I’m using proton services and now the Pass password manager as well.
I never let any managers save my bank data such as credit cards or login credentials being sort of afraid to.
Is this concern still valid? when using a manager like Proton Pass that has e2e encryption? what’s your opinion on holding bank data in managers like this?
This is also largely based on threat model as something is better than nothing. I don’t believe the average person is going to, much less successfully, implement full layered security.
If more people could just:
Use long passphrases
Never reuse passwords for more than one service
Use an encrypted password manager
Enable 2FA (Preferability via app not SMS)
It would solve a large majority of the issues. It’s important to note that most stolen logins are actually from data breaches and malware. Before Proton Pass I stored everything in KeePass, we’re talking many years. I have yet to ever have unauthorized activity or login on any of my accounts, I’ve even been lucky not to show up on any data breaches.
Sure, I got a “FIPS 140-2 certified encrypted USB” which really can just be done with VeraCrypt for FREE (Supply Chain Prevention), used for archive backups, but otherwise just not clicking on links in random emails or visiting sketchy websites.
I agree with you on most of the points. Some security is better than nothing. More security is better than less, layers and all.
Regarding data breaches and malware, and threat models in general. We should not forget phishing too. People voluntarily entering their credentials on a website masquerading as their bank etc.
With all of that, having your credentials split over multiple applications and devices actually saves you from an endpoint compromise and evil maid attacks, at least in a sense of limiting the fallout.
Regarding VeraCrypt and “FREE”. While it is, again, better than nothing, VeraCrypt is fiddly, not always works consistently on all operating systems (I look at you, MacOS), and is susceptible to key logging. I prefer actual certified hardware with physical keypads instead. It is not free and has its own downsides, but it is just something I find more appealing.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !protonprivacy@lemmy.world
Empowering you to choose a better internet where privacy is the default. Protect yourself online with
Proton Mail, Proton VPN, Proton Calendar, Proton Drive. Proton Pass and SimpleLogin.
Proton Mail is the world’s largest secure email provider. Swiss, end-to-end encrypted, private, and free.
Proton VPN is the world’s only open-source, publicly audited, unlimited and free VPN. Swiss-based, no-ads, and no-logs.
Proton Calendar is the world’s first end-to-end encrypted calendar that allows you to keep your life private.
Proton Drive is a free end-to-end encrypted cloud storage that allows you to securely backup and share your files. It’s open source, publicly audited, and Swiss-based.
Proton Pass Proton Pass is a free and open-source password manager which brings a higher level of security with rigorous end-to-end encryption of all data (including usernames, URLs, notes, and more) and email alias support.
SimpleLogin lets you send and receive emails anonymously via easily-generated unique email aliases.
This is also largely based on threat model as something is better than nothing. I don’t believe the average person is going to, much less successfully, implement full layered security.
If more people could just:
It would solve a large majority of the issues. It’s important to note that most stolen logins are actually from data breaches and malware. Before Proton Pass I stored everything in KeePass, we’re talking many years. I have yet to ever have unauthorized activity or login on any of my accounts, I’ve even been lucky not to show up on any data breaches.
Sure, I got a “FIPS 140-2 certified encrypted USB” which really can just be done with VeraCrypt for FREE (Supply Chain Prevention), used for archive backups, but otherwise just not clicking on links in random emails or visiting sketchy websites.
I agree with you on most of the points. Some security is better than nothing. More security is better than less, layers and all.
Regarding data breaches and malware, and threat models in general. We should not forget phishing too. People voluntarily entering their credentials on a website masquerading as their bank etc.
With all of that, having your credentials split over multiple applications and devices actually saves you from an endpoint compromise and evil maid attacks, at least in a sense of limiting the fallout.
Regarding VeraCrypt and “FREE”. While it is, again, better than nothing, VeraCrypt is fiddly, not always works consistently on all operating systems (I look at you, MacOS), and is susceptible to key logging. I prefer actual certified hardware with physical keypads instead. It is not free and has its own downsides, but it is just something I find more appealing.