There's a misconception here that Proton supports FIDO2 and they do not. The terminology is being inaccurately used. They only support FIDO U2F. Thus far, unlike Apple, Google and Microsoft, they have yet to support genuine, passwordless FIDO2 authentication with security keys, which is the most secure authentication form ahead of FIDO U2F.

Hi Proton Team,

Can you please provide a status update on disabling authenticator app as a 2FA option?

The admin comment on this thread said that the option to disable authenticator app would be added "very soon", but it has now been over a year, and this still doesn't seem to be available.

For those of us who want to rely exclusively on passkeys/hardware security keys for 2FA, this is a pretty important security and usability issue.

Even a brief roadmap update or clarification (for example, if there are technical or policy blockers) would be greatly appreciated.

Thank you.

Definitely need this on the desktop app at least! I would prefer to use my hardware security key as a passkey for all Proton apps and go passwordless as they are inherently multi-facor!

Appreciated.
My first attempts with this feature in the first week resulted in many new pass entities, but no successful logins.
I'll try again and communicate EV. issurs appropriately.

Many thanks for this excellent feature, we have 3 sets of two keys waiting for this.

Well done!
I'll try again

I want to get away from any authenticator app for logging into Proton, my only holdback is security keys are not available to be used via Mobile

Proton apps on Android currently don't support hardware security keys as a second factor of authentication despite the Proton web applications offering this support. Please add universal support across all Proton login surfaces for hardware security keys.

I've been waiting for this for a long time.

Tutanota not only has support for Webauthn on the app (though it has its own problems), it also has a biometric lock for accessing the app. Even SimpleLogin has this. Currently if someone were to access my device, they'd have full access. Logging out each time is not convenient, I have to stay logged in. Please add this!

Protonvpn.com (even in a desktop browser) also does not support FIDO2/U2F and you have to use the TOTP app code. If they can add support for that site as well then we could ditch the TOTP app entirely.

The reason you need to have an app as well is because they don't have FIDO2 support for protonvpn.com yet. They also don't have FIDO2 support for their mobile apps. Until these are supported by FIDO2 you'd be locked out of them without the app.

They should also work on using the current gen standards for FIDO2/WebAuthn, where it prompts for a PIN upon activation of the hardware key. As someone who has keys for both work and personal, the PIN feature has kept me from using the wrong key without failing the acutal Authentication challenge on more than one occasion.

BTW a workaround i did to re institiute this keyfob requirment on platfroms that still only support TOTP is to just store the TOTP secrets on my yubikeys using the Yubico Authenticator App. Extra Few Seconds to Copy/Paste the code, and extra app to have to download, but storing the secret physicly on the keyfob maks this method of TOTP almost as secure as U2F imho.

I suppose it's for preventing user to lock out themselves since most of them only have one key. But it's still a bad configuration, it must be mandatory to use two methods for second factor.

If you have two key, then you configure them both and have a way to connect if you lose one. This should be enough and allow you to remove OTP completely.

2FA / MFA should be the accepted standard for improved security by now?! Even Amazon supports OTP by Yubikey with YubiAuthenticator. Any Phone based OTP or 2FA App is inherently unpleasant. So why not support hardware tokens or OTP without the App? I don't quite see the point of being forced to use the App to activate 2FA. Unless this has marketing reasons - but come on we're talking security here - that's why we love ProtonMail. Pretty please with sugar on top: Give us OTP and Yubikey support without the App. Thank You kindly.

Would like to see this also, it should not take an Authenticator to log in to iOS, TOTP is pretty weak security.

Not needed for the app lock feature IMO as that is only to prevent snooping by someone you pass an unlocked device to. But for authentication U2F everywhere is a must.

This is extremely important, as TOTP is significantly less secure than security keys. Since authn is only as strong as the weakest authn method, we need TOTP to go away as soon as possible.

Just like the web app, it would be good to have FIDO Security key support for the iOS app, in addition to FaceID.

Need more hardware token support. I don't want to have to use the bad you ikey authenticator "app"

Yubikey has various NFC keys that can be integrated with mobile apps on iOS (and probably android, too) for 2FA without the hassle of launching a separate app, copy and enter an OTP.
Open app, user/password, swipe yubico key, done.
That would be a very useful addition