Proton
Empowering you to choose a better internet where privacy is the default. Protect yourself online with Proton Mail, Proton VPN, Proton Calendar, Proton Drive. Proton Pass and SimpleLogin.
Proton Mail is the world's largest secure email provider. Swiss, end-to-end encrypted, private, and free.
Proton VPN is the world’s only open-source, publicly audited, unlimited and free VPN. Swiss-based, no-ads, and no-logs.
Proton Calendar is the world's first end-to-end encrypted calendar that allows you to keep your life private.
Proton Drive is a free end-to-end encrypted cloud storage that allows you to securely backup and share your files. It's open source, publicly audited, and Swiss-based.
Proton Pass Proton Pass is a free and open-source password manager which brings a higher level of security with rigorous end-to-end encryption of all data (including usernames, URLs, notes, and more) and email alias support.
SimpleLogin lets you send and receive emails anonymously via easily-generated unique email aliases.
view the rest of the comments
I've been using Proton pass for about a week and it's okay so far.
Importing passwords from another manager is pretty easy, except that it can only be done from the browser extension. I had to dig out my laptop to import my passwords which was kind of annoying since I rarely use it.
Proton Pass also doesn't work great on mobile, it rarely recongnizes username fields in my browser. This means I have to manually copy/paste my username and password from the app to the browser to login, which is annoying.
I really like that Pass automatically generates a private email address for each website, but I'm not sure how useful that is in terms of privacy because I still have to get things shipped with my real name and address.
Another nitpick I have is using the same password for my email to also secure all of my passwords and generate my TOTP for 2FA. If my Proton password gets compromised then all of my passwords, my 2FA, and my email are compromised. Seems like a pretty serious security risk, but I'd really appreciate it if someone who knows more about security could explain to me why this is actually okay.
Not sure if I qualify for that, but just logically, there's only really a difference if you are not planning on storing your email password in your password manager anyway. If you do that, it doesn't really matter that you have the same password for both, since if your password manager is compromised, your email is just as compromised.
But, and it's a big "but", that's assuming you're using a cloud-based password manager that only requires a single master password to get into. My point of reference here is 1Password, where that's not enough - you also need a device with which you have logged in before, or you need your long, unmemorable Secret Key in addition to your password. You cannot log into 1Password on a new device with just your master password, the way that it appears to be possible with Proton.
Personally I don't use 2fa in my password manager unless it's something I don't care too much about securing because of everything you said. I use bitwarden but they offer the same service. My boss uses it and I can't understand why he would trust one password to secure literally everything. Seems too easy to hack compared to keeping 2fa separate.