Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proton Pass: Open-Source and Encrypted Password Manager App

proton.me

Post reply on HN
Print view View original

71–80 of 114 posts

Re: Proton Pass: Open-Source and Encrypted Password Manager App

#71

Post by josephcsible »

rmorey wrote: post #70
jacooper wrote: post #53

Earlier quoted context omitted.

Yup, for proton open source means client code only

I tend to think this is a fair trade-off for services like this because: 1) for end-to-end encrypted services, I think what you most want to verify is: is my data actually being encrypted with my keys before being sent over the network, which open-source clients allow you to do 2) you can't personally verify what code is running on a company's servers anyway and to a lesser extent: 3) there could be legitimate securi…

> there could be legitimate security reasons to keep server code confidential

If this is ever the case, it means the server code has been written in a horribly vulnerable way and you should never use it.

Re: Proton Pass: Open-Source and Encrypted Password Manager App

#73

Post by gregmac »

selykg wrote: post #17
GoofballJones wrote: post #10

I know it may be nitpicking or just pedantic, but they say on their page "Your data also never goes to the cloud, as we own and manage our own server infrastructure." But...if you upload your data to their servers (so it can go to all your devices), isn't that the "cloud"?

I think you're conflating "cloud" to mean any computer on the internet. I think that's generally a fine thing to do most of the time. But, cloud used to mean something a little different and it's been lost to weird arguments it seems. I look at the cloud as something I can spin up a new service or VM very quickly. Think AWS, or Azure or whatever other service lets you quickly and easily deploy something. We've now go…

> I think you're conflating "cloud" to mean any computer on the internet.

If you read "cloud" as "somebody else's computer" it entirely depends on perspective.

If you're running a service on your own hardware in your own datacenter, you're clearly not cloud.

However, if you're a user of that same service, and your data lives on some computers that are running in someone else's data center, then for all intents and purposes your data is "in the cloud". It's indistinguishable if the service you're using is using AWS/Azure/etc, running their own hardware, and/or storing data on something like S3.

There's of course a mix of in between stuff that makes this 10x more complicated: if it's a rented server in somebody else's datacenter, are you "cloud" or not? What if it's your hardware, but somebody else's datacenter? What if you store backups on S3?

Re: Proton Pass: Open-Source and Encrypted Password Manager App

#74

Post by rmorey »

josephcsible wrote: post #71
rmorey wrote: post #70

Earlier quoted context omitted.

I tend to think this is a fair trade-off for services like this because: 1) for end-to-end encrypted services, I think what you most want to verify is: is my data actually being encrypted with my keys before being sent over the network, which open-source clients allow you to do 2) you can't personally verify what code is running on a company's servers anyway and to a lesser extent: 3) there could be legitimate securi…

> there could be legitimate security reasons to keep server code confidential If this is ever the case, it means the server code has been written in a horribly vulnerable way and you should never use it.

Yeah you're probably right

Re: Proton Pass: Open-Source and Encrypted Password Manager App

#75

Post by neltnerb »

protonmail wrote: post #69
neltnerb wrote: post #3

It's amazing how many new products Proton manages to make while still barely supporting their VPN on Linux. On the one hand, nice work proton team. On the other, you lost a VPN customer today.

We appreciate your feedback. We wanted to let you know we're currently working on a new app. In general, the Linux app does lack features in comparison to our Windows application, this has to do mainly with 1) the fact that the Linux team is quite small compared to the window team and 2) the linux team is quite recent. Differently than the other platforms, Linux is an extremely fragmented OS. To support it means supp…

Thank you for the comment! I truly wish you all the best, I've been a customer since you started. But not a VPN customer anymore.

You might suggest your support team repeat what you said rather than an endless loop of submitting logs with no timeline for a fix or obvious intent to release one at all. In lieu of any other information or even meaningful acknowledgement of the problem, I gave up and switched to mullvad. I waited three years for this to work right and your comment is the first I've heard that there is even a Linux team working on it.

I'm using the most recent Ubuntu LTS version recently reinstalled with no other customization to the network configuration. This shouldn't be a hard target to make work. And to be clear, this is two different Ubuntu desktops with different CPU vendors manufactured seven years apart. Maybe it's just me but when I get the same issues over clean reinstalls of the OS over multiple years and multiple computers using one of the most popular distributions...

I dunno, but releasing (at least three!) new offerings while I'm sitting here for years sending bug reports sends a message about priorities.

They didn't even feel it was worth mentioning that there is an alpha to test! So bad!

Re: Proton Pass: Open-Source and Encrypted Password Manager App

#77

Post by renaudg »

josephcsible wrote: post #71
rmorey wrote: post #70

Earlier quoted context omitted.

I tend to think this is a fair trade-off for services like this because: 1) for end-to-end encrypted services, I think what you most want to verify is: is my data actually being encrypted with my keys before being sent over the network, which open-source clients allow you to do 2) you can't personally verify what code is running on a company's servers anyway and to a lesser extent: 3) there could be legitimate securi…

> there could be legitimate security reasons to keep server code confidential If this is ever the case, it means the server code has been written in a horribly vulnerable way and you should never use it.

Not necessarily : defense in depth is a thing.

Re: Proton Pass: Open-Source and Encrypted Password Manager App

#80

Post by kenmacd »

Correct me if I'm wrong, but I suspect this has the same issue preventing me from using it as does Bitwarden, namely: if I give you my vault and my password, you can access all my passwords.

With how common hardware security keys (or even just tpm2) are these days this limitation seems inexcusable to me. Which is why I'll stick with gopass/pass using my yubikey (w/ touch policy fixed). You might hack my machine and trick me in to decrypting a few passwords, but at least you won't make off with them all.

Post reply on HN