Anonymous
My feedback
162 results found
-
13 votesAnonymous
supported this idea
·
-
20 votesAnonymous
supported this idea
·
-
30 votesAnonymous
supported this idea
·
-
31 votesAnonymous
supported this idea
·
-
45 votesAnonymous
supported this idea
·
-
47 votesAnonymous
supported this idea
·
-
76 votesAnonymous
supported this idea
·
-
165 votesAnonymous
supported this idea
·
-
208 votesAnonymous
supported this idea
·
-
678 votesAnonymous
supported this idea
·
-
2,741 votes
An error occurred while saving the comment Anonymous
supported this idea
·
-
2 votesAnonymous
shared this idea
·
-
4 votesAnonymous
supported this idea
·
-
330 votesAnonymous
supported this idea
·
-
428 votesAnonymous
supported this idea
·
-
445 votesAnonymous
supported this idea
·
-
1,253 votesAnonymous
supported this idea
·
-
2 votesAnonymous
shared this idea
·
-
339 votes
An error occurred while saving the comment Anonymous
commented
This is a bad idea. The point about Pass and Authenticator being separate is to isolate 2FA Token from your passwords. If a bad actor manages to access your Pass vault today they will have access to all passwords and 2FA Token saved in Pass. So for that reason you don't store your most critical accounts' 2FA Tokens in Pass but in Authenticator--if a bad actor does get in to your Pass vault they will only have your passwords and not your 2FA Tokens stored on Authenticator.
Of course, there is another issue that Proton has not yet fixed. If today, you turn on Proton account sync in Authenticator and someone does manage to get into your Proton account, for example by abusing an emergency contact or getting their hands on your recovey passphrase, they can in affect download your synced 2FA Tokens onto their own Authenticator instance. This is because Proton does not isolate any synced 2FA Tokens from your Pass’ security plane--this should really be fixed--but until then do not enable Proton Account sync in Authenticator IMO.
-
1,824 votesAnonymous
supported this idea
·
As a security-conscious Proton user with a unified subscription (including Mail, Calendar, Drive, and Pass),
I want the option to permanently and cryptographically split my Proton Pass credentials and identity from the rest of the Proton ecosystem,
So that even if my primary Proton account (Mail/Calendar) is fully compromised, or if its emergency recovery credentials and passphrases are abused, my Proton Pass vault remains entirely isolated, uncompromised, and inaccessible to the attacker.
So basically
Unified Proton Account (Credential A) ---> (Permanent Split Rule)*
(Credential A) ---> [Mail / Calendar / Drive]
(Credential B) ---> [Pass]*
where * == tokenized billing link
so you end up with a single unified billing but clean isolation between Pass and the rest of the Proton ecosystem. In this scenario the user can for example continue to use the same username across Pass and the rest of the Proton ecosystem but where they differ in terms of the password required, or if the user wishes can select a different username for Pass as well and it will also still be linked from a billing perspective using the tokenized billing link. Additional benefit is then Pass users will also get the other ask they have, and that is to have a true username for login instead of a email address.