and currently 3x - for free. Google's paid accounts include up to 2 TB (!) at that price point. As for the custom domains, on my private Gsuite I currently run about 10 without problem plus and at least fifty aliases (I make new ones for many services I sign up for, my #1 spam-avoidance trick). Even if I wanted, I couldn't switch without losing a ton of functionality, security and convenience. Getting most of this in Protonmail would probably cost me an eye-watering additional ~$360 - per user!
What on earth is their value proposition? Switzerland + encryption, okay, all well and good. Happy to pay some extra money for that. But not more than 10 times the amount a user costs on Google Workspace.
They also have no discounts, let alone free accounts for EDU or NGOs which makes it hard very hard to convince any of these orgs to switch there seeing as they get a lot more value from Google Workspace or Microsoft 365, completely for free - and these companies know that people will be more likely to privately sign up for Gmail, Office etc. if they use it at work or at school all day.
Bottom-line, I've longed for a service like Protonmail for almost half a decade now but at least the people and companies I work with don't want to pay close to what they're asking and are not willing to be nickel-and-dimed for something trivial like aliases, a catch-all address or a reasonable amount of storage (2 TB would cost ~$21,500 per year on Protonmail, according to their published price list!!).
From statements of their management I suspect that they're trying to manage (and limit) growth and thus have positioned their product in a way that makes it a premium/high-end offer, certainly without the goal of getting "everyone" to switch to them. The price and feature/addon policy makes it extremely difficult to convince anybody to switch for whom privacy and encryption is "nice to have" but not worth $$$.
I am a bit frustrated by this and have been for a long time.
Here's to hoping that a competitor appears and offers a more attractive bundle. Or that they finally get together a growth plan or funding that allows them to reduce costs and scale to more customers quickly.
It probably would be more precise to say the price points of Protonmail's tiers are not competitive. Sure, Google can offer cheaper prices due to exploitation of data (even though on Gsuite Business and EDU plans they claim not to mine the data). But I find it difficult to believe that Google (on average) pulls a value of $21,500 out of every 2 TB of data stored on their servers (maybe I'm wrong).
I'm not saying Protonmail (or any other viable competitor offering security and full encryption) needs to beat Google, MS etc. on pricing. People are willing to pay a (sensible) premium for that. Just not 5 or 10 times. Probably not even double. But a 30%-50% markup (with feature parity!) sounds absolutely fair.
I can only say that personally, I just found it impossible over the years - even though I really tried multiple times - to "sell" Protonmail's offering to clients. It always failed, ultimately, because of the pricing structure and the "nickel-and-diming". Their plans are just not attractive or convincing at all, from multiple angles, that's it.