Proton Pass is now available for everyone.
As the name suggests, Proton Pass is an encrypted password manager, one
of the most highly demanded services from the Proton community in our
annual surveys. <https://proton.me/pass/download>

Jörg Lorenz <hugybear@gmx.ch> wrote:
> Am 05.08.23 um 06:00 schrieb Proton Manager:
> >
> > Proton Pass is now available for everyone.
> > As the name suggests, Proton Pass is an encrypted password manager, one
> > of the most highly demanded services from the Proton community in our
> > annual surveys. <https://proton.me/pass/download>
>
> X-posting over four groups with a fake identity?
> Even worse: Using one of the worst Troll-servers.
> Not really helping your case ...

Well, he's not actually *using* "one of the worst Troll-servers", but
*faking* that he's using it:

> Path: news.solani.org!!weretis.net!reader5.news.weretis.net!feeder8.news.weretis.net!eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail

> Organization: Aioe.org NNTP Server

I.e. using news.eternal-september.org, but faking Aioe.org (which is
no longer online).

Frank Slootweg <this@ddress.is.invalid> wrote:

> Jörg Lorenz <hugybear@gmx.ch> wrote:
>> Am 05.08.23 um 06:00 schrieb Proton Manager:
>>>
>>> Proton Pass is now available for everyone.
>>> As the name suggests, Proton Pass is an encrypted password manager, one
>>> of the most highly demanded services from the Proton community in our
>>> annual surveys. <https://proton.me/pass/download>
>>
>> X-posting over four groups with a fake identity?
>> Even worse: Using one of the worst Troll-servers.
>> Not really helping your case ...
>
> Well, he's not actually *using* "one of the worst Troll-servers", but
> *faking* that he's using it:
>
>> Path: news.solani.org!!weretis.net!reader5.news.weretis.net!feeder8.news.weretis.net!eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
>> Organization: Aioe.org NNTP Server
>
> I.e. using news.eternal-september.org, but faking Aioe.org (which is
> no longer online).

Where in the PATH header is an AIOE node? The injection node is the
first node after which each subsequent peering host gets prepended as a
node in PATH, so the route is read right to left. You mention him
faking using AIOE, but you also show the PATH header in your claim. The
PATH header is not involved in him faking his injection node.

What he did do is use a non-blank Organization header that misleads to
him using AIOE. If the Organization header is absent (the client did
not include it) then the server may optionally add its own. If the
client did specify a non-blank Orgranization header, the server is to
step aside and keep the one the client specified. Why he uses a value
for the Organization header that has anything to do with his choice of
Usenet provider, real or not, is odd. He should pick a value that
relates to his presence.

The same goes for the Message-ID header: if absent from the client
submission then the server adds it, else if present in the client's
submission then the server leaves it. ES uses <token@dont-email-me> for
their server-added MID header; however, since he is faking the
Organization header he could be faking his MID header, too. Yet the
PATH header's injection node does show he submitted to the ES server.

There are some NNTP servers that permit pre-loading the PATH header.
The user can inject their own node into the PATH header, but the Usenet
provider requires that same user to append "!<providernode>" to PATH, so
it still looks like "...!<usernode>!<providernode>". Yet, although the
policy is to append the provider's domain to the user-added node, such
Usenet providers don't actually test submissions to enforce that policy.
Providers that allow pre-loading the PATH header will permit their users
to lie about the injection node. Alt.net was one of these untrustworthy
Usenet providers.

His Content-Language header also looks to be fake. It is for web
documents (pages), not Usenet posts. swiss is not a valid language tag.
For swiss, "CH" (Confoederatio Helvetica) would be somewhere in the
language tag which happens to also be the ccTLD (country code top-level
domain) for Switzerland. The .swiss ccTLD got added in 2014 to
supplement the traditional .ch ccTLD, but .swiss is a TLD, not a
language tag since Switzerland has 4 national languages. For the
Content-Language header to be viable, standard tags must be used, not
some user-specified arbitrary string. In addition, Content-Language is
an entity header added by the server but rarely used by clients, in
contrast to the Accept-Language header issued by web clients expresses
their language preference. In an HTML document to specify the language
for the page, use the lang attribute.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Language
https://en.wikipedia.org/wiki/Language_code

While he presents a fake Organization header, he also chose to hide
which NNTP client he uses by not including the User-Agent header. Guess
he wants that to be a secret. Or, he used a web-based Usenet client,
like those many web-based (HTTP) forums that leech from Usenet to
pretend they have larger groups, and the HTTP-to-NNTP proxy doesn't
identify itself, and also adds the Content-Language header (with
incorrect value) which is inappropriate to Usenet.

While Proton Pass (https://proton.me/pass) is free, it only comes as a
web browser extension on desktop PCs. Available as Android or iOS app
for smartphones. While this has Proton Pass focused on passwords
entered via web browser, the Web is not the only only place you may use
passwords.

In article <uaki8n$1kiac$1@dont-email.me>
Proton Manager <Proton@invalid.invalid> wrote:
>
>
> Proton Pass is now available for everyone.
> As the name suggests, Proton Pass is an encrypted password manager, one
> of the most highly demanded services from the Proton community in our
> annual surveys. <https://proton.me/pass/download>

I don't trust password managers. I put all my passwords into a text
file and then encrypt it with PGP.

I think his multi x-posting of this link is fine. There are jerkos
who x-post a lot worse useless crap.

In alt.comp.os.windows-11 VanguardLH <V@nguard.lh> wrote:
> Frank Slootweg <this@ddress.is.invalid> wrote:
>
> > Jörg Lorenz <hugybear@gmx.ch> wrote:
> >> Am 05.08.23 um 06:00 schrieb Proton Manager:
> >>>
> >>> Proton Pass is now available for everyone.
> >>> As the name suggests, Proton Pass is an encrypted password manager, one
> >>> of the most highly demanded services from the Proton community in our
> >>> annual surveys. <https://proton.me/pass/download>
> >>
> >> X-posting over four groups with a fake identity?
> >> Even worse: Using one of the worst Troll-servers.
> >> Not really helping your case ...
> >
> > Well, he's not actually *using* "one of the worst Troll-servers", but
> > *faking* that he's using it:
> >
> >> Path: news.solani.org!!weretis.net!reader5.news.weretis.net!feeder8.news.weretis.net!eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
> >> Organization: Aioe.org NNTP Server
> >
> > I.e. using news.eternal-september.org, but faking Aioe.org (which is
> > no longer online).
>
> Where in the PATH header is an AIOE node? The injection node is the
> first node after which each subsequent peering host gets prepended as a
> node in PATH, so the route is read right to left. You mention him
> faking using AIOE, but you also show the PATH header in your claim. The
> PATH header is not involved in him faking his injection node.

Sigh! Try to read for comprehension! And please don't try to 'teach'
*me* about NetNews headers (or NetNews in general).

I didn't say he's faking the Path: or/and the injection node. I said
"he's not actually *using* "one of the worst Troll-servers" [FS:
Aioe.org], but *faking* that he's using it:". *Obviously* the faking is
done in the (*also* quoted) Organization: header.

[What we Dutch call 'kicking in an open door' episode deleted.]

On 8/5/2023 11:31 AM, Frank Slootweg wrote:

> "he's not actually *using* "one of the worst Troll-servers"

If you are trying to promote a piece of software that
relies on "trust", this is not a particularly good way to do it.

I presume the individual is a "de-moter" rather than a "pro-moter".

I guess my PostIt notes with the passwords written on it, is
safe for another year :-/

Paul

On 8/5/2023 12:03 PM, Paul wrote:
> On 8/5/2023 11:31 AM, Frank Slootweg wrote:
>
>> "he's not actually *using* "one of the worst Troll-servers"
>
> If you are trying to promote a piece of software that
> relies on "trust", this is not a particularly good way to do it.
>
> I presume the individual is a "de-moter" rather than a "pro-moter".
>
> I guess my PostIt notes with the passwords written on it, is
> safe for another year :-/
>
> Paul

As is my Rolodex :-)

In article <14k3mqnvrrkqc.dlg@v.nguard.lh>
VanguardLH <V@nguard.LH> wrote:
>
> Frank Slootweg <this@ddress.is.invalid> wrote:
>
> > J�rg Lorenz <hugybear@gmx.ch> wrote:
> >> Am 05.08.23 um 06:00 schrieb Proton Manager:
> >>>
> >>> Proton Pass is now available for everyone.
> >>> As the name suggests, Proton Pass is an encrypted password manager, one
> >>> of the most highly demanded services from the Proton community in our
> >>> annual surveys. <https://proton.me/pass/download>
> >>
> >> X-posting over four groups with a fake identity?
> >> Even worse: Using one of the worst Troll-servers.
> >> Not really helping your case ...
> >
> > Well, he's not actually *using* "one of the worst Troll-servers", but
> > *faking* that he's using it:
> >
> >> Path: news.solani.org!!weretis.net!reader5.news.weretis.net!feeder8.news.weretis.net!eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
> >> Organization: Aioe.org NNTP Server
> >
> > I.e. using news.eternal-september.org, but faking Aioe.org (which is
> > no longer online).
>
> Where in the PATH header is an AIOE node? The injection node is the
> first node after which each subsequent peering host gets prepended as a
> node in PATH, so the route is read right to left. You mention him
> faking using AIOE, but you also show the PATH header in your claim. The
> PATH header is not involved in him faking his injection node.
>
> What he did do is use a non-blank Organization header that misleads to
> him using AIOE. If the Organization header is absent (the client did
> not include it) then the server may optionally add its own. If the
> client did specify a non-blank Orgranization header, the server is to
> step aside and keep the one the client specified. Why he uses a value
> for the Organization header that has anything to do with his choice of
> Usenet provider, real or not, is odd. He should pick a value that
> relates to his presence.
>
> The same goes for the Message-ID header: if absent from the client
> submission then the server adds it, else if present in the client's
> submission then the server leaves it. ES uses <token@dont-email-me> for
> their server-added MID header; however, since he is faking the
> Organization header he could be faking his MID header, too. Yet the
> PATH header's injection node does show he submitted to the ES server.
>
> There are some NNTP servers that permit pre-loading the PATH header.
> The user can inject their own node into the PATH header, but the Usenet
> provider requires that same user to append "!<providernode>" to PATH, so
> it still looks like "...!<usernode>!<providernode>". Yet, although the
> policy is to append the provider's domain to the user-added node, such
> Usenet providers don't actually test submissions to enforce that policy.
> Providers that allow pre-loading the PATH header will permit their users
> to lie about the injection node. Alt.net was one of these untrustworthy
> Usenet providers.
>
> His Content-Language header also looks to be fake. It is for web
> documents (pages), not Usenet posts. swiss is not a valid language tag.
> For swiss, "CH" (Confoederatio Helvetica) would be somewhere in the
> language tag which happens to also be the ccTLD (country code top-level
> domain) for Switzerland. The .swiss ccTLD got added in 2014 to
> supplement the traditional .ch ccTLD, but .swiss is a TLD, not a
> language tag since Switzerland has 4 national languages. For the
> Content-Language header to be viable, standard tags must be used, not
> some user-specified arbitrary string. In addition, Content-Language is
> an entity header added by the server but rarely used by clients, in
> contrast to the Accept-Language header issued by web clients expresses
> their language preference. In an HTML document to specify the language
> for the page, use the lang attribute.
>
> https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Language
> https://en.wikipedia.org/wiki/Language_code
>
> While he presents a fake Organization header, he also chose to hide
> which NNTP client he uses by not including the User-Agent header. Guess
> he wants that to be a secret. Or, he used a web-based Usenet client,
> like those many web-based (HTTP) forums that leech from Usenet to
> pretend they have larger groups, and the HTTP-to-NNTP proxy doesn't
> identify itself, and also adds the Content-Language header (with
> incorrect value) which is inappropriate to Usenet.
>
> While Proton Pass (https://proton.me/pass) is free, it only comes as a
> web browser extension on desktop PCs. Available as Android or iOS app
> for smartphones. While this has Proton Pass focused on passwords
> entered via web browser, the Web is not the only only place you may use
> passwords.

Jesu Christo!

Who gives a damn 'bout all that crap?

On 8/4/23 23:00, Proton Manager wrote:
>
> Proton Pass is now available for everyone.
> As the name suggests, Proton Pass is an encrypted password manager, one
> of the most highly demanded services from the Proton community in our

Does it store the decryption keys on the server with your passwords,
like proton's ``secure'' mail does?

On 2023-08-08 10:27 a.m., rdh wrote:
> On 8/4/23 23:00, Proton Manager wrote:
>>
>> Proton Pass is now available for everyone.
>> As the name suggests, Proton Pass is an encrypted password manager, one
>> of the most highly demanded services from the Proton community in our
>
> Does it store the decryption keys on the server with your passwords,
> like proton's ``secure'' mail does?

ProtonMail is a fraud, use Posteo.de.

--
RabidPedagog
TG: @RabidPedagog
Galatians 6:7

<Matt@WhoCares.org> wrote:

<snipped the header discussion Matt doesn't give a gnat's fart about>

> Jesu Christo!
> Who gives a damn 'bout all that crap?

Learn to have fun. Never play a trivia game? If so, did you bitch
about wee bits of info that you deem crap? You're no fun at parties.

rdh <rdh@tilde.institute> wrote:

> Proton Manager wrote:
>
>> Proton Pass is now available for everyone.
>> As the name suggests, Proton Pass is an encrypted password manager, one
>> of the most highly demanded services from the Proton community in our
>
> Does it store the decryption keys on the server with your passwords,
> like proton's ``secure'' mail does?

For Proton Mail:

https://proton.me/support/how-is-the-private-key-stored
https://proton.me/support/download-public-private-key

You can add a password to your account, or even to a particular mailbox.
They would have to brute force key regeneration since they wouldn't have
your password used to create the private key. No encryption is 100%
protected. It just makes it tough to find the right one (which could be
on the 1st try, or never in millions of tries which should generate an
alert to Proton about excessive super-rapid login attempts that would
get your account locked or suspended).

My guess is Proton already has a scheme setup for Proton Mail, and
likely reuses it for their Proton Pass. In addition, they added 2FA to
help better protect against hacking into your account. Even Proton
won't have your phone or security key.

https://proton.me/support/pass-2fa

No such thing as 100% security in electronics. Even a bunker can be
destroyed with a non-nuke bunker buster bomb. You're just creating
higher hurdles for hackers to jump.

Proton attempts to secure your data. What do you use now you think is
more secure? Please elaborate. I'm curious to know.

On Sun, 6 Aug 2023 07:10:49 -0400, DMP wrote:

>> I guess my PostIt notes with the passwords written on it, is
>> safe for another year :-/
>>
>> Paul
>
> As is my Rolodex :-)

As is my keepassXC which works on all the common PC & phone platforms.
https://keepassxc.org/download/

Why would he bother faking aoie when there's nothing wrong with eternal
september (especially given Paolo Amaroso shut down aioe.org long ago)?

Patron Saint wrote:
> Why would he bother faking aoie when there's nothing wrong with eternal
> september (especially given Paolo Amaroso shut down aioe.org long ago)?

Maybe he chose to configure some unknown agent that way back in the past
when he was using aioe; and then didn't bother to change it when he went
to e-s. A stale config line.

Maybe he is/was an aioe 'supporter'/fan then.

I think that same line content was so stamped by aioe back when msg/s
were posted via that server.

--
Mike Easter

On 8/19/2023 5:52 PM, Mike Easter wrote:
> Patron Saint wrote:
>> Why would he bother faking aoie when there's nothing wrong with eternal september (especially given Paolo Amaroso shut down aioe.org long ago)?
>
> Maybe he chose to configure some unknown agent that way back in the past when he was using aioe; and then didn't bother to change it when he went to e-s.  A stale config line.
>
> Maybe he is/was an aioe 'supporter'/fan then.
>
> I think that same line content was so stamped by aioe back when msg/s were posted via that server.
>

This particular pattern has been done before, which means
odds are, the author of the post is a <cough> "regular".

I just don't see the rationale for grasping at every shiny
piece of software that comes along. Password managers have
a pretty spotty history at the best of times. The bar is high
for those puppies.

If you had a password manager you'd been using for a few years,
the issues and exploits appeared minimal, staying with your
choice would likely be safer than starting from scratch to
calibrate another one.

It might be different with a new movie player, where if it
breaks or can't play a format, it's not the end of the world.

Paul

Paul wrote:
> I just don't see the rationale for grasping at every shiny
> piece of software that comes along. Password managers have
> a pretty spotty history at the best of times. The bar is high
> for those puppies.

What makes 'sense' is what Proton is doing in their 'overall' scheme or
mission.

They came up w/ a secure mail idea; they offered it free and wove it
into free/pay. They continued to enhance the 'value added' aspect of
that model via Tor and pgp, building their security reputation.

Then they expanded into VPN, free/pay, and did a good job of that. Now
there are more value added services, Calendar and Password mgr as part
of the larger package.

'Another' free pw mgr may not make sense from a 'freeware' perspective,
but as part of a much larger value added pay service it is another
attraction or 'leader' or 'bait' if one looks upon capitalism unkindly.

Proton has open-sourced most of what it does, because what it is really
selling is the support and service, not the software.

--
Mike Easter

Paul <nospam@needed.invalid> wrote:
> On 8/19/2023 5:52 PM, Mike Easter wrote:
>> Patron Saint wrote:
>>> Why would he bother faking aoie when there's nothing wrong with eternal
>>> september (especially given Paolo Amaroso shut down aioe.org long ago)?
>>
>> Maybe he chose to configure some unknown agent that way back in the past
>> when he was using aioe; and then didn't bother to change it when he went
>> to e-s.  A stale config line.
>>
>> Maybe he is/was an aioe 'supporter'/fan then.
>>
>> I think that same line content was so stamped by aioe back when msg/s
>> were posted via that server.
>>
>
> This particular pattern has been done before, which means
> odds are, the author of the post is a <cough> "regular".
>
> I just don't see the rationale for grasping at every shiny
> piece of software that comes along. Password managers have
> a pretty spotty history at the best of times.

Spotty how?

>The bar is high
> for those puppies.

Indeed, but they are plenty good options

On Sun, 20 Aug 2023 08:10:06 -0700, Mike Easter wrote:
> Paul wrote:
>> I just don't see the rationale for grasping at every shiny
>> piece of software that comes along. Password managers have
>> a pretty spotty history at the best of times. The bar is high
>> for those puppies.
>
> What makes 'sense' is what Proton is doing in their 'overall' scheme or
> mission.

You seem to understand Proton's mission, but me, not understanding it, I do
kind of agree with Paul that a free password manager has "issues" in that
if it is (what he calls) spotty, then you've just lost all your passwords.

Luckily, KeepassXC is venerable, as is VeraCrypt and the Mozilla Tor
Browser. What I'd like to see more "free stuff" is proxy-enabled browsers.

I use Epic & Opera proxy browsers (often called vpn browsers) but a lot of
cloudflare web sites are filtering the proxies out more and more over time.
> They came up w/ a secure mail idea; they offered it free and wove it
> into free/pay. They continued to enhance the 'value added' aspect of
> that model via Tor and pgp, building their security reputation.

The Proton Mail free account works well enough for low message content
(which is most of us, as it's something like 150 messages per day).

It's really slow on the Mozilla Tor Browser, surprisingly but at least it
has an onion address when you're logging in from the Mozilla Tor Browser.

> Then they expanded into VPN, free/pay, and did a good job of that. Now
> there are more value added services, Calendar and Password mgr as part
> of the larger package.

I'm not familiar with proton's free VPN. Usually the "free" offerings
require an account (which defeats the whole point of VPN) and worse than
requiring an account to track you, most free offerings are really fremium
in that you have to give them a credit card first. That's worthless.

Let me look it up to see if it requires an "account" & CC or not.
https://protonvpn.com/free-vpn

Darn. It requires an account (which pretty much makes its VPN worthless).
Worse, paradoxically it won't use a protonmail account.

Worse still, it wouldn't take a mailinator account, so I gave up.
> 'Another' free pw mgr may not make sense from a 'freeware' perspective,
> but as part of a much larger value added pay service it is another
> attraction or 'leader' or 'bait' if one looks upon capitalism unkindly.
>
> Proton has open-sourced most of what it does, because what it is really
> selling is the support and service, not the software.

It seems like you understand proton mail's strategy, which I have nothing
against, where I personally use the proton mail, but nothing else yet.

If you know of a throw-away email domain that the VPN will accept, let me
know as a VPN that you're logged into is just about the worse thing to do.

Patron Saint wrote:
> If you know of a throw-away email domain that the VPN will accept, let me
> know as a VPN that you're logged into is just about the worse thing to do.

At the time I wanted to get a free Proton VPN, I didn't have any trouble
finding a throwaway; but that is a 'dynamic' variable. Now the place I
used requires 'invites' and for all I know, maybe Proton doesn't even
take their email addies anymore. I don't really want to recommend it;
except to say that I didn't find it that hard to do.

(And) Depending on how 'obscure' and anonymous one wants to be, there
are all kinds of problems to overcome, not the least of which is
anonymizing your connectivity, such as 'free' connectivity which can be
hard to find.

--
Mike Easter

On Sun, 20 Aug 2023 14:23:52 -0700, Mike Easter wrote:
>> If you know of a throw-away email domain that the VPN will accept, let me
>> know as a VPN that you're logged into is just about the worse thing to do.
>
> At the time I wanted to get a free Proton VPN, I didn't have any trouble
> finding a throwaway; but that is a 'dynamic' variable. Now the place I
> used requires 'invites' and for all I know, maybe Proton doesn't even
> take their email addies anymore. I don't really want to recommend it;
> except to say that I didn't find it that hard to do.

Thanks for that observation, where I've used a variety of throwaway mails
in the past, but it was surprising that Protonmail VPN won't even take
their own domain.

As a secondary VPN perhaps (since it requires a login account no matter
what IP address you connect to it from) the Protonmail VPN might still be
useful as the bandwidth is presumed to be good (but "unlimited" doesn't
mean it's fast - it just means you can have as many (fast? slow?) bits as
you like).

In short, the main drawback of the Protonmail VPN is (a) you have to have
an account and (b) you have to have an email that they'll accept for that
account - but other than that, it seems like an OK deal.

Thank you for suggesting it as I know you have pointed to VPN rating
systems in the past (e.g., are they offshore) and you've pointed out no
matter what they say, they must keep logs (at least temporarily), etc.,
but my needs are mostly for the IP switching effect of the VPN as I'm not
running (yet) away from any TLA.

> (And) Depending on how 'obscure' and anonymous one wants to be, there
> are all kinds of problems to overcome, not the least of which is
> anonymizing your connectivity, such as 'free' connectivity which can be
> hard to find.

It turns out, pragmatically anyway, the free connections are more anonymous
(simply because there is nothing to trace to you except your IP address).

However, I'm very well aware you're a proponent of the "you are the
customer" aspect of free services, and while that may very well be, if you
use a VPN that doesn't have any link to you (other than to whatever IP
address you're connecting from) and if you use openvpn software (instead of
the proprietary VPN-servers' software) and if you use encryption as much as
possible (e.g., proxy-based and tor-based browsers - although the whole
point of system-wide vpn is to handle more than browsing, such as torrents,
email and nntp messaging) - then all they have to tie to you is (a) what IP
address you connected with (admittedly damning) and (b) what you do.

Mostly I use VPN for IP anonymity to the final Internet server (e.g., to
the torrent server or to the nntp server or to the email server, etc.).

Patron Saint <patron@saint.com> wrote:
> On Sun, 20 Aug 2023 08:10:06 -0700, Mike Easter wrote:
>> Paul wrote:
>>> I just don't see the rationale for grasping at every shiny
>>> piece of software that comes along. Password managers have
>>> a pretty spotty history at the best of times. The bar is high
>>> for those puppies.
>>
>> What makes 'sense' is what Proton is doing in their 'overall' scheme or
>> mission.
>
> You seem to understand Proton's mission, but me, not understanding it, I do
> kind of agree with Paul that a free password manager has "issues" in that
> if it is (what he calls) spotty, then you've just lost all your passwords.

Only if you use the worst examples of pw managers. Good ones will cache
your pw database locally or you're in control of where it is. No risk from
being "spotty".

On Mon, 21 Aug 2023 07:04:59 -0000 (UTC), Chris wrote:
>> You seem to understand Proton's mission, but me, not understanding it, I do
>> kind of agree with Paul that a free password manager has "issues" in that
>> if it is (what he calls) spotty, then you've just lost all your passwords.
>
> Only if you use the worst examples of pw managers. Good ones will cache
> your pw database locally or you're in control of where it is. No risk from
> being "spotty".

Remember, this proton mail thing is a new product so we have to assume it
can be spotty (i.e., perhaps one of the worst examples of pw managers).

Also there are two pw manager fundamental models, local and cloud storage.
Model 1 = keepassxc => nothing leaves the local device, no account exists
Model 2 = lastpass => everything is stored in an account on their servers

While there is an inherent ease-of-use advantage to storing all your
passwords on someone else's server (in an account that they can lock you
out of at any time), there's also a _different_ inherent advantage of
storing all your passwords in a file you completely control and simply sync
between your own devices only (& where you might forget your own password).

Which of those two types is this new "Proton Pass" password manager?

Patron Saint wrote:
> Remember, this proton mail thing is a new product so we have to
> assume it can be spotty (i.e., perhaps one of the worst examples of
> pw managers).

Proton pass is open source and has been audited by

> This report describes the results of a security assessment of the
> Proton complex, more specifically covering the Proton Pass mobile
> applications and browser addon, as well as the web application
> and backend API endpoints. The project, which included
> a penetration test and a wider review of the security posture, was
> carried out by Cure53 in May 2023.

https://drive.proton.me/urls/AS97HV90MW#1RzmiLrBTUg4

There is a rather extensive Conclusions in there, which I don't know
which issues have been addressed.

I don't use PP so I have no experience w/ it, but it is a browser
extension available for multiple browsers Brave Firefox Edge Chrome and
Android & iOS.

--
Mike Easter

Patron Saint <patron@saint.com> wrote:
> On Mon, 21 Aug 2023 07:04:59 -0000 (UTC), Chris wrote:
>>> You seem to understand Proton's mission, but me, not understanding it, I do
>>> kind of agree with Paul that a free password manager has "issues" in that
>>> if it is (what he calls) spotty, then you've just lost all your passwords.
>>
>> Only if you use the worst examples of pw managers. Good ones will cache
>> your pw database locally or you're in control of where it is. No risk from
>> being "spotty".
>
> Remember, this proton mail thing is a new product so we have to assume it
> can be spotty (i.e., perhaps one of the worst examples of pw managers).
>
> Also there are two pw manager fundamental models, local and cloud storage.
> Model 1 = keepassxc => nothing leaves the local device, no account exists
> Model 2 = lastpass => everything is stored in an account on their servers

There's also a third model where you pay for a service via an account and
you also keep control of your files. You can put them on a cloud service of
your choice.

On Mon, 21 Aug 2023 07:04:59 -0000 (UTC), Chris <ithinkiam@gmail.com>
wrote:

>Patron Saint <patron@saint.com> wrote:
>> On Sun, 20 Aug 2023 08:10:06 -0700, Mike Easter wrote:
>>> Paul wrote:
>Only if you use the worst examples of pw managers. Good ones will cache
>your pw database locally or you're in control of where it is. No risk from
>being "spotty".

You mean like the MS Word document I use?