A Proton Pass login option for biometrics or extra password rather than device PIN.
The setting that enables biometrics with a fallback to device PIN seems to be a weakness to me as you can force the biometrics to fail and device PIN can be weak. I suggest that if an extra password has been added that an option to fallback to that rather than device PIN should be available.
This problem is on a Mac. I see that on mobile devices you can turn off the fallback to PIN and it will force a re-login.
Tony Shirley
shared this idea
-
s.c.
commented
100%. Can't believe this has been open for almost a year without being fixed. It's a major security weakness.
When the Security Settings > Unlock with option is set to "Biometrics", the Proton Pass app should not offer to use "Password" as a fallback. If Touch ID doesn't work or fails, it should require the Proton Pass Account or Extra Password to unlock to Proton Pass, it should not fall back to the macOS User Account password to permit access. The Proton Pass app should not use .deviceOwnerAuthentication as a policy to avoid macOS falling back to the macOS login password instead of the user’s Proton Account Password or Proton Pass Extra Password. Instead the app should utilise .deviceOwnerAuthenticationWithBiometrics.
-
Anonymous
commented
This option needs to be added to the desktop app. Frankly I am astounded this isn't the default. There should be no way to access your proton pass app simply by entering your iphone pin or mac password. One of the main reasons I switched away from apple passwords was precisely this security flaw.
-
Steven
commented
If biometric/faceID authentication fails, require the Proton Pass password (+ optional extra password) instead of the device PIN. This improves security if a device is stolen and the PIN is compromised. 1Password already supports this.