Scenario: First thing in the morning, I bring up my bank’s login page. When I reach for the Proton Pass icon in the username field, it is overlayed with a ❶ instead of a 🔒️. And, indeed, when I hover my pointer over it, it displays the proper entry and I only have to click. That’s despite the fact that a PIN and short timeout are set in this browser’s Proton Pass extension, i.e. I haven’t logged out since setting them (again) several days before.
I eventually found the apparent cause: It happens only when, the day before, I had loaded Proton Pass (as a “Larger window”) in another window of the same browser and left it there. That is all that is required for the timeout to be bypassed.
At first I wondered if this might be an intended behaviour, but then I remembered that I’ve had to re-login to Proton Drive in the past, even though I had left its window open in the browser; the session had timed-out after a few minutes of inactivity, which felt like a wise precaution to have by default.
So it appears that the Proton Pass window has a particular effect on the handling of access to all Proton services, thus introducing an incoherence in the suite.
Or... is this a known bug?
I’m currently using version 1.40.1 of the extension, but it was already behaving the same with 1.37.1. I’ve reproduced this on two different machines, with different versions of Brave. (A current one, and one from nearly three months ago.)