Proton
Empowering you to choose a better internet where privacy is the default. Protect yourself online with Proton Mail, Proton VPN, Proton Calendar, Proton Drive. Proton Pass and SimpleLogin.
Proton Mail is the world's largest secure email provider. Swiss, end-to-end encrypted, private, and free.
Proton VPN is the world’s only open-source, publicly audited, unlimited and free VPN. Swiss-based, no-ads, and no-logs.
Proton Calendar is the world's first end-to-end encrypted calendar that allows you to keep your life private.
Proton Drive is a free end-to-end encrypted cloud storage that allows you to securely backup and share your files. It's open source, publicly audited, and Swiss-based.
Proton Pass Proton Pass is a free and open-source password manager which brings a higher level of security with rigorous end-to-end encryption of all data (including usernames, URLs, notes, and more) and email alias support.
SimpleLogin lets you send and receive emails anonymously via easily-generated unique email aliases.
view the rest of the comments
Yes. The concern is that if your account for your password manager is compromised, your passwords and 2FA tokens are both compromised. Whereas if you kept your 2FA in a different account, only your passwords are compromised. All services work this way. Proton has suggested creating a second account for your 2FA codes, even though it violates their own ToS.
That's why I tell everyone I know to get their own domain. Not just for email, but for a variety of things. If nothing else, I run a Linkstack that has all of my personal information, so when people ask me for it, I send them there, and let them contact me however they wish. I've actually managed to get it to the top of the Google search results somehow so people can just Google me and easily find it as well. It grants you a whole lot of autonomy over your digital identity.
Changing your email host is just a matter of a simple DNS config change. When I changed from Google it was indeed a nightmare. Several companies I realized don't even have mechanisms to change your email address because it is actually your identity in their system. I had to delete my account and open a new one. They had no other mechanism. Which is absurd. Other companies would send some things to my new email and other (important) things would continue to be sent to my old email, for reasons no one would explain to me. They are simply not technologically equipped to handle this sort of change. All in all it took about a year before I was comfortable deleting my Google account.
Thank you for your reply!
I understand the concern of having 2FA and Password vault under 1 account. This creates a single factor to access everything and is indeed a security risk.
I should have been clearer, but what I meant is: "Why is the use of Proton Pass considered problematic, with the reason 'dont put all eggs in one basket'?"
I just realized it's because of the same thing: mail is used as MFA too.
Proton Pass specifically, is not problematic. The problematic part is just having both passwords and TOTP keys in the same vault (basket).