Accounts & payments
148 results found
-
Account Lockout & Deletion Policy
The logic is straightforward: if 20 or more consecutive failed login attempts are detected on an account, the system automatically locks it as a security measure. Once locked, the legitimate account owner must complete an identity verification step — such as confirming via email, phone, or a backup authentication method — in order to regain access and unlock their account.
If the account remains locked and the owner fails to verify within a configurable inactivity window (defaulting to 3 months, but adjustable by the user up to 8 months or more), the account enters a deletion process — not an…3 votes -
Improve and expand QR code sign-in so it works from a PC
The QR code sign-in is fantastic, however, it should also allow users to sign in outside portable devices. For example, using a logged in session within the browser could improve the logging workflow experience for users with degoogled devices as the user can then only have a security key setup in their account and avoid altogether less secure forms of 2FA such as TOTP. At the moment, degoogled devices pretty much must have TOTP enabled, which is not ideal for those seeking maximum security within a degoogled ecosystem.
5 votes -
Security concern regarding the shared session between Proton Pass and Proton Mail.
Hello,
I would like to report a behavior that I find inconsistent and potentially problematic from a security perspective.
I use the Proton Pass extension in Chrome. When I initially signed in, I entered the main password for my Proton account. I then configured a PIN to lock Proton Pass, with an automatic locking delay of two minutes.
Once Proton Pass is locked, the PIN is correctly required to access the vault. However, when I open Proton Mail in the same browser, my mailbox opens immediately, without asking for either my main password or the Proton Pass PIN.
It therefore…
4 votes -
Passwordless login using hardware key / passkey only
Enable the user to use a FIDO2 hardware key or an iOS or Android biometric passkey as the sole login method for users that desire it. It would be for all Proton services, in my case mail, drive and pass.
I would like to eliminate using passwords altogether and solely rely on a passkey in my iOS Passwords app OR my Feitian FIDO2 hardware key with fingerprint sensor.
Requiring multiple keys would be a way to help prevent users from locking themselves out.
1password is currently in beta with passwordless login and google already supports it.
10 votes -
OAuth flow for external applications to use to access Proton services
Allow developers to implement their own apps integrated to the Proton enviroment and, through an auth flow, get the required permissions to use users accounts
Examples of implementation
Proton Drive SDK (Existing Proton Drive SDK implementation of authentication and app indentification is easily forjable and apps wth bad intentions will store user credentials)
A future Proton Mail SDK (which would allow open email clients like Thunderbird to implement Proton Mail without the need of Proton Mail Bridge)
Proton VPN SDK (An SDK where apps can tunnel requests via a Proton VPN server)
Proton Docs & Calendar SDK (SDK to develop…6 votes -
Stop Spam and Bad Actors by Separating Username from Email and Aliases
As Proton user,
I want my username to be completely separate from my email address and aliases
So that bad actors and others that attempt to email any proton domain containing my username will automatically get a 500 5.1.1 Address does not exist and that bad actors who use a list of email addresses to get into my proton account won't be able to because the email addresses they have have nothing to do with my usernameThis will solve two problems. So in future when you sign up for proton you first create a username, thereafter you can register…
4 votes -
Add allowing a second email for account recovery, or possibly add multiple email accounts for recovery.
Add allowing a second email for account recovery, or possibly add multiple email accounts for recovery.
This would assure that users can do a recovery, even if the 1st/primary email is not available at any particular time.15 votes -
Grace period for deliquent accounts
My credit card company got swallowed up by a larger company and as a result my credit card number was changed. As a result auto-renew failed. Instead of deleting delinquent accounts perhaps put them in stasis for a month or two?
4 votes -
Stop advertising recovery options as 'Security'
Just got another mail to add recovery options to my account in order to increase 'security' or 'safety'. I don't know in which dimension adding another attack vector to the account increases account security in any way. Yes, regular users forget passwords but that doesn't mean you have to advocate for watering down account security on a mass scale, because:
- users who usually forget their passwords also squander around with recovery keys
- users who use other means of recovery (additional e-mail accounts and so on), also usually have bad account security for those recovery methods.
Please rephrase this properly and…
8 votes -
Require password & 2FA to disable sentinel
Currently, Proton Sentinel can be enabled/disabled just from a click from Proton Pass (i didnt check if on the Proton Mail settings and the bar on the right if it did ask or not), without typing a password.
For security reasons, the activation or deactivation of Proton Sentinel should ask for password and 2FA
3 votes -
3 votes
-
Secure Storage for Certification Documents
I use Proton services to keep important documents secure. Has anyone created a good folder structure for storing professional certification records like CMA exam registrations, payment receipts, certificates, and study notes?
I'd love to know how others keep everything organized.
2 votes -
Provide real robust admin capabilities for Duo and Family plans
Currently Family and Duo plans primarily function as a consolidated billing method rather than providing robust group administration.
When compared to other providers, these plans lack true administrative capabilities. It would be beneficial to for example have the ability to:
- Add custom domains and create users directly within the plan, rather than relying on inviting existing Proton users first then assigning them alias for the customer domain.
- Manage users up to the plan limit directly through the admin dashboard; avoid problems with anti-abuse algorithms where you are forced to first create free proton plan users and invite them.
- Perform basic…
3 votes -
Filter inbox by identity.
I have ten email addresses on a single account, and the inbox is missing a feature that would allow me to view only the incoming mail for a specific identity. Please create a new filter for users with multiple addresses.
3 votes -
[Business Account Setup] Proton-first or Proton-only Setup for Businesses
When signing up for a company account (paid plans), one has to enter an existing company e-mail-address. While that works for existing companies seeking to switch to Proton, new companies that want to go Proton-first (no other e-mail provider) have to use a personal e-mail-address or another provider. It would only make sense to leave the e-mail-address of the "Business Information"/"Tell us about your business" step entirely and allowing for account creation with proton only.
1 vote -
Dedicated Account Management Link and/or App
Dedicated Account Management Link and/or App
As a proton user,
I want navigate directly to the account management section from the https://account.proton.me/apps landing page or via a dedicated mobile application
So that I can quickly manage my account settings without the intermediate step of loading a specific service (like pass or mail) first.*this will save a lot of time when needing to make security and other related changes.
3 votes -
Account Recovery Option Obfuscation (Decoy Interface)
Account Recovery Option Obfuscation (Decoy Interface)
As a Proton user with hardened recovery settings,
I want the "Forgot Password" flow to always display all possible recovery methods (Email, SMS, Phrase) regardless of which ones I actually have active,
So that a malicious actor trying to brute-force my account cannot deduce my exact security configuration based on what the UI shows.Acceptance Criteria (AC)
AC 1: Standardized Interface Response
When a user clicks "Forgot Password" and enters their username, the following screen must display the generic tabs/buttons for Email, SMS, and Recovery Phrase.AC 2: Blind Failure for Fake Options
If…3 votes -
Allow to verify and recover from multiple email addresses and/or multiples phone numbers
Currently, you can verify and recover from one email address and/or one phone number.
I wish to be able to verify and recover by multiples of both.To clarify, I'm not looking for a 2 of 2 multisign solution like Phone 1 AND Phone 2, but from Phone 1 OR Phone 2. The same for external email addresses, while we are here.
Why this? Because I live between two continents with 2 relative phone numbers. One almost doesn't work in one continent; the other almost doesn't work in the other one.
3 votes -
Automatically re-enable other email addresses when premium account is reinstated
Just had a very frustrating experience not receiving emails because I had a small lapse in membership and many of my email addressees remained disabled.
11 votes -
Show OTP key 2FA
I would greatly appreciate if you could allow users to see the private key of your actual OTP 2FA without having to reenable. This could allow users to have more than one 2FA apps if they want without having to rely on changing it every time they want to add a new one.
This should help people than want to migrate from 2FA apps that don't have a way to export the codes (such as Microsoft Authenticator).2 votes
- Don't see your idea?