I don’t really get the “all eggs in one basket” problem with Proton Pass / Proton Auth.
Am I wrong in thinking that it depends on the specific service?
Some services are very hard to migrate and have a lot of vendor lock-in.
For example, your e-mail address (if not using a custom domain) cannot be changed overnight, and it will probably take years to move everything over. Think carefully about where you put your e-mail!
I understand that cloud storage, especially when using non-standard formats for online collaboration, such as GSuite or Proton Docs, is also hard to move to a different provider. When choosing such an option, think carefully of how hard it will be to migrate away. Have a plan.
But switching between Bitwarden and Proton Pass is at most an hour of work. How is that problematic? Both apps store data locally so they continue to work when the provider’s servers are offline.
Yes, Bitwarden has a self-host option with Vaultwarden, Proton Pass does not. So if you want to start using that, just export from Proton Pass and Proton Auth, import to Vaultwarden, sign in on your devices, and done. I don’t see the problem of using Proton Pass.
Up voted you because you’re asking valid questions and you are prompting people to give you and others solid advice, and thus you deserve visibility, as well as the answers given to your questions.
I hate it when people down vote valid and interesting questions. It’s so stupid.
Am I wrong in thinking that it depends on the specific service?
Yes. The concern is that if your account for your password manager is compromised, your passwords and 2FA tokens are both compromised. Whereas if you kept your 2FA in a different account, only your passwords are compromised. All services work this way. Proton has suggested creating a second account for your 2FA codes, even though it violates their own ToS.
For example, your e-mail address (if not using a custom domain) cannot be changed overnight, and it will probably take years to move everything over. Think carefully about where you put your e-mail!
That’s why I tell everyone I know to get their own domain. Not just for email, but for a variety of things. If nothing else, I run a Linkstack that has all of my personal information, so when people ask me for it, I send them there, and let them contact me however they wish. I’ve actually managed to get it to the top of the Google search results somehow so people can just Google me and easily find it as well. It grants you a whole lot of autonomy over your digital identity.
Changing your email host is just a matter of a simple DNS config change. When I changed from Google it was indeed a nightmare. Several companies I realized don’t even have mechanisms to change your email address because it is actually your identity in their system. I had to delete my account and open a new one. They had no other mechanism. Which is absurd. Other companies would send some things to my new email and other (important) things would continue to be sent to my old email, for reasons no one would explain to me. They are simply not technologically equipped to handle this sort of change. All in all it took about a year before I was comfortable deleting my Google account.
I understand the concern of having 2FA and Password vault under 1 account. This creates a single factor to access everything and is indeed a security risk.
I should have been clearer, but what I meant is: “Why is the use of Proton Pass considered problematic, with the reason ‘dont put all eggs in one basket’?”
I just realized it’s because of the same thing: mail is used as MFA too.
I think the argument is that if at some point Proton services get compromised, or if Proton somehow turn into the bad guys, then using fewer of their services will impact you less or give you more time to react. The same goes for any other vendor, of course, which is why the way you address this is by spreading your trust across different services/regions/owners/…
I think it’s entirely illogical. Likely, they were burned before, and cautious about using anything under one name ever again, even though the circumstances are slightly but substantially different in Proton vs (for example) Google.
If by not using proton you’ll have to switch services less, or it’ll somehow make switching services easier in the future, sure. But I don’t see any reason to believe that
I don’t really get the “all eggs in one basket” problem with Proton Pass / Proton Auth.
Am I wrong in thinking that it depends on the specific service?
Some services are very hard to migrate and have a lot of vendor lock-in. For example, your e-mail address (if not using a custom domain) cannot be changed overnight, and it will probably take years to move everything over. Think carefully about where you put your e-mail!
I understand that cloud storage, especially when using non-standard formats for online collaboration, such as GSuite or Proton Docs, is also hard to move to a different provider. When choosing such an option, think carefully of how hard it will be to migrate away. Have a plan.
But switching between Bitwarden and Proton Pass is at most an hour of work. How is that problematic? Both apps store data locally so they continue to work when the provider’s servers are offline.
Yes, Bitwarden has a self-host option with Vaultwarden, Proton Pass does not. So if you want to start using that, just export from Proton Pass and Proton Auth, import to Vaultwarden, sign in on your devices, and done. I don’t see the problem of using Proton Pass.
Up voted you because you’re asking valid questions and you are prompting people to give you and others solid advice, and thus you deserve visibility, as well as the answers given to your questions.
I hate it when people down vote valid and interesting questions. It’s so stupid.
Thank you. I know most people agree and I’m missing something so my explanation of my current POV is basically me asking to be corrected on this.
Was a bit disappointed with the downvotes but I could have seen it coming when explaining my unpopular position.
Thank you for your understanding and for promoting dialogue
You get it. Promoting dialogue. Very good way of putting it. 🫶
Yes. The concern is that if your account for your password manager is compromised, your passwords and 2FA tokens are both compromised. Whereas if you kept your 2FA in a different account, only your passwords are compromised. All services work this way. Proton has suggested creating a second account for your 2FA codes, even though it violates their own ToS.
That’s why I tell everyone I know to get their own domain. Not just for email, but for a variety of things. If nothing else, I run a Linkstack that has all of my personal information, so when people ask me for it, I send them there, and let them contact me however they wish. I’ve actually managed to get it to the top of the Google search results somehow so people can just Google me and easily find it as well. It grants you a whole lot of autonomy over your digital identity.
Changing your email host is just a matter of a simple DNS config change. When I changed from Google it was indeed a nightmare. Several companies I realized don’t even have mechanisms to change your email address because it is actually your identity in their system. I had to delete my account and open a new one. They had no other mechanism. Which is absurd. Other companies would send some things to my new email and other (important) things would continue to be sent to my old email, for reasons no one would explain to me. They are simply not technologically equipped to handle this sort of change. All in all it took about a year before I was comfortable deleting my Google account.
Thank you for your reply!
I understand the concern of having 2FA and Password vault under 1 account. This creates a single factor to access everything and is indeed a security risk.
I should have been clearer, but what I meant is: “Why is the use of Proton Pass considered problematic, with the reason ‘dont put all eggs in one basket’?”
I just realized it’s because of the same thing: mail is used as MFA too.
Proton Pass specifically, is not problematic. The problematic part is just having both passwords and TOTP keys in the same vault (basket).
I think the argument is that if at some point Proton services get compromised, or if Proton somehow turn into the bad guys, then using fewer of their services will impact you less or give you more time to react. The same goes for any other vendor, of course, which is why the way you address this is by spreading your trust across different services/regions/owners/…
They have already one collaborated with courts to provide access to emails of an activist which helped the French state to convict them.
I think it’s entirely illogical. Likely, they were burned before, and cautious about using anything under one name ever again, even though the circumstances are slightly but substantially different in Proton vs (for example) Google.
If by not using proton you’ll have to switch services less, or it’ll somehow make switching services easier in the future, sure. But I don’t see any reason to believe that