Do you use an extra password for Proton Pass?

[PurpleDime]

@LightningToaster

Personally have not experienced this with Proton Pass Android in several months. I think it only happened once when my fingerprint reader was dirty and it failed a couple of times.

That surprises me because it’s standard security for all smartphones and password manager apps.

@LightningToaster

have you considered that if the standalone app was open on your desktop (unlocked), the intruder can steal any password anyway, not just your master password/security key. I consider that a full compromise, far past the point of considering defense strategies.

Yes, but if someone steals my password manager’s credentials, it’s a bigger deal than if they steal my default email or even my bank credentials. With the former they have access to everything, with the latter they only have access to one thing (for email). All of my banks require 2FA via their app when I try to make a transaction on the web.

@LibreKumiho

Luckily I can even do online banking without any app (physical TAN generator for 2FA).

That is surprising. From my experience, it is practically impossible to do any online banking via web today without needing the bank’s app as 2FA verification. In other words, it’s practically impossible to do any online banking via web without needing a smartphone.

@LibreKumiho

I know it becomes worse, especially in other countries, but I hope GDPR in EU will be a shield against it, because it rates biometric data as highly protectable data (wording is maybe different) and so I think it is possible to force banks to use other authentication methods inside Europe.

I hope you are right, but I am not confident. If the only way to do banking without being spied on is by physically going to the bank or the ATM every time, it’s not a very pragmatic solution. I hope people sue. I intend to report my bank to my local data protection agency, but I suspect they’ll tell me there’s nothing I can do.

@LibreKumiho

You can take bad cameras to make it easier to hack the system. What comes next? Maybe you have to film yourself in 180° to make sure that it is not just a photo.

I tell you what comes next. Recording a video of yourself repeating random words that appear on-screen. This system is already in place with some European banks. You can’t fake it with AI either, because you’re given a short amount of time, maybe 30 seconds, and the words will only appear once you press start.