Accounts & payments
154 results found
-
[Business Account Setup] Proton-first or Proton-only Setup for Businesses
When signing up for a company account (paid plans), one has to enter an existing company e-mail-address. While that works for existing companies seeking to switch to Proton, new companies that want to go Proton-first (no other e-mail provider) have to use a personal e-mail-address or another provider. It would only make sense to leave the e-mail-address of the "Business Information"/"Tell us about your business" step entirely and allowing for account creation with proton only.
2 votes -
Require password & 2FA to disable sentinel
Currently, Proton Sentinel can be enabled/disabled just from a click from Proton Pass (i didnt check if on the Proton Mail settings and the bar on the right if it did ask or not), without typing a password.
For security reasons, the activation or deactivation of Proton Sentinel should ask for password and 2FA
7 votes -
OAuth flow for external applications to use to access Proton services
Allow developers to implement their own apps integrated to the Proton enviroment and, through an auth flow, get the required permissions to use users accounts
Examples of implementation
Proton Drive SDK (Existing Proton Drive SDK implementation of authentication and app indentification is easily forjable and apps wth bad intentions will store user credentials)
A future Proton Mail SDK (which would allow open email clients like Thunderbird to implement Proton Mail without the need of Proton Mail Bridge)
Proton VPN SDK (An SDK where apps can tunnel requests via a Proton VPN server)
Proton Docs & Calendar SDK (SDK to develop…8 votes -
Account Lockout & Deletion Policy
The logic is straightforward: if 20 or more consecutive failed login attempts are detected on an account, the system automatically locks it as a security measure. Once locked, the legitimate account owner must complete an identity verification step — such as confirming via email, phone, or a backup authentication method — in order to regain access and unlock their account.
If the account remains locked and the owner fails to verify within a configurable inactivity window (defaulting to 3 months, but adjustable by the user up to 8 months or more), the account enters a deletion process — not an…4 votes -
Improve and expand QR code sign-in so it works from a PC
The QR code sign-in is fantastic, however, it should also allow users to sign in outside portable devices. For example, using a logged in session within the browser could improve the logging workflow experience for users with degoogled devices as the user can then only have a security key setup in their account and avoid altogether less secure forms of 2FA such as TOTP. At the moment, degoogled devices pretty much must have TOTP enabled, which is not ideal for those seeking maximum security within a degoogled ecosystem.
6 votes -
Use random hidden username for encryption, let users pick public email
Description:
When creating an account, Proton should generate a random internal username (e.g., x7k9f2@proton.me) that handles all encryption behind the scenes. Users wouldn't know or interact with it.
They would pick a public-facing address (e.g., elias.silva@proton.me). Paid users could swap it for one of their additional addresses. The public address is separate from the encrypted data.
Current problem:
My encryption key depends on my username
If I enter personal info in the username, I'm locked in forever
Changing it breaks the key or requires a new accountProposed fix:
Generate random crypto username at signup (automatic, invisible)
Let…3 votes -
All Jews deserve to burn in ****
All Jews deserve to burn in ****
1 vote -
Stop Spam and Bad Actors by Separating Username from Email and Aliases
As Proton user,
I want my username to be completely separate from my email address and aliases
So that bad actors and others that attempt to email any proton domain containing my username will automatically get a 500 5.1.1 Address does not exist and that bad actors who use a list of email addresses to get into my proton account won't be able to because the email addresses they have have nothing to do with my usernameThis will solve two problems. So in future when you sign up for proton you first create a username, thereafter you can register…
6 votes -
Security concern regarding the shared session between Proton Pass and Proton Mail.
Hello,
I would like to report a behavior that I find inconsistent and potentially problematic from a security perspective.
I use the Proton Pass extension in Chrome. When I initially signed in, I entered the main password for my Proton account. I then configured a PIN to lock Proton Pass, with an automatic locking delay of two minutes.
Once Proton Pass is locked, the PIN is correctly required to access the vault. However, when I open Proton Mail in the same browser, my mailbox opens immediately, without asking for either my main password or the Proton Pass PIN.
It therefore…
5 votes -
Multi-Tenant Account
I have multiple companies with multiple domains. I want to have everything on one place (Proton) but separated. I want to have two open tabs with two companies whose emails are not in the same inbox. I want to have separate filtering and forwarding rules, separate spaces, separate users and so on.
Thank you for considering this idea.
3 votes -
Feature Request: FIDO2 only authentication on new devices
Summary
Add an account security option that enforces FIDO2 security keys as the only allowed 2FA method when a user signs in from a new or untrusted device.Problem / Current Behavior
In the current login flow, when a user has a FIDO2 key enabled the user can fallback to OTP-based 2FA rolling codes. This creates a downgrade path.Desired Behavior (What should change)
Provide a ON/OFF setting such as: “Require FIDO2 security key for new/untrusted devices.”When enabled
• FIDO2 is required when signing in from a new/untrusted device.
• OTP fallback is not offered in that same new/untrusted…17 votes -
Grace period for deliquent accounts
My credit card company got swallowed up by a larger company and as a result my credit card number was changed. As a result auto-renew failed. Instead of deleting delinquent accounts perhaps put them in stasis for a month or two?
6 votes -
Account recovery (Android App)
Add Password Reset Option Using Active Proton Mail Session
Description
Currently, Proton users who are locked out of Proton Pass but still have an active authenticated Proton Mail session can become permanently stuck in a recovery deadlock.
In my case, I am locked out of Proton Pass and unable to access my stored passwords or recovery codes. Proton Mail is the only session I still have access to. However, when attempting to change or reset my account password from Proton Mail, the system requires entering the current (old) password.
This requirement defeats the purpose of account recovery. If the user…
8 votes -
Secure Storage for Certification Documents
I use Proton services to keep important documents secure. Has anyone created a good folder structure for storing professional certification records like CMA exam registrations, payment receipts, certificates, and study notes?
I'd love to know how others keep everything organized.
3 votes -
Provide real robust admin capabilities for Duo and Family plans
Currently Family and Duo plans primarily function as a consolidated billing method rather than providing robust group administration.
When compared to other providers, these plans lack true administrative capabilities. It would be beneficial to for example have the ability to:
- Add custom domains and create users directly within the plan, rather than relying on inviting existing Proton users first then assigning them alias for the customer domain.
- Manage users up to the plan limit directly through the admin dashboard; avoid problems with anti-abuse algorithms where you are forced to first create free proton plan users and invite them.
- Perform basic…
4 votes -
Passwordless login using hardware key / passkey only
Enable the user to use a FIDO2 hardware key or an iOS or Android biometric passkey as the sole login method for users that desire it. It would be for all Proton services, in my case mail, drive and pass.
I would like to eliminate using passwords altogether and solely rely on a passkey in my iOS Passwords app OR my Feitian FIDO2 hardware key with fingerprint sensor.
Requiring multiple keys would be a way to help prevent users from locking themselves out.
1password is currently in beta with passwordless login and google already supports it.
10 votes -
Filter inbox by identity.
I have ten email addresses on a single account, and the inbox is missing a feature that would allow me to view only the incoming mail for a specific identity. Please create a new filter for users with multiple addresses.
4 votes -
Add allowing a second email for account recovery, or possibly add multiple email accounts for recovery.
Add allowing a second email for account recovery, or possibly add multiple email accounts for recovery.
This would assure that users can do a recovery, even if the 1st/primary email is not available at any particular time.16 votes -
CRYPTO FRAUD INVESTIGATION — Hire SAGITTARIUS CYPHER CYBER INTELLIGENCE
My experience with SAGITTARIUS CYPHER CYBER INTELLIGENCE has shown me the importance of professional guidance, clear communication, and evidence-based investigation when dealing with cryptocurrency scams and online financial fraud.
Their focus on blockchain transaction analysis, digital evidence, and investigative support provides a helpful starting point for understanding suspicious transactions and exploring possible next steps.
What stands out is the importance of transparency, professionalism, and realistic expectations throughout the investigative process.
I would encourage anyone affected by cryptocurrency fraud to preserve their evidence, report the incident to the appropriate authorities, and carefully assess their options before engaging any recovery service.
SAGITTARIUS…1 vote -
Stop advertising recovery options as 'Security'
Just got another mail to add recovery options to my account in order to increase 'security' or 'safety'. I don't know in which dimension adding another attack vector to the account increases account security in any way. Yes, regular users forget passwords but that doesn't mean you have to advocate for watering down account security on a mass scale, because:
- users who usually forget their passwords also squander around with recovery keys
- users who use other means of recovery (additional e-mail accounts and so on), also usually have bad account security for those recovery methods.
Please rephrase this properly and…
8 votes
- Don't see your idea?