Why do you think that separating your 2FA tokens and password is better for security? I think that carrying two separate apps on the same device does not really give any security benefit and introduces friction. If your device gets compromised or if you are forced to unlock it, they will have access to everything in the device, both passwords and 2FA codes. So keeping them in separate apps introduces an inconvenience, while not really being “safer”. However, maybe I’m not thinking about every scenario so geniunly curious as to why people think they are “safer” by having two apps in the same device instead of one.
I personally use a password. In the passed I’ve used them all but code is what I have been using for years now. Years ago when the pattern came out I thought I was pretty slick with the pattern. I would go diagonal between dots so even if someone were to see me doing the pattern (which I had set not to display) that it would be very hard for them to tell exactly what I was doing. The amount of times that someone is directly looking over my shoulder that’s possibly even close to a threat is almost none existent in my opinion but still not a bad idea to be cautious. I don’t know how I feel about the biometrics. When I have used that method in the passed my finger print would always be changing so it was more of a pain in the ass. Build a fence, lay some bricks, do some framing and all of a sudden the fingerprint scanner wouldn’t work. I think a password is the best way to go. Plus, there’s no telling if the fingerprints actually stay on the device. Trusting Google, Samsung, Apple, etc is something that they all have lied about one thing or another. Why would they not be taking users fingerprints and adding them to their database attached to the big fat files that they have on each user. No one would be the wiser and with everyone’s attitude being “big deal, I’ve got nothing to hide! What can they do with my fingerprints" is exactly what they want. Sorry for the long rant.
Separate apps can reduce your attack surface:
-
Most people install their password manager on all their devices, but you could install a separate 2FA app on only one or two.
-
The 2FA app could be encrypted separately from the password manager, which is an additional defense in some scenarios.
I think you are only thinking about a “man with a wrench” scenario, but there are other ways your device could be compromised, and some devices are more likely to be compromised than others. If you have your password manager installed on your Linux laptop and your Android phone, keeping 2FA codes only on your phone provides some protection here.
6 Likes
For android is it only available on the Play Store? Usually Proton offers the APK for their android apps as well but can’t find it.
Where did you pull this comment from?
I don’t see it in this post. I also used to be of the opinion that Proton should acquire Ente. And before they bought Standard Notes, I thought they should acquire Notesnook not Standard Notes. My guess is, they picked Standard Notes mostly because of the brand name recognition within the privacy community.
But to my point, I think I have changed my mind about Proton acquiring Ente. We do need competition. Also, I am not impressed with how Proton has integrated its current acquisitions so far. Integrating Simple Login into Proton Pass was genius, but there are still issues that make SL separate from Proton. Standard Notes has yet to be integrated, and it’s been over a year. Frankly, at this point, I am very skeptical of what Proton can bring for the end user.
As you’ve surmised, it’s safer precisely because the apps are separate. Even if it’s only mildly safer, it’s still safer. The most likely scenario isn’t somone forcing you to unlock your phone at gunpoint. It’s someone accessing your device or y our account without you being aware. But I hear you point.
For the record, although I love having my 2FA tokens saved in my password manager, it is not a solution I’m solely satisfied with. I like having a backup of my tokens in a stand alone app, which is whis is why I also use Ente.
Wow. Using a password instead of a code to unlock your phone is pretty bold.
I was fairly comfortable using my finger to unlock my phone, but not my face. I find using my face way more invasive even though it is also more convenient, especially for me, because like you, I’ve experienced issues with using my finger frequently.
I just found out that my bank is currently locking me out of certain features on my phone unless I share my biometrics. Don’t know what I’m gonna do yet, but I will not be surprised if one day I am unable to use the app entirely without sharing my biometrics.
Thanks, I appreciate your answer, I understand and I see your point of view. You are right, the “man with a wrench” scenario is important in my threat model, but there are also other things I need also to consider. I take the discussions here as an opportunity to learn.
It was this comment made by @yes
Yes, I have heard that there are several countries that do that. It absolutely sucks! But in the case that I am describing, it is the app that is asking for biometrics. Meaning that even if my bank required collecting biometrics physically at their branch (AFIAK they don’t), the app would still ask for biometrics.
I see Steam is supported. Can someone tell me how i can get my secret from steam?
1 Like
Proton is a significant brand name, so even if there is feature parity and not much gained by having a Proton option, people trust the brand and more people will be likely to adopt it than something random they find on github.
Here’s what Bitwarden says about that: Integrated Authenticator | Bitwarden
You don’t say….bold statement!! Can you elaborate please?
That’s how Google does it. It’s a success for everyone when google comes in and makes an offer! Tells everyone “this will benefit YOU so much”. I like when people told them how they really feel, so much so that they knew it wasnt going work.
Elaborate on what specifically?
Glad to see Notesnook call out Proton for their dishonesty.
Proton knows better and hence should do better.
4 Likes
Man! I am a proton subscriber for a while and as the days are passing, is it just me who is loosing interest (may be loosing trust) in proton? Definately hate to see proton fighting big tech but they themselves want to be one.
I like that we have an alternative to ente auth now, but this launch does feel dishonest, at least on the surface. I am an user of ente services and for auth perticularly, the UI feels somewhere off. I am tempted to move to Proton authenticator, at least try it out, but at the same time feels like I should be moving away from proton altogether…
1 Like
I simply took this as “Switch from Microsoft Authenticator to Proton” whereas if you are using Ente Auth et al today you don’t gain as much. They didn’t say good alternatives don’t already exist - just that if you are still using MS Auth today - switch to Proton Authenticator.
Another example: If you are Proton trying to grow your userbase, would you target Tuta users or Gmail users? Gmail users are both a larger market group and have more incentive to switch. Same with MS authenticator.
5 Likes
You asked if I used biometrics or password and I said I’ve been using a password and you said that’s bold. I’m asking you to elaborate why you feel using a password is bold.