I have Proton Unlimited and honestly, I wouldn’t know what to say about SimpleLogin even though I indirectly use it since I have an email for each account and the domains don’t end in Proton, but rather things like passmail .com and passinbox .com.
It takes me 10 seconds to create an email for a new account and that’s it.
If you already use Proton Mail and pay for SimpleLogin, you could switch to Proton Unlimited and have both since Proton uses SimpleLogin for aliases.
Whatever choice you make, SimpleLogin has had many security audits and is considered by many to be a solid service, so you can rest easy on that front.
800 accounts are indeed a lot. You can simply start by migrating the most important ones, like personal email, banks, social media, and anything else you deem important to protect.
The list should reduce to a few dozen. The rest you can do over time, whether it’s weeks or months.
If you have a common threat model and aren’t at risk of losing your life, it’s not a problem. The world of digital privacy is infinite, and there’s nothing wrong with not doing everything at once.
It’s possible that some accounts are no longer useful, so you might be able to delete them.
Most of us have accounts made years ago but forgotten or otherwise unused.
The motivation isn’t always there, but it’s better to at least care about the important ones rather than to think about how many accounts you have and do nothing.
You can make as many backups of your password managers’s vault as you want; they’re simple to make and import back into an account, even an external one (both offline and online).
For example, let’s say you lose access to your Bitwarden account, but you had a backup of the vault.
Just put it on another account, even with a free tier, and if they were unencrypted you’ll have zero problems.
Of course, an encrypted vault isn’t exactly ideal, but if you really want to be 100% sure, you can have an unencrypted copy on a Veracrypt-encrypted drive.
In that case, you still have solid encryption. Regarding how to remember the password or ideally the passphrase of the password manager, there’s a guide by Privacy Guides.
It’s designed to have a passphrase that’s easy to remember but hard to crack, a single password to protect all the others.
If you don’t feel like remembering a passphrase at first, you can still use a phrase you remember that’s 25-30 characters long.
Less optimal, but better than potentially abandoning password managers.
So, about the potential increase of attack surface. This isn’t an issue exclusive to aliases; any client like Gmail and Proton is affected.
The real problem, as always, is protecting your accounts well through solid email clients like Proton and Tuta, having good passwords, and using 2FA like authentication apps and security keys like YubiKey or using passkeys.
If an attacker gets into your Proton account you could have trouble, just like with SimpleLogin, Gmail, and so on.
Regarding documents, it depends on what you want to do. There are secure online drives that care about privacy, like Proton Drive, and Privacy Guides has an article on this.
This is an example of an important account to prioritize. Use a good password and solid 2FA as mentioned above.
Regarding losing them, the advice, as already mentioned, is to use the 3-2-1 rule.
Three copies of the backup, on two different media, and one off-site.
Make regular backups (like once a month) on a flash drive, external SSD and HDD, whatever you have, and a cloud or a physical copy not at your home.
It may seem like a hassle at first, but you can start simply by making a single backup on a physical device and uploading it to Proton Drive, so you already have two extra copies.
After that, doing it once a month becomes a habit and shouldn’t take much time. There’s a yt video of Explaining Computers called “Data Backup: The 3-2-1 rule.”
It’s a bit old, but still relevant. Obviously you could view or read something else about it.
The same classic advice applies to photos and documents: protect your devices well with good passwords, disk encryption on PCs, the usual general advice on protecting personal devices, which I won’t go into detail here.
You can find them here, from Techlore, on the EFF website, on Naomi Brockwell’s channel, and so on.
Regarding AI training, I wouldn’t upload photos, at least not personal or sensitive ones, to clouds like Google Drive.
I’d keep them on my personal devices, locally or on privacy-respecting clouds, and here I’d add Ente Photos.
Preferably, I wouldn’t upload sensitive content on the internet or on social media and keep them to mysel and not sending them in general. That way, you should have avoided many hassles.
Regarding PII, I’d also cite the sources mentioned above (like Privacy Guides and EFF).
To name a few, disk encryption on PCs, using VPNs, browsers like Brave, using sites only in HTTPS or forcing them with the browser, avoiding unprotected public Wi-Fi.
Use encrypted messengers like Signal (even WhatsApp is better than nothing), minimize personal information published on social media and the internet.
Use as many privacy-respecting services as possible, even using Linux and android distributions like GrapheneOS helps a lot.
Online, if you’re not using your public identity, try not to share personal information, don’t use your real name, and try to be as anonymous as possible.
There are many things you can do. The term “can” is important. You can do them tomorrow or next week calmly; no one is chasing you.
You can prioritize certain things if you think your threat model requires it more and do (if you want) the other things at another time.
(probably not a big improvement on privacy, but a small step I want to do).