Proton Sentinel: next level account security protection for (almost) everyone
Proton, maker of Proton Mail, VPN and several other services, announced the launch of Proton Sentinel earlier today. Proton Sentinel is a security add-on for Proton accounts that enables higher levels of account security protection and support.
Proton services have grown considerably ever since the company launched Proton Mail, an email service with a strong focus on security and privacy. The launching of additional services made accounts more attractive to bad actors. While Proton's security defenses are excellent, the company has not experienced a breach, data loss or leak, it is user passwords that are a weak link in the chain. While Proton users may enable two-factor authentication to better secure their accounts, not all do, and bad actors are constantly trying to find ways to circumvent two-factor protections or trick users into providing them with the codes.
Proton Sentinel
Proton Sentinel has years of experience protecting high profile accounts according to the company. Proton claims that it is serving "high-profile people and organizations from around the world", and has been for years. These high-risk accounts are lucrative targets, considering that an attacker would gain access to a person's entire email history, files and other data.
The very same protection is now offered to Proton customers as part of Proton Sentinel. While not available to all account types, Proton Sentinel is available free of charge.
Proton explains that it is limiting access to Proton Sentinel to certain account types, because of the "expensive resources required". The following Proton accounts may enable Sentinel: Proton Unlimited, Family, and Business, along with legacy Lifetime and Visionary accounts.
To do so, Proton customers need to load their account home and go to Settings > Go to Settings > Account > Security and Privacy. There is a toggle on the page to enable or disable Proton Sentinel.
Here is what the security program entails when enabled:
- Includes advanced protections that, Proton says, are "more likely to detect and challenge suspicious events".
- Suspicious events will be escalated 24/7 to security analysts, who will "review the assessments" made by the automated systems.
- Any security-related support request is escalated to "trained security specialists".
Proton combines automated systems with human security specialists, raising protections of accounts who enable the security feature significantly.
Proton customers who enable Proton Sentinel will also gain access to additional information and security alerts. An advanced security log, for instance, lists the protective measures of Proton's systems.
Proton notes that the high-security program is not for everyone. Customers who share the account with other people and don't use two-factor authentication may not want to enable Proton Sentinel, as it may throw more login challenges at them when they try to sign-in.
Customers who are high-profile public figures, who deal with sensitive data or may be targets of cyberattacks may consider enabling Proton Sentinel to increase account protections further.
Interested users find more information about Proton Sentinel here.
Now You: do you use Proton services? Will you enable Proton Sentinel?
Proton, Tutanota, Chrome by Alphabet Inc. and Brave are examples of this trend of so called Walled Gardens…
Me and my Court meet @ our IRC Server. Public and Open. Stay Safe!
+1 to what Tom H. is saying.
I use, and recommend to clients who need it, ProtonMail. The rest of the Proton product range is not particularly unique or best-in-class (for example, I’d recommend Mullvad over ProtonVPN, although there’s nothing especially wrong with the latter).
But the above press release (and linked blog post) regarding their Sentinal product is ambiguous drivel. I’m not clear on where this product would be needed or even what it actually is. It sounds like “just trust us” scareware.
I have no Proton account.
Regarding the article and quoting two paragraphs,
“Proton Sentinel has years of experience protecting high profile accounts baked into it. Proton claims that it is serving “high-profile people and organizations from around the world”, and has been for years.”
“Customers who are high-profile public figures, who deal with sensitive data or may be targets of cyberattacks may consider enabling Proton Sentinel to increase account protections further.”
I don’t quite understand the difference between high-profile accounts who had Proton Sentinel baked into it and new high-profile public figures who’d be concerned by adopting Proton Sentinel. What sort of account did the former have which was unavailable until now for others? Were the former provided a Sentinel automatically? On what ground? Perhaps a reserved contractual relationship? I’ve never read anything on Proton Web pages referring to this “Sentinel”, so it’d be that the high-profile accounts who had Proton Sentinel baked into it got it in a non-publicized way.
I evoke this to find an argument that would remove any doubt about the promotion of a service motivated by the increase of customers. More secure than secure triggers skepticism here. Like detergent cleaning whiter than white. I can understand that “it is user passwords that are a weak link in the chain.” but to handle that, secure password requirements could provide that necessary level of security, user-side. But a “sentinel” above all that is somewhat beyond my understanding.
I think it depends on Proton’s selection process and classification of who is getting the automatic treatment of having their account protected with additional high-security protections and who not. You may be a public figure, but Proton may not give you the “high profile” treatment. Now, you can enable it to better protect the account.
I’m a since very early days proton user. As the Proton ecosystem grows I’m growing ever more cautious this is not “the way” Proton is becoming a liability and due to the ever higher degree of centralisation the Proton services are becoming exactly what they are supposed to mitigate (single points of failure)
While their software is mostly of high quality it is far from perfect. To this day i feel unwell because protonmail has a web frontend which means it builds so called security on one of the weakest components of a computer system. I still think it is naieve and ill informed, they promised my repeatedly there’s “no chance” this will become an issue now or later.
JL, do you have a statement from Proton that said they were trying to mitigate against single points of failure? They are a company offering security products.
As to the services offered, I just started testing Proton and so far it is smooth. I like the mail interface as well as the mobile app, though I wish the mobile app would offer to save emails to device, and I wish it wasn’t reliant on GP Services on Android.
I especially like Proton Pass. It seems to work very well and doesn’t try to be a nuisance like 1Password does. I haven’t tested much of the other products yet, and I don’t think I will be using Sentinel as I am not that paranoid.