3 ms·

This would worry me more than drama about one algo choice over another. Encrypting the data at rest (even it's not perfect) is probably better than letting it s

This would worry me more than drama about one algo choice over another. Encrypting the data at rest (even it's not perfect) is probably better than letting it sit around in plain text. OTOH account hijacking is a well documented[1][2] threat. I don't like the idea that if I set up a secure password and 2FA someone could call up Protonmail and go "Uh yeah, I use, uh... Hulu? Reset my password please!" [1] https://www.ftc.gov/news-events/blogs/techftc/2016/06/your-mobile-phone-account-could-be-hijacked-identity-thief https://www.ftc.gov/news-events/blogs/techftc/2016/06/your-m... [2] https://www.engadget.com/2016/06/10/hacker-hijacks-deray-by-redirecting-his-verizon-phone-number/ https://www.engadget.com/2016/06/10/hacker-hijacks-deray-by-...

Abishek_Muthian 8y ago
It's a valid concern, though in my case there's no other means to check the ownership albeit being flawed one; note that me having a valid login password/ or not doesn't seem have any impact on me recovering the password as I contacted them using web form support.
- dontbenebby 8y ago
  Oh, you're on a free account? So you think it'd be stronger protected if you're paying due to probably having a CC etc tied?
  - hombre_fatal 8y ago
    You'd think, right? AWS doesn't even consider you the account owner despite you holding the credit card that they bill for that account. https://news.ycombinator.com/item?id=19574672 https://news.ycombinator.com/item?id=19574672 Our industry is such a shitshow in some massive ways.
  - Abishek_Muthian 8y ago
    I don't think that would have made any difference, if someone with malicious agenda wanted to gain access to my email account. It all depends upon how much trust, my initial answer to the question 'When you account was created'; I'm 90% sure I have correct year & 70 % on the month (I gave another month as well). If that answer really did create some trust, then there's something; if not then I'm quite sure anyone can hijack an account without recovery email if they are able to guess few email ids correctly.

Abishek_Muthian 8y ago

It's a valid concern, though in my case there's no other means to check the ownership albeit being flawed one; note that me having a valid login password/ or not doesn't seem have any impact on me recovering the password as I contacted them using web form support.

dontbenebby 8y ago
Oh, you're on a free account? So you think it'd be stronger protected if you're paying due to probably having a CC etc tied?
- hombre_fatal 8y ago
  You'd think, right? AWS doesn't even consider you the account owner despite you holding the credit card that they bill for that account. https://news.ycombinator.com/item?id=19574672 https://news.ycombinator.com/item?id=19574672 Our industry is such a shitshow in some massive ways.
- Abishek_Muthian 8y ago
  I don't think that would have made any difference, if someone with malicious agenda wanted to gain access to my email account. It all depends upon how much trust, my initial answer to the question 'When you account was created'; I'm 90% sure I have correct year & 70 % on the month (I gave another month as well). If that answer really did create some trust, then there's something; if not then I'm quite sure anyone can hijack an account without recovery email if they are able to guess few email ids correctly.