• John Richard@lemmy.world
    link
    fedilink
    English
    arrow-up
    10
    arrow-down
    23
    ·
    5 months ago

    And so what happens to your passwords if Proton were to go offline and you needed to continue using Proton Pass? Do they have an open source server you can use like Bitwarden does or vaultwarden? Or are you essentially locking yourself into a new walled garden for no reason other than name recognition? Why not just use KeePassXC which is encrypted locally rather than share your password with a third party who can easily capture your private key password?

    • nutsack@lemmy.world
      link
      fedilink
      English
      arrow-up
      15
      arrow-down
      1
      ·
      edit-2
      5 months ago

      I think a lot of these cloud-based password vaults will have a local database that syncs with the cloud. I think you can unlock them and access your passwords without internet access

      • John Richard@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        11
        ·
        5 months ago

        Keyword… unlock, not add information or use them offline where they can sync to an open source backend. They are cloud-based password managers that are designed to operate online. The backend is not open source. It is designed to lock you into a walled garden.

        • nutsack@lemmy.world
          link
          fedilink
          English
          arrow-up
          3
          ·
          edit-2
          5 months ago

          The unlocking happens locally. it’s simply decrypting. also, i think you can export the data from proton pass.

          it’s a cloud solution. keepassxc works great and I don’t know why you want something else to replace it

          • ruse8145@lemmy.sdf.org
            link
            fedilink
            English
            arrow-up
            1
            ·
            5 months ago

            Browser integration with quality biometric login is a beautiful thing. Keepass’ implementation of both is trash, and keepassxc’s browser integration may actually be worse than the original.

            That having been said I always recommend to people they use two managers, with keepass being the secure base for things you don’t often need convenient access to like savings accounts, password manager passwords, tax services, etc.

            bitwarden, proton, et al I use for the day-to-day…I don’t give any fucks if my Lemmy account is lost for example.

      • ruse8145@lemmy.sdf.org
        link
        fedilink
        English
        arrow-up
        1
        ·
        5 months ago

        “A walled garden is a garden enclosed by high walls, especially when this is done for horticultural rather than security purposes, although originally all gardens may have been enclosed for protection from animal or human intruders.”

        Agreed proton isn’t this

        "A closed platform, walled garden, or closed ecosystem[1][2] is a software system wherein the carrier or service provider has control over applications, content, and/or media, and restricts convenient access to non-approved applicants or content. "

        Try using thunderbird and id argue proton is this

        • asdfasdfasdf@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          4 months ago

          Still, that seems like a combo of “comes with the territory of encrypted email” and “their software could use some major improvements”. I think closed platform is closed by design.

          • dan@upvote.au
            link
            fedilink
            English
            arrow-up
            2
            ·
            edit-2
            4 months ago

            comes with the territory of encrypted email

            AFAIK they haven’t tried to standardize their implementation, which to me implies that they’re not interested in interoperability. That’s unfortunate. I wouldn’t want to be locked in to a vendor like that.

            At least some providers do try. FastMail published the spec for their modern, stateless replacement to IMAP through the IETF as “JMAP”, and built on top of existing RFCs where possible.

          • ruse8145@lemmy.sdf.org
            link
            fedilink
            English
            arrow-up
            1
            arrow-down
            1
            ·
            4 months ago

            Nah, fundamentally proton uses the same encryption as everyone else, they just have a central server to exchange keys rather than one of the open servers.

      • John Richard@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        7
        ·
        5 months ago

        It will cache credentials for a short time so you can still access some of your passwords. It will not let you add new credentials. It’s like a web browser working in offline mode for a period of time. It is a cloud-based password manager with a closed-source server backend.