I’m curious: How is Cryptomator better/worse than running rclone with client-side encryption?

I’d asked a similar question. Basically, the response I got was: if the something goes sideways, the community can hard fork all their clients and use vaultwarden as a server (their current licenses would allow that).

Another suggestion was that you can always use the web ui bundled with vaultwarden directly (heh, I’ve been using vaultwarden for years and I don’t think I ever used the web ui - just the applications, CLI, browser extension).

They’re two sides of the same coin. Can’t have privacy without security and can’t have security without privacy.

Hmmm… I half agree with what you said. The corner stone of most security is an element of initial trust.

With SSL, we’re trusting that the certificate authority is valid.

With tools like GPG, I (as the sender) are trusting that the key I’m using to sign a message is really yours.

With Android we (the users) and the application developers are trusting Google (hence why “sideloading” is now “bad”, because Google says it is).

I absolutely agree that privacy cannot exist without security. But, your privacy is dependent on who your security model trusts.

I don’t trust Google with my privacy (hence, I degoogle) , but my bank app doesn’t trust my security (hence, the app can only be installed via Google Play).

So, privacy is dependent on security, but security is built on trust.

I do use a (modded) version of graphene as a daily driver and I do appreciate many of the features that it offer.

And I totally agree that some people seem to try to turn graphene into some rigid cult (especially on the philosophy of running root and “who decides how application backup should be made? The application developer or the device/data owner”)

That said:

the idea that the only way I can not get assraped on the reg is to give a shitload of money to google and then use this elitist OS is something I have a gigantic problem with.

There is actually a technical reason for this. Pixel phones are the only ones to support custom AvB keys.

Basically, this allows you (or graphene) to create a key, which can be used to sign your custom firmware. So, you can have a locked bootloader that will only allow OS updates signed with your key.

You can basically create your own OTA updates. It’s fantastic.

It’s amazing and disappointing that most phone manufacturers don’t allow custom AvB keys, but it’s a reflection of how they truly don’t care about people who like to tinker.

Now, should the lack of custom AvB keys be a barrier towards using graphene? Tbh, I don’t think so - but it does fit the graphene rigid MO of “root is bad”.

edit : fixed link

is it worth it?

I’ll try to be objective.

The Pros:

1. Graphene gives you more “control” over your data “out of the box” than any other custom firmware. Yes, you can patch and mod your favorite firmware to your liking, but graphene “just works”
2. It’s rock solid and reliable. It only supports one hardware family. I’ve never had graphene lock-up, crash, camera stop working, etc
3. The installation and upgrading is amazingly easy (compared to other cfw) and streamlined. After the initial setup, it behaves just like any ofw.
4. You’ll see just how much of an intrusive cancer Google has become (Google play has a “feature” where they’ll dynamically load code and try to run it - graphene blocks this kinda crap).
5. Going back to stock Google (with locked bootloader) is rather easy. So you don’t have much to lose (other than a few hours) in trying.

The Cons:

1. Some apps will crash. Graphene hardens how applications behave (in terms of accessing memory, for example) some apps are buggy and will not work. Not many apps (may 1 or 2 out of 30+) but it does happen and you can fittle with the app settings to try to fix it, but it’s tedious through trial-and-error
2. Some apps won’t work, like maybe your bank because it will never pass the “Google integrity” checks. The fear and concern is that more and more apps will start to block cfw. So expect that you might need a second device.
3. Any apps/processes that deal with money (tap-to-pay, Google wallet) probably will not work (again, it fails the “Google integrity” checks).
4. (personal preference) I don’t like the graphene launcher nor their store nor their (boring) default icons. However, graphene empowers you to change/replace all this.

And as far as I remember: only a hash of your password is sent. So, if the hash you sent matches something on their powned list, they’ll tell you. If it’s not on their list, then it is just a meaningless hash (your personal information was not exposed)

I use 1Password at work. It pretty much ticks your boxes. With 1Password, a collection of passwords are referred to as a vault.

• you can share passwords, either permanently or temporarily (and even with people outside of your company).
• vaults can be shared with people in your company (so you just add all your secrets to the vault)
• by default each person get a “personal vault”, which is not shareable (but you can temporarily share secrets in the vault, if you want too).
• nobody can read the content unless you share it with them (or one of your client apps gets exploited)

As the OP mentioned, it “just works” with everything.

My only gripes with it is that it’s a bit cumbersome to log into the website (you basically have two passwords, plus mfa)… but if you’ve got the browser extension installed, it’s painless. The other gripe I have is, it’s tricky to have an overview of what passwords/vaults already exist. So, if you have enough people, it’s inevitable that passwords will be accidentally duplicated - and no one will have a clear idea what was duplicated and who has access to it (unless you’re a member/owner of a vault).

You mentioned you wanted something “hands-off”, I think that after the initial setup, you’d get just that.