Pros of Proton Pass over bitwarden

• Much better UI/UX (in terms of looks and ease to navigate)
• The app is feels much faster than Bitwarden’s, maybe its not objectively, but it feels lightyears ahead in terms of >speed
• Possibility for separate email and username fields
• more seamless integration with simplelogin aliases than what Bitwarden has
• TOTP is available in the free version

1. Bitwarden is currently working on redesigning their apps, which will also include new native mobile apps that will fix the current speed issues. You can already test them if you are interested.

2. Even if Bitwarden doesn’t have as straightforward implementation regarding the separate email and username fields, you can easily use custom fields to solve this issue. As you also noted, Bitwarden will also autofill these.

3. Even though Proton’s SimpleLogin implementation is more simple and likely easier to use compared to Bitwarden, it also poses a serious lock-in issue with Proton Pass. If you ever decide to downgrade to a free plan, Proton will disable all your aliases that go beyond the max limit (10) in the free plan. This is a big contrast to even SimpleLogin that will keep all of your aliases operational even if you downgrade to the free plan. I would also take Bitwarden’s alias implementation over Proton Pass because they support multiple different aliasing providers compared to just SimpleLogin. In the past I have had issues registering a SimpleLogin alias for some sites, so all I needed to do was to change to DuckDuckGo that Bitwarden also supports and the site accepted that one. This is also a feature I doubt Proton would never implement because they own SimpleLogin.

4. Proton’s free version only supports three TOTP logins, so not very usable, and Bitwarden’s Premium plan is only $10 per year, so not a big deal to upgrade to that if you need this feature.

There seems to be a specific problem with registering passkeys, but logging in should work fine if you have already registered a passkey for a site. Not sure if this is the case with all password managers, or just Bitwarden.

Since the vault is end-to-end encrypted, it shouldn’t matter where it is hosted, even if it is in the cloud. Here is what a security researcher and a password cracker Jeremy M. Gosney has said about this after the LastPass incident.

”Is the cloud the problem? No. The vast majority of issues LastPass has had have nothing to do with the fact that it is a cloud-based solution. Further, consider the fact that the threat model for a cloud-based password management solution should *start* with the vault being compromised. In fact, if password management is done correctly, I should be able to host my vault anywhere, even openly downloadable (open S3 bucket, unauthenticated HTTPS, etc.) without concern. I wouldn’t do that, of course, but the point is the vault should be just that – a vault, not a lockbox.”

This is wrong. By enabling privacy.resistFingerprinting you cannot make yourself more unique in Firefox because you’re already unique. I would read this guide by the Arkenfox project about fingerprinting. The guy has worked for the Tor browser, so he knows his stuff. The summary is that the privacy.resistFingerprinting is the best tool that Firefox has against fingerprinting, but it can only ”fool naive scripts.” If you’re really worried about fingerprinting and want to defeat advancing fingerprinting, the only option is to use either Tor or Mullvad Browser depending on your threat model.

The Firefox hardening project Arkenfox only recommends uBlock Origin. Everything else is redundant.

I would also remove DuckDuckGo Privacy Essentials. It is redundant if you are using uBlock Origin.

This has already been recently discussed here.

I don’t think that it captures everything, but according to the Arkenfox project, any additional benefit ClearURLs could have compared to this setup is minimal, and thus, it probably isn’t worth to install another extension.

ClearURLs is not really needed anymore since you can enable AdGuard URL Tracking Protection and import Actually Legitimate URL Shortener Tool to uBlock Origin.

Skip Redirect is still fine if you want to continue using it but Smart Referer could be replaced by changing network.http.referer.XOriginPolicy in about:config to 2 like the Arkenfox project recommends. However, note that there could be some issues regarding this setting, so keep that in mind.