Empowering you to choose a better internet where privacy is the default. Protect yourself online with Proton Mail, Proton VPN, Proton Calendar, Proton Drive. Proton Pass and SimpleLogin.
Proton Mail is the world's largest secure email provider. Swiss, end-to-end encrypted, private, and free.
Proton VPN is the world’s only open-source, publicly audited, unlimited and free VPN. Swiss-based, no-ads, and no-logs.
Proton Calendar is the world's first end-to-end encrypted calendar that allows you to keep your life private.
Proton Drive is a free end-to-end encrypted cloud storage that allows you to securely backup and share your files. It's open source, publicly audited, and Swiss-based.
Proton Pass Proton Pass is a free and open-source password manager which brings a higher level of security with rigorous end-to-end encryption of all data (including usernames, URLs, notes, and more) and email alias support.
SimpleLogin lets you send and receive emails anonymously via easily-generated unique email aliases.
It’s recommended to keep your Proton 2FA separate from Proton Pass. I think they wrote a blog post about it, I’ll link it here if I find it
Edit:
Please note that you should never use Proton Pass to secure your Proton Account using TOTP. Use a third-party authenticator app instead.
Proton themselves have suggested creating a second Proton account expressly for this purpose, despite violating their own ToS.
Hah. Love it
I think you're allowed to do it if you're a paying customer
You shouldn't use multiple free accounts. That's on their TOS. But you can have multiple paid accounts, or one free and a paid account, sure thing.
Honestly speaking, nothing is going to happen with two accounts and a normal usage.
Not an answer to your question, just another one connected to it: Is using the same software for storing passwords and 2FA beating the whole purpose of 2FA in some way? For example if someone can get a hold of your proton account somehow, there's no additional layer of security provided by the 2FA.
I thought the same thing which is why I'm only switching over now. I switched one account just as a test, but I liked being able to access it from the browser. Maybe it's less secure but only if someone gets my Proton account itself, which is protected by 2fa in a different app.
Understandable. I'm also struggling sometimes to find the right balance between comfort and security/privacy.
I actually use a YubiKey (WebAuth)for my password manager. But I also have my OTPs in Aegis that's locally backed up.
Sure but do I split off my Proton account from the rest?
What do you mean? You just add your Proton Account to an authenticator app (not Proton Pass) and you keep all of your other stuff in Proton Pass.
That is what I mean. Does it make sense to have one app (Aegis) just for one account (Proton) and then another app (Pass) for all other 2FAs?
There's nothing wrong with this setup. Of course, it's more secure to keep your passwords separate from your 2FA tokens, I store them in Aegis and only use my password manager for my credentials.