Accounts & payments
150 results found
-
Require password & 2FA to disable sentinel
Currently, Proton Sentinel can be enabled/disabled just from a click from Proton Pass (i didnt check if on the Proton Mail settings and the bar on the right if it did ask or not), without typing a password.
For security reasons, the activation or deactivation of Proton Sentinel should ask for password and 2FA
5 votes -
Feature Request: FIDO2 only authentication on new devices
Summary
Add an account security option that enforces FIDO2 security keys as the only allowed 2FA method when a user signs in from a new or untrusted device.Problem / Current Behavior
In the current login flow, when a user has a FIDO2 key enabled the user can fallback to OTP-based 2FA rolling codes. This creates a downgrade path.Desired Behavior (What should change)
Provide a ON/OFF setting such as: “Require FIDO2 security key for new/untrusted devices.”When enabled
• FIDO2 is required when signing in from a new/untrusted device.
• OTP fallback is not offered in that same new/untrusted…17 votes -
Account Lockout & Deletion Policy
The logic is straightforward: if 20 or more consecutive failed login attempts are detected on an account, the system automatically locks it as a security measure. Once locked, the legitimate account owner must complete an identity verification step — such as confirming via email, phone, or a backup authentication method — in order to regain access and unlock their account.
If the account remains locked and the owner fails to verify within a configurable inactivity window (defaulting to 3 months, but adjustable by the user up to 8 months or more), the account enters a deletion process — not an…3 votes -
Improve and expand QR code sign-in so it works from a PC
The QR code sign-in is fantastic, however, it should also allow users to sign in outside portable devices. For example, using a logged in session within the browser could improve the logging workflow experience for users with degoogled devices as the user can then only have a security key setup in their account and avoid altogether less secure forms of 2FA such as TOTP. At the moment, degoogled devices pretty much must have TOTP enabled, which is not ideal for those seeking maximum security within a degoogled ecosystem.
5 votes -
Stop Spam and Bad Actors by Separating Username from Email and Aliases
As Proton user,
I want my username to be completely separate from my email address and aliases
So that bad actors and others that attempt to email any proton domain containing my username will automatically get a 500 5.1.1 Address does not exist and that bad actors who use a list of email addresses to get into my proton account won't be able to because the email addresses they have have nothing to do with my usernameThis will solve two problems. So in future when you sign up for proton you first create a username, thereafter you can register…
5 votes -
Security concern regarding the shared session between Proton Pass and Proton Mail.
Hello,
I would like to report a behavior that I find inconsistent and potentially problematic from a security perspective.
I use the Proton Pass extension in Chrome. When I initially signed in, I entered the main password for my Proton account. I then configured a PIN to lock Proton Pass, with an automatic locking delay of two minutes.
Once Proton Pass is locked, the PIN is correctly required to access the vault. However, when I open Proton Mail in the same browser, my mailbox opens immediately, without asking for either my main password or the Proton Pass PIN.
It therefore…
4 votes -
Grace period for deliquent accounts
My credit card company got swallowed up by a larger company and as a result my credit card number was changed. As a result auto-renew failed. Instead of deleting delinquent accounts perhaps put them in stasis for a month or two?
5 votes -
Passwordless login using hardware key / passkey only
Enable the user to use a FIDO2 hardware key or an iOS or Android biometric passkey as the sole login method for users that desire it. It would be for all Proton services, in my case mail, drive and pass.
I would like to eliminate using passwords altogether and solely rely on a passkey in my iOS Passwords app OR my Feitian FIDO2 hardware key with fingerprint sensor.
Requiring multiple keys would be a way to help prevent users from locking themselves out.
1password is currently in beta with passwordless login and google already supports it.
10 votes -
OAuth flow for external applications to use to access Proton services
Allow developers to implement their own apps integrated to the Proton enviroment and, through an auth flow, get the required permissions to use users accounts
Examples of implementation
Proton Drive SDK (Existing Proton Drive SDK implementation of authentication and app indentification is easily forjable and apps wth bad intentions will store user credentials)
A future Proton Mail SDK (which would allow open email clients like Thunderbird to implement Proton Mail without the need of Proton Mail Bridge)
Proton VPN SDK (An SDK where apps can tunnel requests via a Proton VPN server)
Proton Docs & Calendar SDK (SDK to develop…6 votes -
Add allowing a second email for account recovery, or possibly add multiple email accounts for recovery.
Add allowing a second email for account recovery, or possibly add multiple email accounts for recovery.
This would assure that users can do a recovery, even if the 1st/primary email is not available at any particular time.15 votes -
Stop advertising recovery options as 'Security'
Just got another mail to add recovery options to my account in order to increase 'security' or 'safety'. I don't know in which dimension adding another attack vector to the account increases account security in any way. Yes, regular users forget passwords but that doesn't mean you have to advocate for watering down account security on a mass scale, because:
- users who usually forget their passwords also squander around with recovery keys
- users who use other means of recovery (additional e-mail accounts and so on), also usually have bad account security for those recovery methods.
Please rephrase this properly and…
8 votes -
easier access to my account management
I'm getting confused how difficult it is to access the management of my account, to see for instance my subscription plan.
I have received an e-mail tell me my plan has been renewed and there is a link to go to a dashboard to be able to cancel or adjust my plan.
Until here everything is fine but when I click on the link I'm redirected to a web page with all the apps and no where I can access my account...
Tried a random app to see if I can access my account, selected calendar but it was the…7 votes -
3 votes
-
Secure Storage for Certification Documents
I use Proton services to keep important documents secure. Has anyone created a good folder structure for storing professional certification records like CMA exam registrations, payment receipts, certificates, and study notes?
I'd love to know how others keep everything organized.
2 votes -
Account recovery (Android App)
Add Password Reset Option Using Active Proton Mail Session
Description
Currently, Proton users who are locked out of Proton Pass but still have an active authenticated Proton Mail session can become permanently stuck in a recovery deadlock.
In my case, I am locked out of Proton Pass and unable to access my stored passwords or recovery codes. Proton Mail is the only session I still have access to. However, when attempting to change or reset my account password from Proton Mail, the system requires entering the current (old) password.
This requirement defeats the purpose of account recovery. If the user…
8 votes -
Provide real robust admin capabilities for Duo and Family plans
Currently Family and Duo plans primarily function as a consolidated billing method rather than providing robust group administration.
When compared to other providers, these plans lack true administrative capabilities. It would be beneficial to for example have the ability to:
- Add custom domains and create users directly within the plan, rather than relying on inviting existing Proton users first then assigning them alias for the customer domain.
- Manage users up to the plan limit directly through the admin dashboard; avoid problems with anti-abuse algorithms where you are forced to first create free proton plan users and invite them.
- Perform basic…
3 votes -
Filter inbox by identity.
I have ten email addresses on a single account, and the inbox is missing a feature that would allow me to view only the incoming mail for a specific identity. Please create a new filter for users with multiple addresses.
3 votes -
Dedicated Account Management Link and/or App
Dedicated Account Management Link and/or App
As a proton user,
I want navigate directly to the account management section from the https://account.proton.me/apps landing page or via a dedicated mobile application
So that I can quickly manage my account settings without the intermediate step of loading a specific service (like pass or mail) first.*this will save a lot of time when needing to make security and other related changes.
3 votes -
Account Recovery Option Obfuscation (Decoy Interface)
Account Recovery Option Obfuscation (Decoy Interface)
As a Proton user with hardened recovery settings,
I want the "Forgot Password" flow to always display all possible recovery methods (Email, SMS, Phrase) regardless of which ones I actually have active,
So that a malicious actor trying to brute-force my account cannot deduce my exact security configuration based on what the UI shows.Acceptance Criteria (AC)
AC 1: Standardized Interface Response
When a user clicks "Forgot Password" and enters their username, the following screen must display the generic tabs/buttons for Email, SMS, and Recovery Phrase.AC 2: Blind Failure for Fake Options
If…3 votes -
Allow to verify and recover from multiple email addresses and/or multiples phone numbers
Currently, you can verify and recover from one email address and/or one phone number.
I wish to be able to verify and recover by multiples of both.To clarify, I'm not looking for a 2 of 2 multisign solution like Phone 1 AND Phone 2, but from Phone 1 OR Phone 2. The same for external email addresses, while we are here.
Why this? Because I live between two continents with 2 relative phone numbers. One almost doesn't work in one continent; the other almost doesn't work in the other one.
3 votes
- Don't see your idea?