Comment on Proton releases a new app for two-factor authentication

artyom@piefed.social ⁨4⁩ ⁨weeks⁩ ago

• BlameTheAntifa@lemmy.world ⁨4⁩ ⁨weeks⁩ ago

  You really should not keep your MFA codes in the same place as your passwords, especially if you are syncing those passwords between devices and/or a cloud service.

  source

  • artyom@piefed.social ⁨4⁩ ⁨weeks⁩ ago

    Yes that's why I said:

    If you already use Proton Pass, I think I'd recommend Ente Auth instead

    source

    • BlameTheAntifa@lemmy.world ⁨4⁩ ⁨weeks⁩ ago

      Aha. Sorry, I misunderstood. I saw the first line about Proton Pass already supporting MFA and I wasn’t familiar with Ente Auth. I did just look it up and I can’t believe I’ve never heard of it before. It’s even AGPL-3.0, be still my beating heart! Thank you for pointing it out!

      ente.io for anyone curious.

      source

      • steal_your_face@lemmy.ml ⁨4⁩ ⁨weeks⁩ ago

        I use ente photos too and I like it

        source
      • artyom@piefed.social ⁨4⁩ ⁨weeks⁩ ago

        Yes, the biggest difference is that Proton Auth seems to work without an account.

        source
• AncientConnection@lemmy.ml ⁨4⁩ ⁨weeks⁩ ago

  Thank you for your comment. I was also confused initially before reading properly. I thought, ‘What? But isn’t the Proton 2FA thing paid? What do they gain by making it free?’ It seems that most people are not willing to use this new app, though. Ente, Aegis, whatever the alternative is, there doesn’t seem to be a reason to use this new authenticator from Proton instead. I wonder what their goal is here. Is it simply to expand their app ‘ecosystem’?

  source

  • artyom@piefed.social ⁨4⁩ ⁨weeks⁩ ago

    There are ads in the app for Proton Pass, so that's my best guess.

    source
• pulsewidth@lemmy.world ⁨4⁩ ⁨weeks⁩ ago

  It is very wise to store your 2FA codes separately from your general login credentials. If one is breached, the other protects it (hence, two factor). If both are breeched, your account is hosed.

  Same deal when setting up 2FA on an account and they provide some ‘one time use’ 2FA codes, they generally say ‘do not store these with your standard password credentials - keep them secure and separate’.

  source

  • artyom@piefed.social ⁨4⁩ ⁨weeks⁩ ago

    Correct. However it's worth noting that passwords are almost always compromised server-side. So 2FA is far more a mitigation of data breaches from the provider, rather than your password manager being breached.

    source

    • pulsewidth@lemmy.world ⁨4⁩ ⁨weeks⁩ ago

      Feels like everyone has forgotten when LastPass was breached, and that was barely three years ago.

      Any affected LastPass users storing their 2FA backup codes in with the rest of their login data got a rude awakening.

      Anyone who had them separate was at least able to rescue those accounts. But hey do what you like people, I know convenience usually trumps security.

      source

      • artyom@piefed.social ⁨4⁩ ⁨weeks⁩ ago

        As far as I know, passwords and TOTP keys were never leaked by LastPass. Regardless, I did say almost always.

        source

        • -> View More Comments