TLDR Tech / InfoSec
Proton Pass: Second-Password Bypass Through Emergency Access
Proton's Pass vault supports a separate second password, but the Emergency Access feature, with wait time set to “None,” lets someone with mailbox access add an attacker account as an immediate emergency contact and reach the vault without that second password. An attacker can also hide notification emails using mailbox rules, then use Emergency Access to log in, open Proton Pass, and export the entire vault.
Read the full story