10 ms·

Proton announces Proton Pass, a password manager

119 points by hubraumhugo 4y ago

nokya 4y ago
Although the company has good credit in terms of developing secure services, the idea of putting my passwords, my VPN and my emails in the same basket doesn't align well with my threat model. I'll stick to KeePassxc.
avinoth 4y ago
While I like players such as Proton entering the Password manager space, I hope they don't lose focus with the multitudes of products. What I liked about Proton was the simplicity on just one product and executing it well, but lately they've kept on adding new products some in their wheelhouse and aligns well (VPN for example), but some a stretch (Drive/Calendar).
- AssertErNullNPE 4y ago
  I feel like drive and calendar go with e-mail fairly naturally. The play seems to be giving people willing to pay for a google alternative everything they'd want to replace. They can't give them everything but, encrypted storage feels like a fairly simple thing to provide and calendars are a well trod problem space. Overall though, I agree with you. Proton seems like a solid company with good offerings and it would be a shame if they lost quality in their core offerings for the sake of adding features.
- vr46 4y ago
  Only their mail product was vaguely good, but became very outdated as the years went on. I liked Proton VPN but ultimately ditched the whole in favour of better value, better UX, more features.
  - theaudacityofyw 4y ago
    Curious what mail you switched to? The only competitor from what I can see to proton mail is probs tutanota.
- devnullbrain 4y ago
  New products were part of the original Indiegogo fundraising. This has always been the plan.
timetraveller26 4y ago
This will probably conflict with the linux pass utility in google results, though not much to do there since it's such a generic name.
- broodbucket 4y ago
  Both proton and pass are things I use every day on Linux, naming things is just hard and it only gets harder as more projects come along.
  - yjftsjthsd-h 4y ago
    Sure, but this is for the same exact thing. It's easier to distinguish between proton the online service and proton the runtime, compared to pass the password manager and pass the password manager.
hammyhavoc 4y ago
With how Proton handled the French climate activist debacle, who is going to trust this over pretty much any alternative if they're concerned about privacy or security?
- brianjking 4y ago
  Any tl/dr available?
  - hammyhavoc 4y ago
    The general gist is that any legal, above board company providing privacy-oriented services is subject to the laws of where they operate, ergo, if privacy and security is something that matters to you, don't trust a third-party because they will want to stay in business. They received a court order, they cooperated with the police, for better or worse (I have zero opinion on it; frankly don't care), and handed over a customer's IP, which led to the arrest of the activist. The problems that Proton is trying to solve, e.g., email, are better taken care of by other tools depending on a user's threat model. Likewise, if someone actually needs privacy and security because their life is on the line in an oppressive regime, utilizing a service like Proton's is a shit idea.
    - protonmail 4y ago
      That's why we published a threat model that goes over what Proton Mail can and cannot protect against: https://proton.me/blog/protonmail-threat-model https://proton.me/blog/protonmail-threat-model.
      - hammyhavoc 4y ago
        It's hard to take it seriously when you invoke an XKCD comic in threat model documentation. It isn't cute. Anybody receiving sensitive information via email is doing email wrong. Email in and of itself is not fit for purpose as anything but a means of notification that something needs their attention on x, hence banks tell you to login to read a sensitive notification, hence the government tell you to login to the web portal to read a message.
drcongo 4y ago
Can we update the link to the actual site [0] for the product? It has, obviously, an awful lot less spyware than TechCrunch. [0] https://proton.me/pass https://proton.me/pass
dist-epoch 4y ago
Every time I read about Proton I remember about that time CIA/BND created a fake crypto company in Switzerland because the country was perceived as neutral and used it to sell backdoored crypto equipment. https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG As a rule, never depend on only one company for all your opsec. Use different companies for you mail/VPN/password manager/antivirus/...
- cyclecount 4y ago
  Crypto AG wasn't a fake crypto company; it was a real crypto company selling a product with a CIA/BND backdoor. Proton makes open-source alternatives to big tech spyware and provides the service with a freemium model. Not sure what the comparison you're trying to make here is; they're both headquartered in Switzerland?
  - dist-epoch 4y ago
    > Proton makes open-source alternatives to big tech spyware Can you link to the open-source repository for this password manager?
    - boomboomsubban 4y ago
      >Like all Proton services, Proton Pass will be open source upon release. https://proton.me/blog/proton-pass-security-model https://proton.me/blog/proton-pass-security-model So the beta isn't free software, but the release will be? I don't understand why you'd do that, surely the beta is when you most want people to try and break things, but the rest of their products do seem to be in their repos so it doesn't seem like a completely bullshit claim. https://github.com/ProtonMail https://github.com/ProtonMail
      - hammyhavoc 4y ago
        Unless something has changed, Proton's "open source" doesn't include the servers themselves, only the clients. Whereas if you really wanted an open source server-based password manager, you could use VaultWarden with BitWarden clients, or one of countless other options. At this point, people are spoiled for choice.
drcongo 4y ago
I hope it's good enough to finally ditch 1Password.
- hammyhavoc 4y ago
  Why not Vaultwarden?
  - smcleod 4y ago
    Isn't that another electron "app"?
  - tommiegannert 4y ago
    (Another user) I've been trying to switch from Keeweb, and Vaultwarden is extremely keyboard-unfriendly in comparison. Perhaps the normal user only use it for auto-completing web forms using a browser extension, but I feel it's actively painful to use the web interface.
    - hammyhavoc 4y ago
      Have you tried the desktop application? (I haven't, but there is one, which is assumedly better) If not, Bitwarden clients are open source, might be worth raising a feature request or offering someone a few bucks to implement what you want to see if you can't DIY. With my particular use case, I don't auto-fill as that's a security vuln waiting to happen.
    - itsbenweeks 4y ago
      Curious why you're looking to switch from KeeWeb. Been using KeeWeb for several years and have been really happy with it for my desktop.
      - tommiegannert 4y ago
        I'm looking for something with integrated storage that enables emergency delegation and securely sharing of passwords within the family.
jacooper 4y ago
> Like every other Proton service, Proton Pass will be open source and publicly auditable upon launch, so anyone can independently verify our security features and their implementation. I doubt its going to include sever side code like bitwarden. But I pay for proton and I'm happy to switch if their product can fully compete.
- amanzi 4y ago
  Genuine question - how is it useful for them to release the server-side code? How do you know for sure that the code they have released is the same as what they are running? Having the server code would be useful for self-hosting, but if you're relying on Proton to host the code for you, then you have to have a certain level of trust with them regardless.
  - jacooper 4y ago
    Yes mainly for self-hosting, other than that you are going to need trust them for managed hosting, but proton has a solid track record here so far.
devnullbrain 4y ago
As a Proton Unlimited subscriber & general supporter of the company: I don't care who it is hosting it, I don't want my password manager connected to the internet. There is cognitive dissonance when this community that distrusts IoT, call-home LLMs, URL bars that send data to Google and 5G-connected vehicles is willing to connect their most critical private data to a single, profit-seeking source-of-failure. The password generation and encryption is an easy, solved problem that you can get for free! For any of these services, you're only paying for the UI, backup and internet connectivity. Companies have failed at this before and will fail again.
- Mindwipe 4y ago
  Yep. If they had built a fully local solution then that would be interesting. If I'm not hosting it then it isn't.
- webstrand 4y ago
  How do you sync your password manager between computers, out of curiosity? Most people put that file online somewhere they can copy it to other computers. Or is the ad-hoc nature of this usage a defense? I use KeepassXC though, I'm still not terribly confident that I haven't lost data from forgetting to merge another modified database before overwriting it.
  - orev 4y ago
    CodeBook allows peer to peer syncing over your local WiFi network. It’s a great password manager and works on desktop and mobile.
    - malermeister 4y ago
      I feel like I can't trust a password manager that's not open source.
      - orev 4y ago
        They make and use SQLCipher, an OSS extension to SQLite. The whole thing isn’t OSS, but it’s also not completely proprietary either.
cryptoegorophy 4y ago
You only needed to lose trust once and you did it. Can’t trust proton anymore.
jagermo 4y ago
i really hope its passphrase generation is on par with bitwarden. I'm not going back to a nonsense password generator, i hate typing these into other devices. Give me CorrectB4tteryStapleHorse! or no deal. edit: i really like that they leverate simple login, that might be a reason to switch.
- sph 4y ago
  Wait, I'm AFK so I can't check, but you can configure Bitwarden to generate pass-words instead of random strings?? I need to set that up then.
  - sebiandev 4y ago
    You can, can also change the parameters of the passphrase. Makes it much easier to type manually, I use passphrases for breakglass/admin accounts.
- Y_Y 4y ago
  Ideally you shouldn't be looking at the actual contents of your passwords! All my passwords are long and, apart from my password manager which requires my devices and 2fa token, I won't log into any of them by typing a password.
  - yjftsjthsd-h 4y ago
    I like line-noise passwords for most things, but I prefer random words (diceware style) for places a password manager doesn't work, which conveniently tends to be less sensitive anyways - if I'm entering a password into a TV one letter at a time on a remote that's not really meant for it, I prefer a friendlier password, but I also don't care if my Netflix password has as many bits of entropy as something important.
  - jagermo 4y ago
    Ideally, yes. Bit if you need to type the Netflix password on your TV, it's simpler to look at it than trying to install a password manager.
efitz 4y ago
I have been a user of Proton since shortly after crowdfunding. I kick myself regularly for not buying a lifetime subscription. I’m a Proton fan mainly for one reason - assuming that they aren’t a CIA company with back doors, my government must get a warrant to access my data there. This is my right and is recognized in the fourth amendment but increasingly my government chooses to ignore it. I am simply reasserting my rights. Before I used Proton I used Hushmail for the same reason but they gave up years ago on innovation, and Canada is practically a totalitarian state nowadays anyway so I don’t trust them anymore.
bigbacaloa 4y ago
Now you can give the NSA all your passwords at the click of a button!
lucabs 4y ago
[dead]
e12e 4y ago
Upstream source/information: https://proton.me/blog/proton-pass-security-model https://proton.me/blog/proton-pass-security-model https://proton.me/blog/proton-pass-beta https://proton.me/blog/proton-pass-beta From their existing github, i expect they will only open up the client part, unlike bitwarden.
Y_Y 4y ago
I currently use Firefox for passwords, this syncs nicely between desktops and despite their awkward killing of Lockwise it still works adequately for logging in to Android apps. I don't see any compelling reason for me to switch here even though I already pay for proton mail.
computerfriend 4y ago
Great, another password manager called "pass".
stockhorn 4y ago
I'm happy subscriber of protonmail and proton calendar. Those are products which provide some value to me, that other products can't (end-to-end encryted, privacy-first, ....). I would like to see other apps such as proton contacts or proton notes, that provide the same values. However, I'm not sure if we need another password manager, there are so many already that propose exactly the values listed above...
varjolintu 4y ago
From https://proton.me/blog/proton-pass-beta https://proton.me/blog/proton-pass-beta: "Proton Pass is also one of the first password managers to include a fully integrated two-factor authenticator (2FA) and supports 2FA autofill." Highly doubt that. There are already multiple password managers with the feature.
- layer8 4y ago
  “One of the first” doesn’t exclude multiple precedents.
AwaAwa 4y ago
Another cloud based password security solution. The cloud is as reliable as the weather. Fairly reliable for the next 24 hours, until it isn't. Because gremlins. This is the reason I have to migrate away from 1password this year, what with manifest v2 deprecation and them abandoning personal vaults.
deleted 4y ago
[deleted]

119 points by hubraumhugo 4y ago

Although the company has good credit in terms of developing secure services, the idea of putting my passwords, my VPN and my emails in the same basket doesn't align well with my threat model. I'll stick to KeePassxc.

avinoth 4y ago

While I like players such as Proton entering the Password manager space, I hope they don't lose focus with the multitudes of products. What I liked about Proton was the simplicity on just one product and executing it well, but lately they've kept on adding new products some in their wheelhouse and aligns well (VPN for example), but some a stretch (Drive/Calendar).

AssertErNullNPE 4y ago
I feel like drive and calendar go with e-mail fairly naturally. The play seems to be giving people willing to pay for a google alternative everything they'd want to replace. They can't give them everything but, encrypted storage feels like a fairly simple thing to provide and calendars are a well trod problem space. Overall though, I agree with you. Proton seems like a solid company with good offerings and it would be a shame if they lost quality in their core offerings for the sake of adding features.
vr46 4y ago
Only their mail product was vaguely good, but became very outdated as the years went on. I liked Proton VPN but ultimately ditched the whole in favour of better value, better UX, more features.
- theaudacityofyw 4y ago
  Curious what mail you switched to? The only competitor from what I can see to proton mail is probs tutanota.
devnullbrain 4y ago
New products were part of the original Indiegogo fundraising. This has always been the plan.

timetraveller26 4y ago

This will probably conflict with the linux pass utility in google results, though not much to do there since it's such a generic name.

broodbucket 4y ago
Both proton and pass are things I use every day on Linux, naming things is just hard and it only gets harder as more projects come along.
- yjftsjthsd-h 4y ago
  Sure, but this is for the same exact thing. It's easier to distinguish between proton the online service and proton the runtime, compared to pass the password manager and pass the password manager.

hammyhavoc 4y ago

With how Proton handled the French climate activist debacle, who is going to trust this over pretty much any alternative if they're concerned about privacy or security?

brianjking 4y ago
Any tl/dr available?
- hammyhavoc 4y ago
  The general gist is that any legal, above board company providing privacy-oriented services is subject to the laws of where they operate, ergo, if privacy and security is something that matters to you, don't trust a third-party because they will want to stay in business. They received a court order, they cooperated with the police, for better or worse (I have zero opinion on it; frankly don't care), and handed over a customer's IP, which led to the arrest of the activist. The problems that Proton is trying to solve, e.g., email, are better taken care of by other tools depending on a user's threat model. Likewise, if someone actually needs privacy and security because their life is on the line in an oppressive regime, utilizing a service like Proton's is a shit idea.
  - protonmail 4y ago
    That's why we published a threat model that goes over what Proton Mail can and cannot protect against: https://proton.me/blog/protonmail-threat-model https://proton.me/blog/protonmail-threat-model.
    - hammyhavoc 4y ago
      It's hard to take it seriously when you invoke an XKCD comic in threat model documentation. It isn't cute. Anybody receiving sensitive information via email is doing email wrong. Email in and of itself is not fit for purpose as anything but a means of notification that something needs their attention on x, hence banks tell you to login to read a sensitive notification, hence the government tell you to login to the web portal to read a message.

drcongo 4y ago

Can we update the link to the actual site [0] for the product? It has, obviously, an awful lot less spyware than TechCrunch. [0] https://proton.me/pass https://proton.me/pass

dist-epoch 4y ago

Every time I read about Proton I remember about that time CIA/BND created a fake crypto company in Switzerland because the country was perceived as neutral and used it to sell backdoored crypto equipment. https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG As a rule, never depend on only one company for all your opsec. Use different companies for you mail/VPN/password manager/antivirus/...

cyclecount 4y ago
Crypto AG wasn't a fake crypto company; it was a real crypto company selling a product with a CIA/BND backdoor. Proton makes open-source alternatives to big tech spyware and provides the service with a freemium model. Not sure what the comparison you're trying to make here is; they're both headquartered in Switzerland?
- dist-epoch 4y ago
  > Proton makes open-source alternatives to big tech spyware Can you link to the open-source repository for this password manager?
  - boomboomsubban 4y ago
    >Like all Proton services, Proton Pass will be open source upon release. https://proton.me/blog/proton-pass-security-model https://proton.me/blog/proton-pass-security-model So the beta isn't free software, but the release will be? I don't understand why you'd do that, surely the beta is when you most want people to try and break things, but the rest of their products do seem to be in their repos so it doesn't seem like a completely bullshit claim. https://github.com/ProtonMail https://github.com/ProtonMail
    - hammyhavoc 4y ago
      Unless something has changed, Proton's "open source" doesn't include the servers themselves, only the clients. Whereas if you really wanted an open source server-based password manager, you could use VaultWarden with BitWarden clients, or one of countless other options. At this point, people are spoiled for choice.

drcongo 4y ago

I hope it's good enough to finally ditch 1Password.

hammyhavoc 4y ago
Why not Vaultwarden?
- smcleod 4y ago
  Isn't that another electron "app"?
- tommiegannert 4y ago
  (Another user) I've been trying to switch from Keeweb, and Vaultwarden is extremely keyboard-unfriendly in comparison. Perhaps the normal user only use it for auto-completing web forms using a browser extension, but I feel it's actively painful to use the web interface.
  - hammyhavoc 4y ago
    Have you tried the desktop application? (I haven't, but there is one, which is assumedly better) If not, Bitwarden clients are open source, might be worth raising a feature request or offering someone a few bucks to implement what you want to see if you can't DIY. With my particular use case, I don't auto-fill as that's a security vuln waiting to happen.
  - itsbenweeks 4y ago
    Curious why you're looking to switch from KeeWeb. Been using KeeWeb for several years and have been really happy with it for my desktop.
    - tommiegannert 4y ago
      I'm looking for something with integrated storage that enables emergency delegation and securely sharing of passwords within the family.

jacooper 4y ago

> Like every other Proton service, Proton Pass will be open source and publicly auditable upon launch, so anyone can independently verify our security features and their implementation. I doubt its going to include sever side code like bitwarden. But I pay for proton and I'm happy to switch if their product can fully compete.

amanzi 4y ago
Genuine question - how is it useful for them to release the server-side code? How do you know for sure that the code they have released is the same as what they are running? Having the server code would be useful for self-hosting, but if you're relying on Proton to host the code for you, then you have to have a certain level of trust with them regardless.
- jacooper 4y ago
  Yes mainly for self-hosting, other than that you are going to need trust them for managed hosting, but proton has a solid track record here so far.

devnullbrain 4y ago

As a Proton Unlimited subscriber & general supporter of the company: I don't care who it is hosting it, I don't want my password manager connected to the internet. There is cognitive dissonance when this community that distrusts IoT, call-home LLMs, URL bars that send data to Google and 5G-connected vehicles is willing to connect their most critical private data to a single, profit-seeking source-of-failure. The password generation and encryption is an easy, solved problem that you can get for free! For any of these services, you're only paying for the UI, backup and internet connectivity. Companies have failed at this before and will fail again.

Mindwipe 4y ago
Yep. If they had built a fully local solution then that would be interesting. If I'm not hosting it then it isn't.
webstrand 4y ago
How do you sync your password manager between computers, out of curiosity? Most people put that file online somewhere they can copy it to other computers. Or is the ad-hoc nature of this usage a defense? I use KeepassXC though, I'm still not terribly confident that I haven't lost data from forgetting to merge another modified database before overwriting it.
- orev 4y ago
  CodeBook allows peer to peer syncing over your local WiFi network. It’s a great password manager and works on desktop and mobile.
  - malermeister 4y ago
    I feel like I can't trust a password manager that's not open source.
    - orev 4y ago
      They make and use SQLCipher, an OSS extension to SQLite. The whole thing isn’t OSS, but it’s also not completely proprietary either.

cryptoegorophy 4y ago

You only needed to lose trust once and you did it. Can’t trust proton anymore.

jagermo 4y ago

i really hope its passphrase generation is on par with bitwarden. I'm not going back to a nonsense password generator, i hate typing these into other devices. Give me CorrectB4tteryStapleHorse! or no deal. edit: i really like that they leverate simple login, that might be a reason to switch.

sph 4y ago
Wait, I'm AFK so I can't check, but you can configure Bitwarden to generate pass-words instead of random strings?? I need to set that up then.
- sebiandev 4y ago
  You can, can also change the parameters of the passphrase. Makes it much easier to type manually, I use passphrases for breakglass/admin accounts.
Y_Y 4y ago
Ideally you shouldn't be looking at the actual contents of your passwords! All my passwords are long and, apart from my password manager which requires my devices and 2fa token, I won't log into any of them by typing a password.
- yjftsjthsd-h 4y ago
  I like line-noise passwords for most things, but I prefer random words (diceware style) for places a password manager doesn't work, which conveniently tends to be less sensitive anyways - if I'm entering a password into a TV one letter at a time on a remote that's not really meant for it, I prefer a friendlier password, but I also don't care if my Netflix password has as many bits of entropy as something important.
- jagermo 4y ago
  Ideally, yes. Bit if you need to type the Netflix password on your TV, it's simpler to look at it than trying to install a password manager.

efitz 4y ago

I have been a user of Proton since shortly after crowdfunding. I kick myself regularly for not buying a lifetime subscription. I’m a Proton fan mainly for one reason - assuming that they aren’t a CIA company with back doors, my government must get a warrant to access my data there. This is my right and is recognized in the fourth amendment but increasingly my government chooses to ignore it. I am simply reasserting my rights. Before I used Proton I used Hushmail for the same reason but they gave up years ago on innovation, and Canada is practically a totalitarian state nowadays anyway so I don’t trust them anymore.

bigbacaloa 4y ago

Now you can give the NSA all your passwords at the click of a button!

lucabs 4y ago

[dead]

e12e 4y ago

Upstream source/information: https://proton.me/blog/proton-pass-security-model https://proton.me/blog/proton-pass-security-model https://proton.me/blog/proton-pass-beta https://proton.me/blog/proton-pass-beta From their existing github, i expect they will only open up the client part, unlike bitwarden.

Y_Y 4y ago

I currently use Firefox for passwords, this syncs nicely between desktops and despite their awkward killing of Lockwise it still works adequately for logging in to Android apps. I don't see any compelling reason for me to switch here even though I already pay for proton mail.

computerfriend 4y ago

Great, another password manager called "pass".

stockhorn 4y ago

I'm happy subscriber of protonmail and proton calendar. Those are products which provide some value to me, that other products can't (end-to-end encryted, privacy-first, ....). I would like to see other apps such as proton contacts or proton notes, that provide the same values. However, I'm not sure if we need another password manager, there are so many already that propose exactly the values listed above...

varjolintu 4y ago

From https://proton.me/blog/proton-pass-beta https://proton.me/blog/proton-pass-beta: "Proton Pass is also one of the first password managers to include a fully integrated two-factor authenticator (2FA) and supports 2FA autofill." Highly doubt that. There are already multiple password managers with the feature.

layer8 4y ago
“One of the first” doesn’t exclude multiple precedents.

AwaAwa 4y ago

Another cloud based password security solution. The cloud is as reliable as the weather. Fairly reliable for the next 24 hours, until it isn't. Because gremlins. This is the reason I have to migrate away from 1password this year, what with manifest v2 deprecation and them abandoning personal vaults.

deleted 4y ago

[deleted]