• artyom@piefed.social
    link
    fedilink
    English
    arrow-up
    22
    arrow-down
    1
    ·
    edit-2
    2 days ago

    Ehhhh but they already have this in Proton Pass?

    E: found this in the FAQ

    Proton Pass is a password manager designed to securely generate and store strong passwords, and protect your digital identity with features like email alises and dark web monitoring. It also includes an integrated authenticator that can store and autofill 2FA codes - but not the ones used to log in to your Proton account. Proton Authenticator is a standalone 2FA app that allows users to enable 2FA protection for their Proton account, it also allows users to store their 2FA codes separate from their passwords if they wish to do so.

    If you already use Proton Pass, I think I’d recommend Ente Auth instead. That’s what I use.

    • BlameTheAntifa@lemmy.world
      link
      fedilink
      English
      arrow-up
      18
      ·
      2 days ago

      You really should not keep your MFA codes in the same place as your passwords, especially if you are syncing those passwords between devices and/or a cloud service.

      • artyom@piefed.social
        link
        fedilink
        English
        arrow-up
        13
        ·
        2 days ago

        Yes that’s why I said:

        If you already use Proton Pass, I think I’d recommend Ente Auth instead

        • BlameTheAntifa@lemmy.world
          link
          fedilink
          English
          arrow-up
          6
          ·
          2 days ago

          Aha. Sorry, I misunderstood. I saw the first line about Proton Pass already supporting MFA and I wasn’t familiar with Ente Auth. I did just look it up and I can’t believe I’ve never heard of it before. It’s even AGPL-3.0, be still my beating heart! Thank you for pointing it out!

          https://ente.io/ for anyone curious.

    • DZZ@lemmy.ml
      link
      fedilink
      English
      arrow-up
      2
      ·
      2 days ago

      Thank you for your comment. I was also confused initially before reading properly. I thought, ‘What? But isn’t the Proton 2FA thing paid? What do they gain by making it free?’ It seems that most people are not willing to use this new app, though. Ente, Aegis, whatever the alternative is, there doesn’t seem to be a reason to use this new authenticator from Proton instead. I wonder what their goal is here. Is it simply to expand their app ‘ecosystem’?

    • pulsewidth@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      arrow-down
      1
      ·
      2 days ago

      It is very wise to store your 2FA codes separately from your general login credentials. If one is breached, the other protects it (hence, two factor). If both are breeched, your account is hosed.

      Same deal when setting up 2FA on an account and they provide some ‘one time use’ 2FA codes, they generally say ‘do not store these with your standard password credentials - keep them secure and separate’.

      • artyom@piefed.social
        link
        fedilink
        English
        arrow-up
        10
        arrow-down
        2
        ·
        2 days ago

        Correct. However it’s worth noting that passwords are almost always compromised server-side. So 2FA is far more a mitigation of data breaches from the provider, rather than your password manager being breached.

        • pulsewidth@lemmy.world
          link
          fedilink
          English
          arrow-up
          3
          ·
          1 day ago

          Feels like everyone has forgotten when LastPass was breached, and that was barely three years ago.

          Any affected LastPass users storing their 2FA backup codes in with the rest of their login data got a rude awakening.

          Anyone who had them separate was at least able to rescue those accounts. But hey do what you like people, I know convenience usually trumps security.

          • artyom@piefed.social
            link
            fedilink
            English
            arrow-up
            1
            ·
            24 hours ago

            As far as I know, passwords and TOTP keys were never leaked by LastPass. Regardless, I did say almost always.

            • pulsewidth@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              arrow-down
              1
              ·
              edit-2
              12 hours ago

              That’s just scratching the surface. Peoples credentials are increasingly captured by information stealer malware, including attacks on Keepass. So that ‘almost always’ ain’t right regardless.

              The goal of 2FA is to be ‘something you have’ like an authenticator device or auth app on your phone, working as a secondary verifier that you are who you say you are to the ‘something you know’ being your password. So if you store 2FA codes with your password then you just have two sets of ‘something you know’ which is far less secure - and leaves you more vulnerable.

              Of course, it doesn’t matter much with stuff like a low value forum account that has 2FA, but I certainly wouldn’t put any of my banking or key account 2FA backup codes or credentials in a password manager or central account/password storage service. It defeats the purpose.