https://www.pcmag.com/news/lastpass-hack-gets-worse-culprit-stole-customers-encrypted-password-vaults

On the LastPass incident in 2022, which is a real-world example of this happening. I've just this second found out they were finally fined by the ICO for it, and there was a class action suit in the USA, this is after years of me unsuccessfully trying to bring a private prosecution.

Just in response to Jack earlier, LastPass managed to lose my entire set of credentials along with 31 million other customers, back four years ago and then lied about it for 9 months compromising any efforts to fix things. To compound matters, a lot of it was stored in plaintext. It offends and baffles me that not only have they been hacked in a similar manner again since, but that they're still trading, and I still see them recommended as trustworthy. And just for bonus marks, this all happened a mere 6 days after I signed up for 2 years and they refused me any kind of refund.

So they answer to your 1 is, hopefully not, but if the firm you've entrusted your details to are truly incompetent, they may well lose all your contact details, website addresses, usernames, and passwords as a job lot.

I trust NordPass/VPN for that now, and they offer the darkweb monitoring service which you are describing or alluding to here. Infinitely more trustworthy company. I am happy with ProtonMail with the glaring exception of the "being able to log in under any alias" thing which has been well documented in these forums since 2017, but seemingly not even acknowledged. I'm slowly migrating over to using the Proton Authenticator, but again concerned about this lax password security issue.

Especially as you can log in using the same password on any alias, a complaint which has been documented on five separate threads now and appears not even to have been acknowledged since 2017.

This feature is needed.
Today I noticed my old password which I used for
literally everything back in the is leaked/hacked.

Google password manager had to tell me this...

Proton doesn't need to build the database themselves they can use the existing one from I have been pwned. I could prefer they build their own instead of using another one.

Anyway paid function of not? Depends entirely on proton. Good password manager gives it free while bitwarden is paid to use it. So I leave that to device from the company

Depending on the password, human readable/memorable or long with random characters, a password showing up as compromised does not necessary mean your own related account was compromised. Someone else may have the same password, but not the same e-mail address (assuming one is not sharing an e-mail address with other people).

Unless it has been used at a company/organisation of which you know it has been hacked. In that case the login credentials need to be updated anyway just to be sure.

So I am not sure if this should be top priority, at least not until some useful things that have more impact on usability have been implemented, but that is just my opinion.

It is very useful for Proton because you are encouraged to buy premium so that you can make a unique alias for all accounts, even if duck email is more useful.

I'm very much in favor of this, although i personally set my password manager up so that this isn't that necessary; by using a forwarding email service like simple login. This is now a standard feature with proton pass plus and proton unlimited i believe and allows you to set-up an email address per login wich you can combine with a unique password. The requested feature is still important, but this set-up means when either of those two show up as compromised, they should both be changed anyway.

It seems intuitively like this would be very important feature for monitoring compromised accounts, but analytically I do not understand why and I do not see an advantage of additionally monitoring for compromised account login credentials by independently monitoring for compromised passwords.

So overall, I'm not sure, but erring on the side of caution and employing the additional method of monitoring for compromised account login credentials by independently monitoring for compromised passwords to cover unknown cases seems prudent.

But all of this said, it seems how beneficial implementing this feature request would potentially be can only be determined through checking some assumptions...

So in the form of questions that come to mind, if I may ask, and maybe other users and/or Proton staff have informed answers and/or other questions :

1.) Are there cases in which an account stored in the password manager for a given website or whatever can be determined to have known fully or partially compromised set of login credentials (i.e. both username/email and password, or only password), therefore calling for user action to change the login's password (and ideally also change the unique username/email too, and also ideally marking the issue as resolved in either case) only by directly searching for each account's password in the databases and other dark web-related places like forums used by these monitoring tools?

2.) If the answer to #1 is 'Yes', then:
If the user follows the standard security practice password managers instruct users to perform--generate a unique password and unique email address and/or unique username for each unique account then is the answer to #1 still a 'Yes' ?

3.) If the answer to #2 is 'No', then it seems that this feature request is more of a request to implement a feature accommodating using the product in a manner diverging a bit from how it is intended...so that might need to addressed in the process of evaluating this request...and hopefully there could be sharing of the developers' and designers' considerations.

Personally, I can see cases in which the user might not be able to reasonably/practically follow to a strict extent the directed or recommended practice of generating a unique password for every account, or generating both a unique password, username, and email address for every account.

This is especially the case for logins created/updated before starting to use a password manager, and/or beginning to implement this practice, because it takes a lot time and energy to change all of the logins to accounts, especially in the beginning.

I can understand from the developer's view, how there has to be some sort of baseline reasonably assumed or expected manner of use of the product. I just hope that if this possibility were at all relevant here, that the burden is not put on the user to such an extreme extent considering the realities how much effort the user already has to put into switching to and adopting new product for everyday and broad use.

But #3 may not be a consideration here if the answer to #2 is 'Yes'...

4.) Last question is related to any possible security considerations:

Is there a way of the performing routine searches of the passwords of the logins stored in Proton Pass in the external sources of information that would be involved in this requested monitoring without any compromise on the level/quality of the existing data security practices in place used protect the passwords stored in Proton Pass?

(I'm guessing it's a negligible risk in the worst case scenario, since Google passwords and 1Password are said to have this requested feature, but that's an assumption for which I have no basis)

And if some degree of compromise/risk is required, how significant is it, and can the user be informed of it with enough understanding to let them decide whether or not the benefits would outweigh the risks/costs for them, in optionally using this requested feature?

Thanks. Would be nice to hear back from Proton and/or anyone with relevant backgrounds on any or all of the above...

:)

this will be important for end users for sure.

Even google password manager does this. It's good to have it.

At the moment I have to export the passwords from my unlimited proton pass to the 1 password regularly to check for compromised passwords, change them ther and reimport them into proton..