Option to Control Alias Access for Enhanced Security
Hi team,
I would like to request the addition of a feature in ProtonMail that allows users to disable alias logins or restrict login access to specific aliases.
Currently, aliases can use the same password for login, which raises security concerns as it feels like having multiple back doors that could be exploited if an attacker gains access.
Implementing a way to manage alias login permissions or disabling them entirely would enhance security and align with best practices for credential management.
Thank you for considering this feature request.

-
Steven commented
What about those of us who use an alias to login to a different device?
For example: I have an alias for my laptop as my main login is used on my phone, and using rules to keep the email in their own folders.
In this case, by restricting access to aliase logins, it would mean that I'd have to either login using the same credentials on each device, or have a second account for my laptop.Unless there's another option I'm not aware of?
-
Mike commented
-
BackSeatDriver commented
I think "additional addresses" that I have paid for I should be given the option where I can enable or disable the ability to login using that email address. Because you will not find out about a leak until after the leak or breach happens... There is a lag... Gives time for hackers to try to break into your account. If the additional address is not enabled to be logged in, then there is no way for them to get in. I have 2FA enabled which uses some authenticator app on my phone. But i have heard about phones being taken over. So, much harder to break in an account if they can never get into it in the first place unless they know the account email address. Besides, I do not have faith in some A.I. sential because it has been proven that a lot of A.I. out there has delusions.
-
Cipher commented
Wow, you are absolutely right. They really said exactly what you mentioned in my Reddit post. I don’t really understand their perspective. Maybe they have sophisticated algorithms to prevent it, but I don’t think so. I believe their sentinel is just a logging mechanism with system and human monitoring—nothing more. It seems more like they are being overconfident to me. To me, it’s the same as 15 accounts using the same password. I regret becoming a paid user.
-
Davie commented
And they’re going to tell you that it doesn’t affect security at all. That as long as you have a good password and 2FA, you’re good.
I don’t really understand, how having 15 possible logins to the same account, is not less secure than having only one.
How is having 15 chances, the same as one?