How to manage 2FA for Proton account if Proton Pass is my 2FA thing? (sh.itjust.works)

submitted 11 months ago by akilou@sh.itjust.works to c/protonprivacy@lemmy.world

10 comments fedilink hide all child comments

I'm migrating the handful of accounts that I have 2FA set up in from using Authy to using Proton Pass. But I'm stuck on my Proton account itself. Should I keep Authy just for my Proton account and then once I'm in, I can use Pass for the rest of the 2FAs?

What do you do?

all 13 comments

sorted by: hot top controversial new old

[-] governorkeagan 13 points 11 months ago* (last edited 11 months ago)

It’s recommended to keep your Proton 2FA separate from Proton Pass. I think they wrote a blog post about it, I’ll link it here if I find it

Edit:

Please note that you should never use Proton Pass to secure your Proton Account using TOTP. Use a third-party authenticator app instead.

https://proton.me/support/pass-2fa

[-] barcaxavi@lemmy.world 4 points 11 months ago

Not an answer to your question, just another one connected to it: Is using the same software for storing passwords and 2FA beating the whole purpose of 2FA in some way? For example if someone can get a hold of your proton account somehow, there's no additional layer of security provided by the 2FA.

[-] akilou@sh.itjust.works 2 points 11 months ago

I thought the same thing which is why I'm only switching over now. I switched one account just as a test, but I liked being able to access it from the browser. Maybe it's less secure but only if someone gets my Proton account itself, which is protected by 2fa in a different app.

[-] barcaxavi@lemmy.world 1 points 11 months ago* (last edited 11 months ago)

Understandable. I'm also struggling sometimes to find the right balance between comfort and security/privacy.

[-] bamboo@lemm.ee 1 points 11 months ago

Yes and no. You’re correct that if someone compromises your proton account, the 2fa does nothing. But in the other hand, if someone were to acquire your credentials some other way, they may still only have the username and password, and maybe the time-dependent 2fa code. So I would argue it’s better than no 2fa but somewhat inferior to using a separately authenticated 2fa app/device.

[-] randombullet@feddit.de 2 points 11 months ago

I actually use a YubiKey (WebAuth)for my password manager. But I also have my OTPs in Aegis that's locally backed up.

this post was submitted on 28 Nov 2023

16 points (100.0% liked)

Proton

5275 readers

13 users here now

Empowering you to choose a better internet where privacy is the default. Protect yourself online with Proton Mail, Proton VPN, Proton Calendar, Proton Drive. Proton Pass and SimpleLogin.

Proton Mail is the world's largest secure email provider. Swiss, end-to-end encrypted, private, and free.

Proton VPN is the world’s only open-source, publicly audited, unlimited and free VPN. Swiss-based, no-ads, and no-logs.

Proton Calendar is the world's first end-to-end encrypted calendar that allows you to keep your life private.

Proton Drive is a free end-to-end encrypted cloud storage that allows you to securely backup and share your files. It's open source, publicly audited, and Swiss-based.

Proton Pass Proton Pass is a free and open-source password manager which brings a higher level of security with rigorous end-to-end encryption of all data (including usernames, URLs, notes, and more) and email alias support.

SimpleLogin lets you send and receive emails anonymously via easily-generated unique email aliases.

founded 1 year ago

MODERATORS

ProtonPrivacy@lemmy.world

alex_herrero@lemmy.world

Nelizea@lemmy.world