Enable Proton Pass Passwordless login with security key (PRF/WebAuthn)
Please allow users to login into Proton Pass via passwordless login with the option of vault decryption using the WebAuthn PRF (Pseudo-Random Function) extension. Essentially, it would be amazing if full passwordless login could be achieved, similar to some of the competitors out there. This would have very obvious security benefits.
Amber
shared this idea
-
kinopii commented
I use "Login with Passkey" and "Unlock with Passkey" feature of a competitor a ton, and it's the only blocker from switching over.
I tried Proton Pass for a while and really like it! But my Yubikey BIO is just way to convenient to let it go unused while I type in a 6 digit PIN all the time.
So I put up with the inferior UI of your competitor just to give myself a little convenience...
It doesn't need to be the sole method of recovery. In fact, I think it should just be an additional method... so if I ever lose the passkey I can just use my proton login + 2FA + Proton Pass Additional Password (if set) to get back in.
-
ProtonUser25
commented
This would be awesome. Though it should be supported on all apps.
Some competitors offer it, but then it doesn't work on all (desktop) apps, forcing the user to fallback on less secure alternatives on that OS.For the topic starter (or voter): could you describe your desired recovery path if you lose the Security Key or access to your Passkey?
How would you want to authenticate then and how would you want to decrypt the data?Since this is proton, I assume Proton's build-in recovery methods could help you authenticate again, but if PRF is used exclusively, how does one decrypt the Proton Pass vault data?
You can make up your own or pick from:
1. A long secret passphrase you had to save when enabling FIDO2+PRF.
2. A data file similar to the one for Protonmail.
3. A second Security Key you had to add when enabling FIDO2+PRF.
4. Normal Proton Password + Regular 2FA (FIDO2-U2F or OTP)*.
5. A second standby digitally frozen Passkey that needs to be defrosted first in case of emergency as described here: https://www.startpage.com/do/search?cat=web&language=english&query=passwordless+dormant+frozen+passkey+thaw&page=1(If 4 is possible, the FIDO2/WebAuthn+PRF option is an EXTENSION of login options, not an exclusive hardened option.)