472
Proton Pass open source password manager is now available on F-Droid (proton.me)
submitted 2 years ago by to c/opensource@lemmy.ml
110 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 2 years ago (7 children)

Because we only know what the client does, and have no clue on the server side of things, allowing Proton to do any manipulations with the data. Not ideal when you consider it for password storage.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 1 point 2 years ago (4 children)

    if the client is e2ee and you can control that, then why is the server relevant?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 2 years ago* (3 children)

    Because non-obvious backdoors can be added to the client that break or circumvent encryption (looking at you, xz), stealing all of your passwords, and no one will be able to raise the alarm just by looking at the server code.

    Open-source backend allows to generally avoid this situation, while also potentially rendering you able to self-host if you're paranoid.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 2 years ago (2 children)

    and you can control that

    Sorry, I meant "assuming one has complete control over the client source" where the remote cannot just change it on you.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 2 years ago* (1 child)

    I mean they can make a sneaky update to the client that introduces such changes.

    Sure, if you won't update your client, this won't affect you, but would potentially open you up to other security vulnerabilities.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •