10 ms·
Proton Pass: Open-Source and Encrypted Password Manager App
- dotcoma 3y agoSaw this some time ago. Any advantages over, say, Bitwarden ?
- WhackyIdeas 3y agoThe main advantage is that it can also set up an ‘alias’ which is a pseudo email address which forwards to your real email address. Really, I think the alias feature should be added into protonmail and removed from proton pass. Bitwarden UI has the edge though, imo.
- LelouBil 3y agoBitwarden can also do this, and supports multiple providers
- ibdf 3y agoWow. I have been with Bitwarden for a few years and never new this was an option.
- c0wb0yc0d3r 3y agohttps://bitwarden.com/help/generator/#username-types https://bitwarden.com/help/generator/#username-types
- esdf 3y agoIf you are paying for Pass Plus or Proton Unlimited then you have integrated 2FA/TOTP which Bitwarden also makes you pay for, same with Yubikey/FIDO2/etc 2-step login, which I think is possible for signing into proton pass. And no desktop app for proton pass, maybe some day though?
- neltnerb 3y agoIt's amazing how many new products Proton manages to make while still barely supporting their VPN on Linux. On the one hand, nice work proton team. On the other, you lost a VPN customer today.
- huijzer 3y agoIt’s okay if you use a regular OpenVPN client, but yes I agree that they could at least clarify that the Proton VPN client is broken for most Linux use-cases.
- yomlica8 3y agoHow so? I've only briefly used the client.
- neltnerb 3y ago"Logical server not found" happened 132 times while out of town for two days. I also use an Ubuntu LTS pretty recently reinstalled with minimal network customization, so I guess that other person was very lucky. This happens on two different Ubuntu computers with different graphics cards and CPU vendors so I don't think I'm imagining things. If I enable the kill switch, it can convince itself there is no network connection (for itself) because of its own kill switch. I turn the kill switch off and back on and it's fine. That's ridiculous. They only support udp and tcp in their Linux app. The Android app literally has more features and stability. On the other hand, now that I've switched to mullvad everything is at least apparently fine. I've been submitting error logs to proton for years, I was one of their first customers and really really wanted them to be good. Instead they just ask me to switch between tcp and udp over and over to provide new logs despite not installing a new version. It's pathetic. And no, I don't buy the Linux market share thing when it's a VPN! Lol, it's not a video game. Their competitors seem to work great and value the Linux market. Years is enough patience, they redesigned their logo, released drive, and released this without fixing the basic issues with their existing products. I'm done trying, it's wasting so much time trying to deal with their support now that they clearly just don't care about it. So I'm done.
- olalonde 3y agoIt seems only the clients are open source? https://github.com/orgs/protonpass/repositories https://github.com/orgs/protonpass/repositories
- jacooper 3y agoYup, for proton open source means client code only
- rmorey 3y agoI tend to think this is a fair trade-off for services like this because: 1) for end-to-end encrypted services, I think what you most want to verify is: is my data actually being encrypted with my keys before being sent over the network, which open-source clients allow you to do 2) you can't personally verify what code is running on a company's servers anyway and to a lesser extent: 3) there could be legitimate security reasons to keep server code confidential 4) there could be legitimate competition reasons to keep server code confidential Overall I think it is a fine tradeoff. And of course, there is already a great "full-stack open source" password manager out there, in Bitwarden. There's an argument to be made we shouldn't call the whole thing "open source" and perhaps call it "open client" or something.
- josephcsible 3y ago> there could be legitimate security reasons to keep server code confidential If this is ever the case, it means the server code has been written in a horribly vulnerable way and you should never use it.
- GoofballJones 3y agoI know it may be nitpicking or just pedantic, but they say on their page "Your data also never goes to the cloud, as we own and manage our own server infrastructure." But...if you upload your data to their servers (so it can go to all your devices), isn't that the "cloud"?
- nerdponx 3y agoYes
- tescocles 3y agoIt depends what you mean by data. Metadata maybe, but I'd think they're meaning that once your passwords data is encrypted (on your device), it is no longer your data without the encryption key?
- selykg 3y agoI think you're conflating "cloud" to mean any computer on the internet. I think that's generally a fine thing to do most of the time. But, cloud used to mean something a little different and it's been lost to weird arguments it seems. I look at the cloud as something I can spin up a new service or VM very quickly. Think AWS, or Azure or whatever other service lets you quickly and easily deploy something. We've now gotten to the point where people are saying any computer on the internet is "the cloud" and I don't think that's right or wrong necessarily, but for the sake of Hacker News, I do wish we were a little more specific. That said, I think this argument from Proton is bordering on funny word play to make it seem different.
- RajT88 3y agoThis is a fine use case for using "cloud" to mean, "somewhere, not here". I don't feel like my passwords should be stored "somewhere, not here". They should be stored "here" - where I choose to store them, and nowhere else. I purchased a hardware password manager a while back, which seemed really neat: https://www.beamu.io/ https://www.beamu.io/ But, sure enough, bulk import uploads all of your passwords to their servers, even though there's just no rational reason why a server "somewhere, not here" needs to play man-in-the-middle to all your logins. To avoid it, you have to go one by one (even then there's no assurance, but the official docs do not say it's sent up to their servers).
- thumbuddy 3y agoWasn't there some article or something claiming that this company was a NSA honeypot or something? Or am I imagining that.
- n_ary 3y agoIf you can cite some sources, I will be very interested to read all about it. I trust Proton with most of my crucial e-mails(bank, insurance, govt services) and use a cheap alternative for personal things. If it is really a NSA honeypot, I'd rather let M$ or GOOG have my e-mails anyways.
- tough 3y agoNo real sources but hn comments, but hey if the river sounds.. https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=proton%20honeypot&sort=byPopularity&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... The NSA/CIA are just too good at hijacking swiss -neutral- companies for their own bidding
- grammers 3y agoI prefer to diversify. That's why I have Bitwarden, Tutanota, NextCloud & ProtonVPN. IMO it does not make sense to use any service from your VPN provider at the same time - it's like not using a VPN at all since they do know your real IP. No idea why this is not known to more people.
- kaba0 3y agoArguably, that’s a very bad idea from a security perspective. The possibility of your passwords leaking are 4-times now.
- the_common_man 3y agoNot if you use a sso
- thiht 3y agoBut if your Nextcloud password gets leaked, your Bitwarden is safe. Not sure what you mean?
- ngrilly 3y agoI'm a bit skeptical about having one more solution in that space, considering that 1) password managers built in OSs and web browsers are becoming better and better (for example the new version of iCloud Keychain) and 2) passkeys are coming.
- noirbot 3y ago1 there really requires you to be all-in on an ecosystem though. Have an iPhone but use Windows/Linux? Doesn't really matter how good iCloud is if you can't get it to sync your passwords easily to half of your devices. I suspect Passkeys will be a similar issue that further pushes people towards single-ecosystem life, unless I'm missing something.
- ngrilly 3y agoI agree with you, but I think a majority of users are fine with being on one ecosystem, as long as it is convenient. iCloud Keychain works on Windows and Chrome using an extension provided by Apple. It is possible to login using passkeys on another device outside of the ecosystem by using QR codes.
- noirbot 3y agoOh sure, but that's not necessarily Proton's market - that's what I'm pointing towards. There's a group of folks who are both most likely to use a password manager, and also don't necessarily want that password manager attached to their Google/MSFT/iCloud accounts.
- ngrilly 3y agoYou're right, that's a very good fit for Proton's users.
- vsskanth 3y agoDoes this reliably detect username password fields on mobile ? 1password is getting really bad on that
- microflash 3y agoSadly no. It is a hit or miss. Particularly, URL match detection is comically bad. I also despise the way the browser extension injects code in every webpage where it detects forms. There's also no way to manually trigger the autofill.
- Mindwipe 3y agoNo no local syncing so my password data never has to touch a computer I don't own? Pass, uninteresting product.
- protonmail 3y agoProton Pass is end-to-end encrypted, but indeed if you want something that doesn't support automatic multi-device sync and is 100% local, then Proton Pass is not the right fit for this use case.
- Alifatisk 3y agoAny reason for me to switch from Bitwarden?
- vidyesh 3y agoNo good reason yet (or many never). It really depends how happy you are with your current setup, Proton pass is young and clearly is still under development. A lot of the features Bitwarden or any other good password manager provides, its on the Proton pass's roadmap. So if you are happy with your setup, stick with it and no need to move to Proton pass. Maybe keep an eye and check back after few months if their offerings have changed or upgraded that is worth the effort and shifting trust. I personally would sign up as first year is free/cheap and I like proton products, although somewhat buggy they are trustworthy and worth supporting. And I am using KeePass as my password manager which is cumbersome to selfhost and manage. I am not giving up on using KeePass yet as I too will wait to see where Proton pass ends up being.
- game_the0ry 3y agoI see the ios and android clients are open source, but not the server implementation - I would not call that "open source." I am sticking with Bitwarden.
- lclc 3y agoI'd switch if they add a native Linux app. Any plans for that?
- kemotep 3y agoWith Bitwarden supporting passkeys soon[0] is there any announcement from Proton that they would as well? Seems odd to release a password manager at this time and not mention at least eventually supporting WebAuth/FIDO2/passwordless. 1Password, Google, Apple, and likely Microsoft are all going to be having some level of passkey management. For middle of 2023, it seems like at least a good feature to mention is going to be available even if the release is months out. [0]: https://bitwarden.com/passwordless-passkeys/ https://bitwarden.com/passwordless-passkeys/
- protonmail 3y agoPassKey support is indeed coming to Proton Pass.
- kemotep 3y agoThanks for the update. I will certainly keep an eye for it.
- luke-stanley 3y agoIt grinds my gears when password managers bundle 2FA/MFA without pointing out how this weakens the security of it, or discussing mitigations. "Proton Pass makes 2FA easier with an integrated authenticator that stores your 2FA codes and automatically displays and autofills them." Is it really multiple factor auth if you're using the same device for the password and automatically filling in the token? It's not a unique failure of Proton Pass but, people reading this should rightly be sceptical and this is a significant failing. When I read their audits on Proton Drive, I see that the web page claims the PDF is end-to-end encrypted. But the link with the key in the URL hash is public. It's a poor demonstration of their technology. When I see the defects that were found by the audits, it doesn't leave an amazing impression. It's great that they have an open source client and do open audits though. Claiming it's open source, does come across as hype without a server too though. Overall this is a welcome thing but it's very rough around the edges, I wouldn't feel it's a compelling offering yet with these big issues.
- cumshitpiss 3y agoNothing wrong with your second factor being the same device. The point is to combine something you know with something you own. The thing which you own can contain your passwords too.
- omniglottal 3y agoWhen the something you own contains passwords, it replaces something you know and all you are left with is one factor: the device.
- shawnz 3y ago> Is it really multiple factor auth if you're using the same device for the password and automatically filling in the token? Yes, the two factors are having the device with the password database on it, and knowing the unlock code for the database or being the biometrically identified owner
- luke-stanley 3y ago
- ryspc 3y agoHow can something be called "open-source" when you can't self-host it?
- balu_ 3y agofurther more, does anyone see the source anywhere? -edit it seems parts of it are on github https://github.com/orgs/protonpass/repositories https://github.com/orgs/protonpass/repositories
- josephcsible 3y agoThe client is open-source but the server isn't.
- mpeg 3y agoIs this available on proton for business too?
- protonmail 3y agoYes, it is included for free in the business plan.
- dovholuknf 3y agoI will stay with Bitwarden too, but it does look nice. I appreciate the design look/feel.
- smcleod 3y agoMy main concerns are - Can I host / store my own vaults? Are the apps native (not electron)? What are the browser plugins like with autofill of secrets, identity, payment information etc…?
- protonmail 3y agoCurrently vaults are online but end-to-end encrypted. Apps are native (not electron), and there are extensions for most major browsers.
- kenmacd 3y agoCorrect me if I'm wrong, but I suspect this has the same issue preventing me from using it as does Bitwarden, namely: if I give you my vault and my password, you can access all my passwords. With how common hardware security keys (or even just tpm2) are these days this limitation seems inexcusable to me. Which is why I'll stick with gopass/pass using my yubikey (w/ touch policy fixed). You might hack my machine and trick me in to decrypting a few passwords, but at least you won't make off with them all.
- binary132 3y agoAll I really want is GNU Pass with an IPFS backend.
- kup0 3y agoWould like to see web/desktop clients for this. When I used it recently I found the unexpandable pop-up overlay in the browser to not be adequate for managing my hundreds of logins- it just felt annoying to be confined to such a small "window"- also would like to see along with that more options for managing items in batches (select multiple and move to another vault, etc). EDIT: Credit cards are available. Somehow I missed that! Might have gotten released in the time since I tried it which hasn't been long at all...
- cquintana92 3y agoCredit cards are supported and available already!
- kup0 3y agoOh, wow. Edited my original post. Thanks for the clarification. I think it wasn't available when I signed up, as far as I could tell, so maybe it was just added recently (or I just completely missed it...)
- mdaniel 3y agoI see the dupe process is working just fine here; I look forward to someone stumbling upon this next week and resubmitting it then, too
- WentFullRetard 3y ago[dead]