How to manage 2FA for Proton account if Proton Pass is my 2FA thing?
How to manage 2FA for Proton account if Proton Pass is my 2FA thing?
I'm migrating the handful of accounts that I have 2FA set up in from using Authy to using Proton Pass. But I'm stuck on my Proton account itself. Should I keep Authy just for my Proton account and then once I'm in, I can use Pass for the rest of the 2FAs?
What do you do?
You're viewing a single thread.
Not an answer to your question, just another one connected to it: Is using the same software for storing passwords and 2FA beating the whole purpose of 2FA in some way? For example if someone can get a hold of your proton account somehow, there's no additional layer of security provided by the 2FA.
I thought the same thing which is why I'm only switching over now. I switched one account just as a test, but I liked being able to access it from the browser. Maybe it's less secure but only if someone gets my Proton account itself, which is protected by 2fa in a different app.
Understandable. I'm also struggling sometimes to find the right balance between comfort and security/privacy.
@barcaxavi @akilou what do you mean with "is a 2FA app accessible also through the browser". I have the app on Linux Desktop and Android but what page of the browser is going to let me do the same? On the main page of the website I don't see any reference.
Yes and no. You’re correct that if someone compromises your proton account, the 2fa does nothing. But in the other hand, if someone were to acquire your credentials some other way, they may still only have the username and password, and maybe the time-dependent 2fa code. So I would argue it’s better than no 2fa but somewhat inferior to using a separately authenticated 2fa app/device.
Yes and no. You’re correct that if someone compromises your proton account, the 2fa does nothing. But in the other hand, if someone were to acquire your credentials some other way, they may still only have the username and password, and maybe the time-dependent 2fa code. So I would argue it’s better than no 2fa but somewhat inferior to using a separately authenticated 2fa app/device.