Proton
Empowering you to choose a better internet where privacy is the default. Protect yourself online with Proton Mail, Proton VPN, Proton Calendar, Proton Drive. Proton Pass and SimpleLogin.
Proton Mail is the world's largest secure email provider. Swiss, end-to-end encrypted, private, and free.
Proton VPN is the world’s only open-source, publicly audited, unlimited and free VPN. Swiss-based, no-ads, and no-logs.
Proton Calendar is the world's first end-to-end encrypted calendar that allows you to keep your life private.
Proton Drive is a free end-to-end encrypted cloud storage that allows you to securely backup and share your files. It's open source, publicly audited, and Swiss-based.
Proton Pass Proton Pass is a free and open-source password manager which brings a higher level of security with rigorous end-to-end encryption of all data (including usernames, URLs, notes, and more) and email alias support.
SimpleLogin lets you send and receive emails anonymously via easily-generated unique email aliases.
view the rest of the comments
As a rule of thumb, do not put all your eggs into one basket. No software is infallible and vulnerabilities can be uncovered and exploited in both open and closed sourced applications.
That’s being said, as long as you don’t store all information necessary for a successful login in your password manager, you should be fine.
So storing credentials for your bank account is fine, as long as it is also protected by MFA and you do not use the same password manager for handling that.
You can store PIN codes from your debit cards in the password manager as long as you do not store card number / expiration / CVV2 there too.
Personally, I keep passwords in a password manager, MFA tokens in a separate authenticator, MFA recovery codes go to FIPS 140-2 certified encrypted USB sticks (3 separate copies). I do store debit card PIN codes in my password manager, but only alongside the last 4 digits of the card number.
that are good suggestions. my bank accounts all require two steps authentications, with the second one being mostly auth via mobile app, so that part is enforced and always keeps the account secured better.
I do have one concern with the Proton account itself, as you wrote "no all eggs in one basket" rule of thumb. With the Pass, I have the 2FA integrated together with passwords (not for bank accounts) - a little risk in here with a gain on convenience.
Though I certainly do not store my Proton password in it, keeping it memorable and more than 40 characters long makes me feel safe. Im not sure what 2FA app to use for the Proton tho, would you recommend anything? I cannot use a physical key, as my devices have different USB connectors and I cannot have a one key for all.
For MFA apps, Google Authenticator seems to be the norm.
I personally use OTPAuth with sync disabled and regular backups. Mostly because it is easier to organise and back up.
Regarding hardware security keys as part of MFA, you can either get yourself dual USB-C / Lightning or USB-C / USB-A keys from Yubikey. Then just buy a USB-A to USB-C dongle (or vice versa) and keep it on your key chain. That’s mostly what I do, not ideal but does the job.
I also use OnlyKey for some passwords, especially encryption passphrases on some servers and laptops. I usually need to enter them on boot, and it just takes too long to do that manually and I’m lazy.