Live data from Hacker News

Proton Pass: Open-Source and Encrypted Password Manager App

proton.me

81–90 of 114 posts

Re: Proton Pass: Open-Source and Encrypted Password Manager App

#81

I know it may be nitpicking or just pedantic, but they say on their page "Your data also never goes to the cloud, as we own and manage our own server infrastructure." But...if you upload your data to their servers (so it can go to all your devices), isn't that the "cloud"?

Not nitpicky at all, they are having the cake, and eating it too with that phrasing. Cloud, colloquially, is data or software being "on the internet".

https://www.merriam-webster.com/dictionary/cloud%20computing

Re: Proton Pass: Open-Source and Encrypted Password Manager App

#82
post #3

It's amazing how many new products Proton manages to make while still barely supporting their VPN on Linux. On the one hand, nice work proton team. On the other, you lost a VPN customer today.

Just a thought, maybe their linux market share is just negligible? If it's not a worthwhile investment of resources, why do it?

Wow, I triggered a lot of linux folks. It was just a curious question. And I have another thought, not gonna answer all of you, sorry:

Wouldn't $linuxuser just not simply install something like keypass w/o having to pay for anything? How many services/apps is the average linux user paying for?

I have used linux for ages before I moved to maco. So my bet is: not much. Why then, as a company, would I try to get people to give me money when they are used to getting stuff for free? And would rather tinker with some half-arsed solution (on average) instead of paying $5 per month?

Maybe sentiment has shifted since I was around. Maybe it was the Arch crowd. But my impression was: "I want it free as in free beer and open".

Re: Proton Pass: Open-Source and Encrypted Password Manager App

#83

I know it may be nitpicking or just pedantic, but they say on their page "Your data also never goes to the cloud, as we own and manage our own server infrastructure." But...if you upload your data to their servers (so it can go to all your devices), isn't that the "cloud"?

I think in general one might consider "the cloud" to be virtual resources on hardware shared with third parties. So of course AWS/GCP/Azure, but DigitalOcean would probably also qualify since to my knowledge droplets are virtual servers on shared hardware. Although renting virtual resources on shared hardware can be convenient (much easier to provision virtual resources than real servers), there are a couple of drawb…

Yes, this is indeed what we mean. Proton does not use third-party providers for hosting encrypted user data. So none of the providers that people typically consider to be "cloud" such as AWS. What we do instead is own and operate all of our physical server hardware and network equipment in datacenters in Switzerland and Germany.

Re: Proton Pass: Open-Source and Encrypted Password Manager App

#84
post #46

With Bitwarden supporting passkeys soon[0] is there any announcement from Proton that they would as well? Seems odd to release a password manager at this time and not mention at least eventually supporting WebAuth/FIDO2/passwordless. 1Password, Google, Apple, and likely Microsoft are all going to be having some level of passkey management. For middle of 2023, it seems like at least a good feature to mention is going…

PassKey support is indeed coming to Proton Pass.

Re: Proton Pass: Open-Source and Encrypted Password Manager App

#85
post #79

My main concerns are - Can I host / store my own vaults? Are the apps native (not electron)? What are the browser plugins like with autofill of secrets, identity, payment information etc…?

Currently vaults are online but end-to-end encrypted. Apps are native (not electron), and there are extensions for most major browsers.

Re: Proton Pass: Open-Source and Encrypted Password Manager App

#88
post #40

Wasn't there some article or something claiming that this company was a NSA honeypot or something? Or am I imagining that.

You might be thinking of https://encryp.ch/blog/disturbing-facts-about-protonmail/ edit: I'd like to inject a reminder that protonmail doesn't encrypt all of your mailbox contents. From their privacy policy: "we have access to the following email metadata: sender and recipient email addresses, the IP address incoming messages originated from, attachment name, message subject, and message sent and received times"

The CIA/NSA claims are quite easily debunked: https://www.reddit.com/r/ProtonMail/comments/14demhj/debunki...

Re: Proton Pass: Open-Source and Encrypted Password Manager App

#89

No no local syncing so my password data never has to touch a computer I don't own? Pass, uninteresting product.

Proton Pass is end-to-end encrypted, but indeed if you want something that doesn't support automatic multi-device sync and is 100% local, then Proton Pass is not the right fit for this use case.

Re: Proton Pass: Open-Source and Encrypted Password Manager App

#90

It grinds my gears when password managers bundle 2FA/MFA without pointing out how this weakens the security of it, or discussing mitigations. "Proton Pass makes 2FA easier with an integrated authenticator that stores your 2FA codes and automatically displays and autofills them." Is it really multiple factor auth if you're using the same device for the password and automatically filling in the token? It's not a unique…

It's really no different to having say, a password manager, and Google authenticator both installed on the phone. At that point, you might as well combine both into a single app for more convenience. And if you don't want both on your phone, then either you don't use 2FA or don't use a password manager, both of which probably leave you worse off.

Btw, the thing you mention for Proton Drive is only for files which are shared publicly. For sure the audit results are not perfect when viewed in isolation, but when compared to other password managers, it's another story.

Post reply on HN