Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proton announces Proton Pass, a password manager

techcrunch.com

Post reply on HN
Print view View original

71–80 of 94 posts

Re: Proton announces Proton Pass, a password manager

#71

Post by lcnPylGDnU4H9OF »

webstrand wrote: post #44
devnullbrain wrote: post #25

As a Proton Unlimited subscriber & general supporter of the company: I don't care who it is hosting it, I don't want my password manager connected to the internet. There is cognitive dissonance when this community that distrusts IoT, call-home LLMs, URL bars that send data to Google and 5G-connected vehicles is willing to connect their most critical private data to a single, profit-seeking source-of-failure. The pass…

How do you sync your password manager between computers, out of curiosity? Most people put that file online somewhere they can copy it to other computers. Or is the ad-hoc nature of this usage a defense? I use KeepassXC though, I'm still not terribly confident that I haven't lost data from forgetting to merge another modified database before overwriting it.

> is the ad-hoc nature of this usage a defense?

In a way, actually. If I use a self-hosted service for hosting the file and keep it open only to myself, then someone who wants that file is targeting me specifically. That's not something I'm particularly worried about. (Obviously someone worrying about that might reconsider this as a line of defense.)

Re: Proton announces Proton Pass, a password manager

#72

Post by devnullbrain »

ementally wrote: post #54
devnullbrain wrote: post #25

As a Proton Unlimited subscriber & general supporter of the company: I don't care who it is hosting it, I don't want my password manager connected to the internet. There is cognitive dissonance when this community that distrusts IoT, call-home LLMs, URL bars that send data to Google and 5G-connected vehicles is willing to connect their most critical private data to a single, profit-seeking source-of-failure. The pass…

https://old.reddit.com/r/ProtonPass/comments/12su1vq/proton_... They claim that using it as cloud service prevents brute force.

I would consider a targeted attack to be less of a risk than a systemic attack on a password manager provider. Local invasive vs. remote non-invasive.

Re: Proton announces Proton Pass, a password manager

#73

Post by yjftsjthsd-h »

Y_Y wrote: post #63
jagermo wrote: post #35

i really hope its passphrase generation is on par with bitwarden. I'm not going back to a nonsense password generator, i hate typing these into other devices. Give me CorrectB4tteryStapleHorse! or no deal. edit: i really like that they leverate simple login, that might be a reason to switch.

Ideally you shouldn't be looking at the actual contents of your passwords! All my passwords are long and, apart from my password manager which requires my devices and 2fa token, I won't log into any of them by typing a password.

I like line-noise passwords for most things, but I prefer random words (diceware style) for places a password manager doesn't work, which conveniently tends to be less sensitive anyways - if I'm entering a password into a TV one letter at a time on a remote that's not really meant for it, I prefer a friendlier password, but I also don't care if my Netflix password has as many bits of entropy as something important.

Re: Proton announces Proton Pass, a password manager

#74

Post by itsbenweeks »

tommiegannert wrote: post #21
hammyhavoc wrote: post #12

Earlier quoted context omitted.

Why not Vaultwarden?

(Another user) I've been trying to switch from Keeweb, and Vaultwarden is extremely keyboard-unfriendly in comparison. Perhaps the normal user only use it for auto-completing web forms using a browser extension, but I feel it's actively painful to use the web interface.

Curious why you're looking to switch from KeeWeb. Been using KeeWeb for several years and have been really happy with it for my desktop.

Re: Proton announces Proton Pass, a password manager

#75

Post by stockhorn »

I'm happy subscriber of protonmail and proton calendar. Those are products which provide some value to me, that other products can't (end-to-end encryted, privacy-first, ....).

I would like to see other apps such as proton contacts or proton notes, that provide the same values.

However, I'm not sure if we need another password manager, there are so many already that propose exactly the values listed above...

Re: Proton announces Proton Pass, a password manager

#76

Post by malermeister »

orev wrote: post #65
webstrand wrote: post #44

Earlier quoted context omitted.

How do you sync your password manager between computers, out of curiosity? Most people put that file online somewhere they can copy it to other computers. Or is the ad-hoc nature of this usage a defense? I use KeepassXC though, I'm still not terribly confident that I haven't lost data from forgetting to merge another modified database before overwriting it.

CodeBook allows peer to peer syncing over your local WiFi network. It’s a great password manager and works on desktop and mobile.

I feel like I can't trust a password manager that's not open source.

Re: Proton announces Proton Pass, a password manager

#77

Post by orev »

malermeister wrote: post #76
orev wrote: post #65

Earlier quoted context omitted.

CodeBook allows peer to peer syncing over your local WiFi network. It’s a great password manager and works on desktop and mobile.

I feel like I can't trust a password manager that's not open source.

They make and use SQLCipher, an OSS extension to SQLite. The whole thing isn’t OSS, but it’s also not completely proprietary either.

Re: Proton announces Proton Pass, a password manager

#78

Post by lazyeye »

hammyhavoc wrote: post #67
boomboomsubban wrote: post #39

Earlier quoted context omitted.

>Like all Proton services, Proton Pass will be open source upon release. https://proton.me/blog/proton-pass-security-model So the beta isn't free software, but the release will be? I don't understand why you'd do that, surely the beta is when you most want people to try and break things, but the rest of their products do seem to be in their repos so it doesn't seem like a completely bullshit claim. https://github.com…

Unless something has changed, Proton's "open source" doesn't include the servers themselves, only the clients. Whereas if you really wanted an open source server-based password manager, you could use VaultWarden with BitWarden clients, or one of countless other options. At this point, people are spoiled for choice.

I dont understand.

How does releasing an open-source version prove their production code doesnt have a backdoor in it?

Re: Proton announces Proton Pass, a password manager

#79

Post by varjolintu »

From https://proton.me/blog/proton-pass-beta:

"Proton Pass is also one of the first password managers to include a fully integrated two-factor authenticator (2FA) and supports 2FA autofill."

Highly doubt that. There are already multiple password managers with the feature.

Re: Proton announces Proton Pass, a password manager

#80

Post by hammyhavoc »

lazyeye wrote: post #78
hammyhavoc wrote: post #67

Earlier quoted context omitted.

Unless something has changed, Proton's "open source" doesn't include the servers themselves, only the clients. Whereas if you really wanted an open source server-based password manager, you could use VaultWarden with BitWarden clients, or one of countless other options. At this point, people are spoiled for choice.

I dont understand. How does releasing an open-source version prove their production code doesnt have a backdoor in it?

That's the thing, it doesn't. It's lip service, as is so much in the industry. It's a buzzword on the marketing materials.

Unless you compile it yourself, which in the case of the server VaultWarden (Rust implementation of a BitWarden server), you absolutely can, otherwise you cannot be sure you can trust it.

Post reply on HN