▲ 472 ▼ Proton Pass open source password manager is now available on F-Droid (proton.me) submitted 2 years ago by pro_grammer@programming.dev to c/opensource@lemmy.ml 110 comments fedilink hide all child comments
[–] Allero@lemmy.today 61 points 2 years ago (15 children) The backend is proprietary. Avoid. permalink fedilink source hideshow 15 child comments replies: [–] warmaster@lemmy.world 10 points 2 years ago (5 children) As all things Proton. permalink fedilink source parent hideshow 5 child comments replies: [–] hswolf@lemmy.world 6 points 2 years ago I use their mail system, and it's pretty good ngl permalink fedilink source parent [–] Zetta@mander.xyz 4 points 2 years ago (1 child) Best alternative for email? permalink fedilink source parent hideshow 1 child comment replies: [–] RobMyBot@lemmy.ml 7 points 2 years ago E2E Encrypted FOSS smoke signals that are only visible on a Time-Based One-Time wavelength of light are the only way. permalink fedilink source parent [–] Harbinger01173430@lemmy.world 0 points 2 years ago (1 child) Even steam proton? permalink fedilink source parent hideshow 1 child comment replies: [–] warmaster@lemmy.world 2 points 2 years ago Except anything Valve, which is awesome. permalink fedilink source parent [–] Sgn@programming.dev 0 points 2 years ago (8 children) Avoid why? permalink fedilink source parent hideshow 8 child comments replies: [–] Allero@lemmy.today 1 point 2 years ago (7 children) Because we only know what the client does, and have no clue on the server side of things, allowing Proton to do any manipulations with the data. Not ideal when you consider it for password storage. permalink fedilink source parent hideshow 7 child comments replies: [–] Sgn@programming.dev 1 point 2 years ago (1 child) What should I use then? permalink fedilink source parent hideshow 1 child comment replies: [–] Allero@lemmy.today 1 point 2 years ago Something like Vaultwarden if you care about cloud sync, or KeePassXC if that's not on your priority list. permalink fedilink source parent [–] refalo@programming.dev 1 point 2 years ago (4 children) if the client is e2ee and you can control that, then why is the server relevant? permalink fedilink source parent hideshow 4 child comments replies: [–] Allero@lemmy.today 1 point 2 years ago* (3 children) Because non-obvious backdoors can be added to the client that break or circumvent encryption (looking at you, xz), stealing all of your passwords, and no one will be able to raise the alarm just by looking at the server code. Open-source backend allows to generally avoid this situation, while also potentially rendering you able to self-host if you're paranoid. permalink fedilink source parent hideshow 3 child comments replies: [–] refalo@programming.dev 1 point 2 years ago (2 children) and you can control that Sorry, I meant "assuming one has complete control over the client source" where the remote cannot just change it on you. permalink fedilink source parent hideshow 2 child comments replies: [–] Allero@lemmy.today 2 points 2 years ago* (1 child) I mean they can make a sneaky update to the client that introduces such changes. Sure, if you won't update your client, this won't affect you, but would potentially open you up to other security vulnerabilities. permalink fedilink source parent hideshow 1 child comment replies: [–] refalo@programming.dev 2 points 2 years ago* This was a real concern with MEGA back in the day (after Kim said you should no longer trust them) and a big reason why I prefer to use standalone client apps that I can control the source of. permalink fedilink source parent
[–] warmaster@lemmy.world 10 points 2 years ago (5 children) As all things Proton. permalink fedilink source parent hideshow 5 child comments replies: [–] hswolf@lemmy.world 6 points 2 years ago I use their mail system, and it's pretty good ngl permalink fedilink source parent [–] Zetta@mander.xyz 4 points 2 years ago (1 child) Best alternative for email? permalink fedilink source parent hideshow 1 child comment replies: [–] RobMyBot@lemmy.ml 7 points 2 years ago E2E Encrypted FOSS smoke signals that are only visible on a Time-Based One-Time wavelength of light are the only way. permalink fedilink source parent [–] Harbinger01173430@lemmy.world 0 points 2 years ago (1 child) Even steam proton? permalink fedilink source parent hideshow 1 child comment replies: [–] warmaster@lemmy.world 2 points 2 years ago Except anything Valve, which is awesome. permalink fedilink source parent
[–] hswolf@lemmy.world 6 points 2 years ago I use their mail system, and it's pretty good ngl permalink fedilink source parent
[–] Zetta@mander.xyz 4 points 2 years ago (1 child) Best alternative for email? permalink fedilink source parent hideshow 1 child comment replies: [–] RobMyBot@lemmy.ml 7 points 2 years ago E2E Encrypted FOSS smoke signals that are only visible on a Time-Based One-Time wavelength of light are the only way. permalink fedilink source parent
[–] RobMyBot@lemmy.ml 7 points 2 years ago E2E Encrypted FOSS smoke signals that are only visible on a Time-Based One-Time wavelength of light are the only way. permalink fedilink source parent
[–] Harbinger01173430@lemmy.world 0 points 2 years ago (1 child) Even steam proton? permalink fedilink source parent hideshow 1 child comment replies: [–] warmaster@lemmy.world 2 points 2 years ago Except anything Valve, which is awesome. permalink fedilink source parent
[–] warmaster@lemmy.world 2 points 2 years ago Except anything Valve, which is awesome. permalink fedilink source parent
[–] Sgn@programming.dev 0 points 2 years ago (8 children) Avoid why? permalink fedilink source parent hideshow 8 child comments replies: [–] Allero@lemmy.today 1 point 2 years ago (7 children) Because we only know what the client does, and have no clue on the server side of things, allowing Proton to do any manipulations with the data. Not ideal when you consider it for password storage. permalink fedilink source parent hideshow 7 child comments replies: [–] Sgn@programming.dev 1 point 2 years ago (1 child) What should I use then? permalink fedilink source parent hideshow 1 child comment replies: [–] Allero@lemmy.today 1 point 2 years ago Something like Vaultwarden if you care about cloud sync, or KeePassXC if that's not on your priority list. permalink fedilink source parent [–] refalo@programming.dev 1 point 2 years ago (4 children) if the client is e2ee and you can control that, then why is the server relevant? permalink fedilink source parent hideshow 4 child comments replies: [–] Allero@lemmy.today 1 point 2 years ago* (3 children) Because non-obvious backdoors can be added to the client that break or circumvent encryption (looking at you, xz), stealing all of your passwords, and no one will be able to raise the alarm just by looking at the server code. Open-source backend allows to generally avoid this situation, while also potentially rendering you able to self-host if you're paranoid. permalink fedilink source parent hideshow 3 child comments replies: [–] refalo@programming.dev 1 point 2 years ago (2 children) and you can control that Sorry, I meant "assuming one has complete control over the client source" where the remote cannot just change it on you. permalink fedilink source parent hideshow 2 child comments replies: [–] Allero@lemmy.today 2 points 2 years ago* (1 child) I mean they can make a sneaky update to the client that introduces such changes. Sure, if you won't update your client, this won't affect you, but would potentially open you up to other security vulnerabilities. permalink fedilink source parent hideshow 1 child comment replies: [–] refalo@programming.dev 2 points 2 years ago* This was a real concern with MEGA back in the day (after Kim said you should no longer trust them) and a big reason why I prefer to use standalone client apps that I can control the source of. permalink fedilink source parent
[–] Allero@lemmy.today 1 point 2 years ago (7 children) Because we only know what the client does, and have no clue on the server side of things, allowing Proton to do any manipulations with the data. Not ideal when you consider it for password storage. permalink fedilink source parent hideshow 7 child comments replies: [–] Sgn@programming.dev 1 point 2 years ago (1 child) What should I use then? permalink fedilink source parent hideshow 1 child comment replies: [–] Allero@lemmy.today 1 point 2 years ago Something like Vaultwarden if you care about cloud sync, or KeePassXC if that's not on your priority list. permalink fedilink source parent [–] refalo@programming.dev 1 point 2 years ago (4 children) if the client is e2ee and you can control that, then why is the server relevant? permalink fedilink source parent hideshow 4 child comments replies: [–] Allero@lemmy.today 1 point 2 years ago* (3 children) Because non-obvious backdoors can be added to the client that break or circumvent encryption (looking at you, xz), stealing all of your passwords, and no one will be able to raise the alarm just by looking at the server code. Open-source backend allows to generally avoid this situation, while also potentially rendering you able to self-host if you're paranoid. permalink fedilink source parent hideshow 3 child comments replies: [–] refalo@programming.dev 1 point 2 years ago (2 children) and you can control that Sorry, I meant "assuming one has complete control over the client source" where the remote cannot just change it on you. permalink fedilink source parent hideshow 2 child comments replies: [–] Allero@lemmy.today 2 points 2 years ago* (1 child) I mean they can make a sneaky update to the client that introduces such changes. Sure, if you won't update your client, this won't affect you, but would potentially open you up to other security vulnerabilities. permalink fedilink source parent hideshow 1 child comment replies: [–] refalo@programming.dev 2 points 2 years ago* This was a real concern with MEGA back in the day (after Kim said you should no longer trust them) and a big reason why I prefer to use standalone client apps that I can control the source of. permalink fedilink source parent
[–] Sgn@programming.dev 1 point 2 years ago (1 child) What should I use then? permalink fedilink source parent hideshow 1 child comment replies: [–] Allero@lemmy.today 1 point 2 years ago Something like Vaultwarden if you care about cloud sync, or KeePassXC if that's not on your priority list. permalink fedilink source parent
[–] Allero@lemmy.today 1 point 2 years ago Something like Vaultwarden if you care about cloud sync, or KeePassXC if that's not on your priority list. permalink fedilink source parent
[–] refalo@programming.dev 1 point 2 years ago (4 children) if the client is e2ee and you can control that, then why is the server relevant? permalink fedilink source parent hideshow 4 child comments replies: [–] Allero@lemmy.today 1 point 2 years ago* (3 children) Because non-obvious backdoors can be added to the client that break or circumvent encryption (looking at you, xz), stealing all of your passwords, and no one will be able to raise the alarm just by looking at the server code. Open-source backend allows to generally avoid this situation, while also potentially rendering you able to self-host if you're paranoid. permalink fedilink source parent hideshow 3 child comments replies: [–] refalo@programming.dev 1 point 2 years ago (2 children) and you can control that Sorry, I meant "assuming one has complete control over the client source" where the remote cannot just change it on you. permalink fedilink source parent hideshow 2 child comments replies: [–] Allero@lemmy.today 2 points 2 years ago* (1 child) I mean they can make a sneaky update to the client that introduces such changes. Sure, if you won't update your client, this won't affect you, but would potentially open you up to other security vulnerabilities. permalink fedilink source parent hideshow 1 child comment replies: [–] refalo@programming.dev 2 points 2 years ago* This was a real concern with MEGA back in the day (after Kim said you should no longer trust them) and a big reason why I prefer to use standalone client apps that I can control the source of. permalink fedilink source parent
[–] Allero@lemmy.today 1 point 2 years ago* (3 children) Because non-obvious backdoors can be added to the client that break or circumvent encryption (looking at you, xz), stealing all of your passwords, and no one will be able to raise the alarm just by looking at the server code. Open-source backend allows to generally avoid this situation, while also potentially rendering you able to self-host if you're paranoid. permalink fedilink source parent hideshow 3 child comments replies: [–] refalo@programming.dev 1 point 2 years ago (2 children) and you can control that Sorry, I meant "assuming one has complete control over the client source" where the remote cannot just change it on you. permalink fedilink source parent hideshow 2 child comments replies: [–] Allero@lemmy.today 2 points 2 years ago* (1 child) I mean they can make a sneaky update to the client that introduces such changes. Sure, if you won't update your client, this won't affect you, but would potentially open you up to other security vulnerabilities. permalink fedilink source parent hideshow 1 child comment replies: [–] refalo@programming.dev 2 points 2 years ago* This was a real concern with MEGA back in the day (after Kim said you should no longer trust them) and a big reason why I prefer to use standalone client apps that I can control the source of. permalink fedilink source parent
[–] refalo@programming.dev 1 point 2 years ago (2 children) and you can control that Sorry, I meant "assuming one has complete control over the client source" where the remote cannot just change it on you. permalink fedilink source parent hideshow 2 child comments replies: [–] Allero@lemmy.today 2 points 2 years ago* (1 child) I mean they can make a sneaky update to the client that introduces such changes. Sure, if you won't update your client, this won't affect you, but would potentially open you up to other security vulnerabilities. permalink fedilink source parent hideshow 1 child comment replies: [–] refalo@programming.dev 2 points 2 years ago* This was a real concern with MEGA back in the day (after Kim said you should no longer trust them) and a big reason why I prefer to use standalone client apps that I can control the source of. permalink fedilink source parent
[–] Allero@lemmy.today 2 points 2 years ago* (1 child) I mean they can make a sneaky update to the client that introduces such changes. Sure, if you won't update your client, this won't affect you, but would potentially open you up to other security vulnerabilities. permalink fedilink source parent hideshow 1 child comment replies: [–] refalo@programming.dev 2 points 2 years ago* This was a real concern with MEGA back in the day (after Kim said you should no longer trust them) and a big reason why I prefer to use standalone client apps that I can control the source of. permalink fedilink source parent
[–] refalo@programming.dev 2 points 2 years ago* This was a real concern with MEGA back in the day (after Kim said you should no longer trust them) and a big reason why I prefer to use standalone client apps that I can control the source of. permalink fedilink source parent