Email account under attack

[Dode]

@ZakMcKracken 

Agreed, but time delays can be made progressive, up to the point an account is locked if necessary.

[ZakMcKracken]

Yeah true. Another option is to copy proton mail, using a 12 word recovery phrase. Nobody will ever guess that.

I think the major problem is, when using the lost password method, the method to get into your account has been made significantly easier. Where a password is relatively difficult to guess, a hacker can get around this by replacing it by a 4 digit number. The method to get into an account using the lost password method should not be a lot easier than using a password, which a 4 digit number clearly is.

[ZakMcKracken]

Actually, thinking about it further, the situation is worse. When you login normally you would require to type in your password and a 6 digit 2fa code. When you do the lost password option, all you need to type is a 4 digit number (why not also 6?), but without any additional 2fa check.