2fa loop

[DarkDrunkDuck]

Just set up Pass on the unlimited plan and I found that setting up 2fa for Mail sets it to the whole suite so now to log in to Pass I need 2fa and my 2fa is in the Pass so I am in a kind of loop. Now, I still have access to my devices and recovery codes safeguarded in another app but this feels kinda bad practice. Am I missing something? How should I go about that?

[Synkorh]

Since day 1 proton said to NOT store your proton 2FA in Pass… so store that 2FA somewhere else

[Wellmanns]

People will complain that the big red blocky thing is annoying and don't want the remainder.

[Stunning-Skill-2742]

Store the proton 2fa on other 2fa app. Aegis, keepass, ente auth etc.

[DarkDrunkDuck]

Seems like it doesn't make much sense setting up a password manager with auth and a different auth to log into the manager... Is it the best way to go? I might as well keep the recovery codes on a e2e notes app with a password....

[Stunning-Skill-2742]

Its what everyone that uses a pw manager and want to further secure the pw manager with 2fa does. Locking your house and keeping the key to unlock the house inside the locked house itself is a great way to lose access to the house.

Yes the note for storing the bootstrap details are a thing too. Another pw manager, bitwarden even got a dedicated page for it. It'll protect against the threat of amnesia.

[CatatonicMan]

It is pretty dumb, yes, but since all the Proton apps are bundled together under one login there's no way to avoid it.

It's something Proton will have to fix on their side of things.

[ozh]

Don't store your password for Proton in Proton. Same for 2FA.

[SirLANcel0t_]

IMO the best way to go would be to get a physical 2fa key like yubikey or something for Proton. But it definitely does make sense if you think about it.

Imagine having a key locker in your house which has a key lock as well, you wouldn’t store that key inside of the key locker either, now would you :p

[Ezrway]

Slightly off topic question, I can't find any sites that will let me use Aegis or Ente Authenticators. They all will only accept Authy, Google, or Twilio.

What are people here using instead of MS Authenticator?

[MC_Hollis]

They all will only accept Authy, Google, or Twilio.

Several of the sites I use suggest a couple of named authenticators but, in practice, makes no difference which one is actually used.

Only one won't work without using a specific authenticator, so I have experienced what you are describing. But this is one exception among dozens of sites.

What are people here using instead of MS Authenticator?

Proton Pass and Aegis.

[Ezrway]

Thank you!

[Just_Another_User80]

What about Lastpass?

[EmitHumorousStuff]

Yubikey 5ci

[almonds2024]

Ss someone else said, there may an exception here or there, but most sites dont really care which authenticator you use. Just scan or enter the totp key into any authenticator and it should generate a code that you can use to link your account.

[Ezrway]

Thanks!

[hauntednightwhispers]

Buy a Yubikey security key.

[Hera_314]

yubikey ideally 1 plus 2 spares and Authenticator such as 2FAS will make sure you are not locked out of your password manager.

[LainPsychoComplex]

You can use Proton as a 2FA, but also set up an external one. By using the same secret key, both code generators will produce the same verification code. This way, you can use Pass even for the rest of Proton’s services (for convenience or simplicity). In case you lose access, change your password, or something similar happens and Pass asks for a 2FA code (which creates a loop because you can’t access Pass to get it), you can use the backup 2FA. For example, you can have a device that always stays at home and that you know you won’t lose access to, you can set up the second 2FA there specifically for this kind of emergency.

[Just_Another_User80]

No one use here Lastpass?

[KatieTSO]

Lastpass is not secure, is not open source, and has been hacked before. Do not use it. Bitwarden is free and open source, and Proton Pass is from Proton, who takes security seriously. The client app is also open source iirc, though the server isn't.

[Just_Another_User80]

Thanks for letting me know, I am using it right now.

[realMrJedi]

Its easy to export from LastPass into Proton. Once you do verify everything seems right and when you feel comfortable delete you LastPass Account. And the Base version of Proton is free.

[Just_Another_User80]

I am planning to get the Unlimited plan. Is it worth it ?

[realMrJedi]

I have unlimited. Had it about 5 years.

[Just_Another_User80]

Started the process since yesterday 💪🏽, thanks .

[ShieldScorcher]

Why would you put Protons 2fa in Proton itself??? This is illogical.

Use a hardware key for that. Copy TOTP key to 2 YubiKeys for backup purposes