Improve security: How to know if an email is a Proton main user or just a Proton alias (@pm.me) for a different main user
Improve security: How to know if an email is a Proton main user or just a Proton alias (@pm.me) for a different main user
Try to log in without @domain.tld (for instance, if your user is: asdf@pm.me, try just asdf).
If asdf exists as a user in @proton.me/@protonmail.com/@protonmail.ch, it will return an "invalid password" message. Otherwise, it will tell you that the user doesn't exist.
IMHO, the message should always be: "Incorrect username/password combination." That would also help avoid disclosing which addresses could be active (or at least were active at some point).
1
vote
Ribbon3682
shared this idea