from Hacker News

Proton Pass end-to-end encrypted password manager is here and free for everyone

by xslvrxslwt on 6/28/23, 3:16 PM with 94 comments

• by firefoxkekw on 6/28/23, 4:16 PM

  Proton, the company that still in 2023 doesn't allow to cancel the auto renewal without losing access to the services you have already paid, the most anti-consumer thing I have seen in my life.

  Here is how it works: 1. You pay for example for 2 years of access. 2. After a few months you decide to remove the auto renew and just use the remaining time of your subscription, your only option is to cancel your current subscription and lost access to any premium service you paid for, they give you credits for the remaining time of your subscription, that you can use if you contract other services.

  So you are force to cancel the subscription before the renewal time and hope you don't forget to cancel it.

  Run from this company.

• by ZeroCool2u on 6/28/23, 3:47 PM

  Should probably link directly to the announcement here: https://proton.me/blog/proton-pass-launch

• by Vaslo on 6/28/23, 4:01 PM

  I’ve been using since beta. It’s really smooth and pretty comparable to Bitwarden. It’s doesn’t have notes and such yet but it’s going to be a good competitor. I don’t think it’s open source so may not exactly be a good replacement for Bitwarden.

• by Mystery-Machine on 6/28/23, 5:11 PM

  I feel like it's not true that their services are end-to-end encrypted. I mean, they are, but they have the encryption keys so it's the same as if they are not.

  https://news.ycombinator.com/item?id=29103056 https://encryp.ch/blog/disturbing-facts-about-protonmail/ https://news.ycombinator.com/item?id=17775326 https://news.ycombinator.com/item?id=28057433

• by doodlesdev on 6/28/23, 3:51 PM

  Am I correct in believing that they haven't open-sourced Proton Pass yet? It seems like an ok password manager, but with no mention of open-source and an option for self-hosting, this already becomes completely unusable, especially considering so many great alternatives are already available.

  edit: Their official announcement post says it's now open source, however I haven't been able to find the repository. I also still see no mentions of self hosting.

• by bobajeff on 6/28/23, 4:26 PM

  I don't think there is any good reason to store passwords on a remote machine that you don't own. When most passwords that anyone will ever have can be fit on one cheap thumb drive in a keepass database. For which there are many open source apps available.

• by AnonC on 6/28/23, 6:45 PM

  Pity it's only available on iOS and Android as apps and as browser extensions elsewhere. I would've been interested to check out a desktop password manager that's free/cheap and is not based on Electron* and follows native OS UX.

  [* As far as I know, Bitwarden is an Electron app. It shares the same kind of sluggishness and some weird navigation issues that are common in Electron apps. Though I wouldn't go back to 1Password for various reasons, I recall that it's also an Electron app ever since Agilebits got huge funding for the company.]

• by latchkey on 6/28/23, 5:19 PM

  I was hesitant to even bother trying yet another open source password manager, but wow, the comments here are brutal. Thanks for confirming initial gut feeling. I'll stick with Bitwarden.

• by psychphysic on 6/28/23, 3:52 PM

  Correct me if this is no longer true.

  The fatal chink in the Proton model is that PGP keys must either be generated on the service or uploaded unencrypted?

  To me it seems trivial to make it possible to upload a locally generated appropriately formatted encrypted key.

  Glad if that now no longer true.

• by varjolintu on 6/29/23, 5:24 AM

  There's still nothing about the telemetry in the browser extension? I couldn't find any mention about it in the "Help us improve Proton apps" or from the privacy policy page. The privacy policy mentions "It details the data processing activities specifically related to the creation and activity of your Proton Account when you use Proton Pass." though, but it's a bit unclear.

  When looking at the extension's source code, telemetry data is anonymous, but it's always sent to the remote endpoint, and the only way to disable it is from your Proton account, not the extension itself.

• by dist-epoch on 6/28/23, 3:53 PM

  > But Proton Pass will also enable you to create a hide-my-email alias. An email alias is a randomly generated email address that sits between a third party (like Amazon, Facebook, or Netflix) and your real email account

  Is there some software I can install on my webserver to generate per service emails like Proton Pass here (amazon.44ot65@passmail.com, netflix.56ax12@passmail.com, ...)? And which forwards the mails to my main Gmail and allows replying to them.

• by highwaylights on 6/28/23, 5:16 PM

  Possibly the worst experience I've had dealing with a software company.

  So bad in fact that I couldn't consider using any of their products ever again out of fear.

• by nyanpasu64 on 6/28/23, 4:47 PM

  I also got an email from Proton saying that they're forcing mandatory arbitration and class action waiver on all users.

• by butz on 6/28/23, 5:13 PM

  And still no native Linux client for Proton Drive.

• by pixxel on 6/28/23, 4:05 PM

  I guess most find it useful to have all these tools/services supplied by one company. Personally I think it’s awful for privacy.

• by systems_glitch on 6/28/23, 3:55 PM

  Can't use the Firefox extension, FF 102 ESR is apparently too old :/

• by Reisen on 6/28/23, 6:11 PM

  I am a current user of Proton about to search for a solution to move away from this company, I am quite disappointed in my experience with them in general.

  1) Their mail import tool reports wrong email set count and sizes leading to low confidence the tool worked, in the end I mbsync'd from both fastmail and proton and compared the email set because the migration UX was so poor (this is reported by other users also).

  2) Their alias address implementation is severely limited, on Fastmail I used *@domain to have infinite emails, on Proton you have to add every alias you want manually one by one, if you do not, you cannot reply from any address. This is not only limited in the UI, but everywhere, protonmail-bridge for example will reject sending any email that is not in your alias list, and as they limit it to 100 addresses you can't work around it programatically either.

  3) Their bridge software is buggy, and poorly documented, it's better with the recent release but for a while it made heavy assumptions about your installation and would log you out sporadically, sometimes requiring gpg-agent to be restarted (for no reason I could figure out) before being able to re-auth.

  4) Their Proton Drive offering is basically useless, it is not available on Linux so can't use it as a target for backup software like Kopia/restic etc, and desktop apps have been in development for as long as I can remember. The WebUI for it will break if you try and drop too many files at once. It has problems with file name limits which don't appear until you try and access the filesystem again; after uploading several documents with extremely long names I found they were straight up inaccessible on my phone or via the web, so as far as I can tell if I hadn't had a second backup I would have lost these files.

  All this would have been rough, but acceptible for me if I felt their client attention / support was good, but the support I received was terrible. Multi-day back and forths with support agents who did not seem to understand my questions, where with fastmail I would have a technical response to almost any question within an hour.

  Their uservoice page is full of basic requests that are unanswered after years: https://protonmail.uservoice.com/

  I've never regretted migrating to a company as much as I do Proton and I would not recommend switching to their applications, everything feels half baked or limited by poor focus on reaching feature parity with other competing services. The fact I can't do basic catch-all domain with their email service without being forced to reply via a limited alias list (if I can, their support was incapable of telling me how), was my last straw.

  It's a shame there's basically no other encrypted mail host that competes.

• by lowbloodsugar on 6/28/23, 4:08 PM

  Time to ditch 1Password.