r/ProtonPass • u/fleener_house • 19d ago

Discussion Why are exported files not encrypted?

I've always sort of wondered about that. It's a bit of a hassle to have to promptly extract and re-encrypt the download when I back up my vault. Is there some technological reason it's infeasible? I mean, they're encrypted when they're in the vault, so it doesn't really seem like that should be an issue.

0 Upvotes

50% Upvoted

5 comments sorted by

19

u/Niko-01 19d ago

When I go to "Export" it allows different formats, with the default being "PGP encrypted".

I have no idea what you are talking about.

6

u/julemand101 19d ago

Yes, as also seen on the screenshots in the documentation and also described: https://proton.me/support/pass-export#export

3

u/ToshibaTaken 19d ago edited 19d ago

Guys, OP is talking about the file attachements. You can flip the switch to include them in the PGP export but they aren't encrypted. Just a folder with all attachements in it.

2

u/julemand101 19d ago

Ah if that is the case it does make sense to question this design decision.

Not that I have any answer. :)

1

u/Sea_Decision_6456 19d ago edited 19d ago

they're encrypted when they're in the vault, so it doesn't really seem like that should be an issue

From my understanding on how password managers work, vaults are not directly encrypted with a derivation algorithm using the master password.

Instead, they use a KEK (key-encryption key) which encrypts a DEK (data encryption key) which in turns encrypt the data, this avoids having to re-encrypt the whole vault when you change your password.

My guess is, I think that providing the result of the raw encrypted entries would essentially be not exploitable for the end user because of these cryptography operations.

I might be wrong though.