4 ms·
Off topic I had a proton email created when it was announced & didn't use it. I found out that my mailbox decryption for that email id is not working (not sure
by Abishek_Muthian 8y ago
Off topic
I had a proton email created when it was announced & didn't use it. I found out that my mailbox decryption for that email id is not working (not sure how, I use password manager) & I haven't set a recovery email to recover my account.
I saw a HN comment earlier telling, the user had recovered their Proton mail account by answering few questions to customer service.
I attempted the same, the issue is that I used VPN to create the email id & didn't provide any personal details for the account.
They asked questions like,
-Do you remember the exact time and date when your account was created?
-When was the last time you have accessed your account?
-What is your display name?
-Do you remember to which addresses you have sent your last messages?
-Do you remember the email subjects of the last sent messages?
I tried to answer the account creation date by using the date of password creation in my password manager (the login password was working); but the support didn't seem to buy it.
They were insistent on,
-Can you please tell us if you remember from which addresses have you received your last few messages?
-Could you tell us if you have used the ProtonMail account to sign up for some other web services?
I told them, I don't remember receiving email from anyone else & I didn't sign up for any service
-There is a service that the xxxxx@protonmail.com address has been used to sign up for. Can you please tell us what that service is?
I told them again that I didn't sign up for any service using that email id.
- Can you tell us the full address below?
no-xxxxx@drxxxxx.com
Even though I could obviously guess the username of that email id. I told them that I didn't sign up with such service, that it must be a spam mail sent by some service.
They said,
- If you have not signed up for this service, the account probably belongs to someone else.
Then I typed 'no-xxxxx@drxxxxx.com' on Google Search, the instant results gave 'no-reply@dropbox.com' as the first result.
I sent them,
Hey sorry, I remembered the service. I did signed up for Dropbox & used the account for a while.
The email id you asked was,
no-reply@dropbox.com
They reset the account & I got access to it.
Edit: Had to fix the xxxxx.
- tristor 8y agoThere’s two separate passwords. If you reset your encryption password it’s supposed to make all prior received mail unreadable. Was this the case for you?
- Abishek_Muthian 8y agoCorrect, existing emails become inaccessible when the mailbox is reset. Can be recovered though, if there's a backup & the original decryption password is found again.
- dontbenebby 8y agoBut is your threat model someone reading your old email? For most people the big risk is that their email can be leveraged to gain access to banks, social media etc through password resets.
- Abishek_Muthian 8y agoI agree, access to other accounts is of greater threat. When I created this account, I wanted to build upon the premise of privacy of proton mail & so I created using VPN, with no personal link whatsoever (hence no recovery email). Unfortunately when my decryption password failed, I had no means of recovery until I attempted to talk through support successfully.
- dontbenebby 8y agoHm. I once had an issue with a decryption password failing despite using a manager (not on Protonmail) It ended up being that a trailing newline got added. It's a long shot but worth looking into...
- deleted 8y ago[deleted]
- mercora 8y agoit was at least my expectation that they are not able to read your mails after storing them. But apparently i didn't get that right.
- Abishek_Muthian 8y agoThey can't, but they know what email ids you received email from & to which email ids you sent emails.
- dontbenebby 8y agoThis would worry me more than drama about one algo choice over another. Encrypting the data at rest (even it's not perfect) is probably better than letting it sit around in plain text. OTOH account hijacking is a well documented[1][2] threat. I don't like the idea that if I set up a secure password and 2FA someone could call up Protonmail and go "Uh yeah, I use, uh... Hulu? Reset my password please!" [1] https://www.ftc.gov/news-events/blogs/techftc/2016/06/your-mobile-phone-account-could-be-hijacked-identity-thief https://www.ftc.gov/news-events/blogs/techftc/2016/06/your-m... [2] https://www.engadget.com/2016/06/10/hacker-hijacks-deray-by-redirecting-his-verizon-phone-number/ https://www.engadget.com/2016/06/10/hacker-hijacks-deray-by-...
- Abishek_Muthian 8y agoIt's a valid concern, though in my case there's no other means to check the ownership albeit being flawed one; note that me having a valid login password/ or not doesn't seem have any impact on me recovering the password as I contacted them using web form support.
- dontbenebby 8y agoOh, you're on a free account? So you think it'd be stronger protected if you're paying due to probably having a CC etc tied?
- hombre_fatal 8y agoYou'd think, right? AWS doesn't even consider you the account owner despite you holding the credit card that they bill for that account. https://news.ycombinator.com/item?id=19574672 https://news.ycombinator.com/item?id=19574672 Our industry is such a shitshow in some massive ways.
- Abishek_Muthian 8y agoI don't think that would have made any difference, if someone with malicious agenda wanted to gain access to my email account. It all depends upon how much trust, my initial answer to the question 'When you account was created'; I'm 90% sure I have correct year & 70 % on the month (I gave another month as well). If that answer really did create some trust, then there's something; if not then I'm quite sure anyone can hijack an account without recovery email if they are able to guess few email ids correctly.
- deleted 8y ago[deleted]