NOTE: This article is not about any of the “normal” topics of this newsletter: genealogy, history, current affairs, DNA, and related topics. However, I will suggest that all computer users should use a password manager that encrypts all of your stored password data (many password managers DO NOT encrypt all your data.) I use several other Proton products (Proton VPN, Proton Mail, Proton Drive, and Proton Calendar) and I plan to use Proton Pass as soon as it opens up to usage by the general public.
The following was written by Andy Yen, the founder and CEO of Proton:
Today, we’re happy to announce another significant milestone in the growth of the Proton ecosystem with the launch of the Proton Pass beta for Lifetime and Visionary users. Invites will roll out over the next week, and you’ll receive an email from us at your Proton Mail email address when you’re eligible.
A password manager has been one of the most common requests from the Proton community ever since we first launched Proton Mail. However, while Proton Pass uses end-to-end encryption to protect your login credentials, it will be much more than a standard-issue password manager. This will become clear over the next weeks and months as we prepare Proton Pass for a public launch later this year.
Learn what a password manager is and why you need one
In 2022, Proton joined forces with SimpleLogin to bring millions of Proton users advanced Hide-my-email Aliases. Making logins more secure, more private, and easier was a core part of the original vision of SimpleLogin. In fact, Son Nguyen Kim, the founder of SimpleLogin, picked the name SimpleLogin for precisely this reason.
The merger united two organizations with a shared interest in tackling this problem. That’s why the SimpleLogin team, joined by a few engineers from Proton, spearheaded work on Proton Pass.
We’re launching Proton Pass now for two primary reasons. First, joining with SimpleLogin increased our ability to develop a new password manager without impacting efforts on other Proton services. Second, passwords are such sensitive information that an insecure password manager is a risk to the Proton community.
If an attacker obtains your password (be it through a data breach or hacking your password manager), they can essentially bypass all of Proton Mail’s advanced encryption. Protecting your passwords properly requires a high level of competence with encryption and security, which few organizations have. We’ve always been worried about the risk posed by a major password manager breach, which unfortunately became a reality with the recent hack of LastPass(new window).
Raising the bar on security
Proton Pass is not just another password manager. It’s perhaps the first one built by a dedicated encryption and privacy company, leading to tangible differences in security. For example, while many other password managers only encrypt the password field, Proton Pass uses end-to-end encryption on all fields (including the username, web address, and more).
This is important because seemingly innocuous bits of information (such as saved URLs, which many other password managers don’t encrypt) can be used to create a highly detailed profile on you. For example, if an attacker can see that you have passwords saved for an account with Grindr, gop.com, or even a manga fan site, they’ll know a lot about you as a person, even if they can’t actually access your accounts.
Cryptographic details matter, and Proton Pass uses a strong bcrypt password hashing implementation (weak PBKDF2 implementations have made other password managers vulnerable) and a hardened implementation of Secure Remote Password (SRP) for authentication. Proton Pass is also one of the first password managers to include a fully integrated two-factor authenticator (2FA) and supports 2FA autofill. This is meant to make it easier to use 2FA everywhere since it’s one of the most effective safeguards for your online accounts.
Read the Proton Pass security model
You can read more about Proton Pass at: https://proton.me/blog/proton-pass-beta.
A note from Dick Eastman: I am not compensated in any way for publishing this article. The article does not contain any affiliate links or other forms of compensation. I am simply a very satisfied user of Proton’s other products and plan to switch to Proton Pass as soon as it becomes available. I decided to share the news about Proton’s latest addition with the readers of this newsletter.