Proton announces Proton Pass, a password manager

https://techcrunch.com/2023/04/20/proton-announces-proton-pass-a-password-manager/

by hubraumhugo • 3 years ago

119 90 3 years ago

avinoth• 3 years ago

While I like players such as Proton entering the Password manager space, I hope they don't lose focus with the multitudes of products.

What I liked about Proton was the simplicity on just one product and executing it well, but lately they've kept on adding new products some in their wheelhouse and aligns well (VPN for example), but some a stretch (Drive/Calendar).

AssertErNullNPE• 3 years ago

I feel like drive and calendar go with e-mail fairly naturally. The play seems to be giving people willing to pay for a google alternative everything they'd want to replace. They can't give them everything but, encrypted storage feels like a fairly simple thing to provide and calendars are a well trod problem space.

Overall though, I agree with you. Proton seems like a solid company with good offerings and it would be a shame if they lost quality in their core offerings for the sake of adding features.

vr46• 3 years ago

Only their mail product was vaguely good, but became very outdated as the years went on. I liked Proton VPN but ultimately ditched the whole in favour of better value, better UX, more features.

theaudacityofyw• 3 years ago

Curious what mail you switched to? The only competitor from what I can see to proton mail is probs tutanota.

devnullbrain3• 3 years ago

New products were part of the original Indiegogo fundraising. This has always been the plan.

timetraveller26• 3 years ago

This will probably conflict with the linux pass utility in google results, though not much to do there since it's such a generic name.

broodbucket• 3 years ago

Both proton and pass are things I use every day on Linux, naming things is just hard and it only gets harder as more projects come along.

yjftsjthsd-h2• 3 years ago

Sure, but this is for the same exact thing. It's easier to distinguish between proton the online service and proton the runtime, compared to pass the password manager and pass the password manager.

hammyhavoc9• 3 years ago

With how Proton handled the French climate activist debacle, who is going to trust this over pretty much any alternative if they're concerned about privacy or security?

brianjking• 3 years ago

Any tl/dr available?

hammyhavoc9• 3 years ago

The general gist is that any legal, above board company providing privacy-oriented services is subject to the laws of where they operate, ergo, if privacy and security is something that matters to you, don't trust a third-party because they will want to stay in business.

They received a court order, they cooperated with the police, for better or worse (I have zero opinion on it; frankly don't care), and handed over a customer's IP, which led to the arrest of the activist.

The problems that Proton is trying to solve, e.g., email, are better taken care of by other tools depending on a user's threat model. Likewise, if someone actually needs privacy and security because their life is on the line in an oppressive regime, utilizing a service like Proton's is a shit idea.

protonmail2• 3 years ago

Proton Pass utilizes end-to-end encryption, so not even Proton can decrypt user data, and there have been hundreds of court cases that have proven that Proton's encryption cannot be bypassed by court orders.

Proton like all law abiding companies must follow court orders. But unlike most companies, Proton actually fights in court and won a legal victory against the Swiss government after the case in question, overturning an earlier ruling that email providers can be classified as telecommunications providers. Details here: https://proton.me/blog/court-strengthens-email-privacy.

hammyhavoc9• 3 years ago

Who said anything about encryption? The problem at hand is handing over IP addresses of a customer when they themselves are peddling a supposedly privacy-oriented service. The fact remains: it isn't fit-for-purpose, and these are non-solutions to real problems for anyone who isn't just LARPing a threat model.

Replace "French climate activist" with "dissenter in an oppressive regime" and that person would be dead.

Who cares if they later won in court? They still threw someone under the bus. Trusting a third-party business who is subject to the laws of where they operate means this will always be a problem, doesn't matter if they're an email provider or a VPN operator, the solutions aren't fit for purpose.

chrismorgan• 3 years ago

Proton Pass utilizes end-to-end encryption, so not even Proton can decrypt user data

… unless they decide they want to, in which case they can, because they serve the software, and can thereby easily exfiltrate the key.

I have to keep on saying it: first-party end-to-end encryption is snake oil. https://hn.algolia.com/?query=chrismorgan+snake+oil&type=com...

It does resist casual or accidental leaking, and is even proof any form of disclosure if you have stopped using the service altogether, but is absolutely not robust against rogue employee, rogue company, legal compulsion, infiltrating attacker, &c. as long as you continue to use the service.

If you want actually valuable end-to-end encryption, start by getting your software and network services from different providers. (And avoid the web’s distribution model like the plague, and probably mobile app distribution models too.)

Mindwipe3• 3 years ago

Proton Pass utilizes end-to-end encryption, so not even Proton can decrypt user data

By default, who generates the keys?

If you are compromised and your software starts to exfiltrate the keys to a third party, how long do you think it would be before anyone noticed?

stereoradonc• 3 years ago

The "Swiss version of neutrality" is an overblown concept and carefully constructed narrative.

drcongo3• 3 years ago

Can we update the link to the actual site [0] for the product? It has, obviously, an awful lot less spyware than TechCrunch.

[0] https://proton.me/pass

dist-epoch3• 3 years ago

Every time I read about Proton I remember about that time CIA/BND created a fake crypto company in Switzerland because the country was perceived as neutral and used it to sell backdoored crypto equipment.

https://en.wikipedia.org/wiki/Crypto_AG

As a rule, never depend on only one company for all your opsec. Use different companies for you mail/VPN/password manager/antivirus/...

cyclecount• 3 years ago

Crypto AG wasn't a fake crypto company; it was a real crypto company selling a product with a CIA/BND backdoor.

Proton makes open-source alternatives to big tech spyware and provides the service with a freemium model. Not sure what the comparison you're trying to make here is; they're both headquartered in Switzerland?

dist-epoch3• 3 years ago

Proton makes open-source alternatives to big tech spyware

Can you link to the open-source repository for this password manager?

nabnob2• 3 years ago

Huh, I frequently see advice online that says to use VPNs based in countries that are not one of the "fourteen eyes"/"five eyes".

dist-epoch3• 3 years ago

Switzerland is strongly associated with EU/Western world.

The famous/traditional Switzerland bank privacy was severely weakened at US pressure.

drcongo3• 3 years ago

I hope it's good enough to finally ditch 1Password.

hammyhavoc9• 3 years ago

Why not Vaultwarden?

tommiegannert2• 3 years ago

(Another user) I've been trying to switch from Keeweb, and Vaultwarden is extremely keyboard-unfriendly in comparison. Perhaps the normal user only use it for auto-completing web forms using a browser extension, but I feel it's actively painful to use the web interface.

smcleod2• 3 years ago

Isn't that another electron "app"?

beardedwizard2• 3 years ago

Why? Why even pursue another password manager at all when they are about to be totally dead anyway...

ValentineC• 3 years ago

Would you like to explain why they are "about to be totally dead"?

16bitvoid2• 3 years ago

What's wrong with 1Password?

aareet3• 3 years ago

Version 8 has been plagued with various bugs with editing, scrolling, sync and stability issues on the Mac and iOS apps. It has become extremely difficult to rely on, and really the only path back to stability has been to downgrade to 1Password v7.

Mindwipe3• 3 years ago

Cloud only now. Non-starter.

smcleod2• 3 years ago

As of their releases from version 8 1Password went really downhill.

It's also just another electron web app and if there's one thing I don't want electron "apps" doing is storing my secrets.

They no longer support offline / non-cloud vaults and force a recurring subscription.

Beyond that it shows the kind of attitude that's present within their company now - it's all about cutting costs to sell as many recurring subscriptions to pay off their VC funding and investors.

drcongo3• 3 years ago

As mentioned by others: cloud only, buggy electron clients (and seriously how can you trust electron with passwords), aggressively hostile to their paying customers, endlessly removing features that people rely on, removing usable keyboard navigation. I could go on for days.

jacooper2• 3 years ago

Like every other Proton service, Proton Pass will be open source and publicly auditable upon launch, so anyone can independently verify our security features and their implementation.

I doubt its going to include sever side code like bitwarden. But I pay for proton and I'm happy to switch if their product can fully compete.

amanzi• 3 years ago

Genuine question - how is it useful for them to release the server-side code? How do you know for sure that the code they have released is the same as what they are running?

Having the server code would be useful for self-hosting, but if you're relying on Proton to host the code for you, then you have to have a certain level of trust with them regardless.

jacooper2• 3 years ago

Yes mainly for self-hosting, other than that you are going to need trust them for managed hosting, but proton has a solid track record here so far.

devnullbrain3• 3 years ago

As a Proton Unlimited subscriber & general supporter of the company:

I don't care who it is hosting it, I don't want my password manager connected to the internet. There is cognitive dissonance when this community that distrusts IoT, call-home LLMs, URL bars that send data to Google and 5G-connected vehicles is willing to connect their most critical private data to a single, profit-seeking source-of-failure.

The password generation and encryption is an easy, solved problem that you can get for free! For any of these services, you're only paying for the UI, backup and internet connectivity. Companies have failed at this before and will fail again.

Mindwipe3• 3 years ago

Yep. If they had built a fully local solution then that would be interesting.

If I'm not hosting it then it isn't.

webstrand• 3 years ago

How do you sync your password manager between computers, out of curiosity? Most people put that file online somewhere they can copy it to other computers. Or is the ad-hoc nature of this usage a defense?

I use KeepassXC though, I'm still not terribly confident that I haven't lost data from forgetting to merge another modified database before overwriting it.

fodmap• 3 years ago

I use Syncthing to sync KeepassXC db. It works flawlessly.

fooqux• 3 years ago

I personally use pass which out of the box uses git, meaning it's trivial to sync to as many devices as I want. And obviously merging is a solved issue there.

andrewla• 3 years ago

I can't answer for OP, but for me, I just don't. I prefer an entirely offline password manager, and that's the way I use mine (I use enpass). Except for backing up to the cloud, it does not really use the network. When I need a password, on my computer or on my phone, I look it up and transcribe it (I'm reluctant even to allow it to hook into the password autocomplete in IOS; I prefer to copy/paste because I don't really want any leak in the knowledge of where my passwords are stored).

I would actually prefer an even less feature-rich password manager. I've thought of trying to fork something like KeePass for my purposes (or use a restricted subset) but I haven't been willing to devote the time and effort necessary.

orev2• 3 years ago

CodeBook allows peer to peer syncing over your local WiFi network. It’s a great password manager and works on desktop and mobile.

lcnPylGDnU4H9OF• 3 years ago

is the ad-hoc nature of this usage a defense?

In a way, actually. If I use a self-hosted service for hosting the file and keep it open only to myself, then someone who wants that file is targeting me specifically. That's not something I'm particularly worried about. (Obviously someone worrying about that might reconsider this as a line of defense.)

ementally• 3 years ago

https://old.reddit.com/r/ProtonPass/comments/12su1vq/proton_... They claim that using it as cloud service prevents brute force.

devnullbrain3• 3 years ago

I would consider a targeted attack to be less of a risk than a systemic attack on a password manager provider. Local invasive vs. remote non-invasive.

cryptoegorophy• 3 years ago

You only needed to lose trust once and you did it. Can’t trust proton anymore.

jagermo2• 3 years ago

i really hope its passphrase generation is on par with bitwarden. I'm not going back to a nonsense password generator, i hate typing these into other devices. Give me CorrectB4tteryStapleHorse! or no deal.

edit: i really like that they leverate simple login, that might be a reason to switch.

sph• 3 years ago

Wait, I'm AFK so I can't check, but you can configure Bitwarden to generate pass-words instead of random strings??

I need to set that up then.

sebiandev• 3 years ago

You can, can also change the parameters of the passphrase. Makes it much easier to type manually, I use passphrases for breakglass/admin accounts.

Y_Y2• 3 years ago

Ideally you shouldn't be looking at the actual contents of your passwords! All my passwords are long and, apart from my password manager which requires my devices and 2fa token, I won't log into any of them by typing a password.

yjftsjthsd-h2• 3 years ago

I like line-noise passwords for most things, but I prefer random words (diceware style) for places a password manager doesn't work, which conveniently tends to be less sensitive anyways - if I'm entering a password into a TV one letter at a time on a remote that's not really meant for it, I prefer a friendlier password, but I also don't care if my Netflix password has as many bits of entropy as something important.

jagermo2• 3 years ago

Ideally, yes. Bit if you need to type the Netflix password on your TV, it's simpler to look at it than trying to install a password manager.

efitz• 3 years ago

I have been a user of Proton since shortly after crowdfunding. I kick myself regularly for not buying a lifetime subscription.

I’m a Proton fan mainly for one reason - assuming that they aren’t a CIA company with back doors, my government must get a warrant to access my data there. This is my right and is recognized in the fourth amendment but increasingly my government chooses to ignore it. I am simply reasserting my rights.

Before I used Proton I used Hushmail for the same reason but they gave up years ago on innovation, and Canada is practically a totalitarian state nowadays anyway so I don’t trust them anymore.

bigbacaloa• 3 years ago

Now you can give the NSA all your passwords at the click of a button!

e12e• 3 years ago

Upstream source/information:

https://proton.me/blog/proton-pass-security-model

https://proton.me/blog/proton-pass-beta

From their existing github, i expect they will only open up the client part, unlike bitwarden.

Y_Y2• 3 years ago

I currently use Firefox for passwords, this syncs nicely between desktops and despite their awkward killing of Lockwise it still works adequately for logging in to Android apps. I don't see any compelling reason for me to switch here even though I already pay for proton mail.

computerfriend• 3 years ago

Great, another password manager called "pass".

stockhorn• 3 years ago

I'm happy subscriber of protonmail and proton calendar. Those are products which provide some value to me, that other products can't (end-to-end encryted, privacy-first, ....).

I would like to see other apps such as proton contacts or proton notes, that provide the same values.

However, I'm not sure if we need another password manager, there are so many already that propose exactly the values listed above...

varjolintu• 3 years ago

From https://proton.me/blog/proton-pass-beta:

"Proton Pass is also one of the first password managers to include a fully integrated two-factor authenticator (2FA) and supports 2FA autofill."

Highly doubt that. There are already multiple password managers with the feature.

layer8• 3 years ago

“One of the first” doesn’t exclude multiple precedents.

AwaAwa• 3 years ago

Another cloud based password security solution. The cloud is as reliable as the weather. Fairly reliable for the next 24 hours, until it isn't. Because gremlins. This is the reason I have to migrate away from 1password this year, what with manifest v2 deprecation and them abandoning personal vaults.

nokya2• 3 years ago

Although the company has good credit in terms of developing secure services, the idea of putting my passwords, my VPN and my emails in the same basket doesn't align well with my threat model. I'll stick to KeePassxc.

Proton announces Proton Pass, a password manager

Related Stories