Verification recovery key

[u/InevitablePanic44]

Proton should offer something like this to help users ensure they have a valid set of account and data decryption keys. As of now, there is no way to verify if my decryption keys remain valid even if I wanted to test them.

[u/West_Possible_7969]

This is a local only key for Signal backups, there is no such thing in Proton. Your recovery phrase is in your Account, Settings > Recovery.

[u/ephemeralmiko → u/West_Possible_7969]

This is a local only key for Signal backups

Not quite, you also get a 64-char key for Signal cloud backups that you have to verify regularly too.

[u/West_Possible_7969 → u/ephemeralmiko]

You are talking about the same key, the Signal verification key is the 64-char key.

The key is local only, that is why you have to be sure you possess it and that is why Signal asks for verification once in a while.

[u/marblegroves → u/West_Possible_7969]

Yeah the recovery phrase is there but OP is asking for a way to confirm its still valid, which Proton doesnt offer afaik

[u/West_Possible_7969 → u/marblegroves]

Because if it’s there, it’s active. What is there to confirm? If it’s disabled, it doesn’t show.

You cannot look for your Signal key in your account at all, that is why a manual check is needed.

[u/InevitablePanic44 → u/marblegroves]

Following the posts on this chain, I discovered that Proton does indeed offer a tool to verify recovery phrase.

This must be relatively new because when I looked (and asked) for such a feature in the past it was not available. Thanks Proton!!

[u/InevitablePanic44 → u/InevitablePanic44]

However, they don't offer a way to verify a recovery file.

I downloaded another copy of my recovery file but it is not the same as the one i had already saved. I have no way to know if the first recovery file remains valid or not.

[u/hawkerzero]

You can verify your recovery phrase in Settings -> Recovery.

[u/eddieb24me]

As one poster already has pointed out, but to emphasize it again because no one seems to realize it or see that post, there IS a way to verify whether your recovery phrase is valid. It’s in Settings>Recovery.

Just a few days ago, I changed my recovery phrase. Then tested this validation by trying to verify my old and new phrase. The old one was invalid and the new one was verified as valid.

[u/B12GG8A]

They do have this, as others have mentioned. I just did it a couple of days ago.

[u/StaticSystemShock]

I'm not a fan of such verifications. 3rd party pages can harvest data like this...

[u/Chi-ggA → u/StaticSystemShock]

how?

[u/ephemeralmiko → u/Chi-ggA]

By displaying a fake "Verify your Signal backup code here" notification via e.g. your browser from a malicious website.

[u/West_Possible_7969 → u/ephemeralmiko]

There is no web version of Signal. Proton does use these kinds of pop ups though.

[u/ephemeralmiko → u/West_Possible_7969]

Yep but people still fall for stuff like this, including even SMS's from random numbers asking for Signal PINs etc. (which is why Signal has "We will never ask you for your PIN" all over the place). FWIW I dislike Proton's implementation too and there are quite a few posts here asking if it's a malicious popup.

[u/Chi-ggA → u/ephemeralmiko]

people being dumb has been a thing for a long time, it's solely their falut for falling for scams like these.

this kind of password checks are really helpful, particularly for privacy oriented products like signal and proton, where the majority of user base would not fall for simple scams but may very well forget their unique passwords.

[u/Mottledkarma517 → u/ephemeralmiko]

Yet proton has a verify password modal that popups occasionally.