Did I get that unlucky and get assigned a bad IP?
Its mobile data btw.
And I don’t wanna point fingers and blame Proton, but like… c’mon,
First of all, its a real IP address,
Second, even if it were a VPN, so what, your company literally runs a VPN lol, kinda ironic.
And its also a paid account, and I rarely (almost never) send outgoing emails.
But again, this is just a small annoyance, I generated a new password in Keepass and its seems fixed.
where does it say anything about your ip?
Well it doesn’t say that, just an inference I made, since I haven’t done anything suspicious with email, so IP is the only logical conclusion since that changes like every time data gets turned off and back on (like daily reboots).
And some CGNAT is often mentioned, so maybe there’s a spammer on the same Shared CGNAT IP? Idk, kinda very unlucky, and probably uncommon since its the first time I got this.
It’s more likely the result of automated login attempts because your email is on a leaked list and they forced a password reset on you to protect your account.
Damn if that’s the case, my paranoia is gonna go overdrive.
Btw, has anyone here actually got hacked? I feel like the media always overexaggerates “hacking” and its mostly people just using weak passwords (user error), not really hacking.
There’s a chance that malware is running on your device that is causing your IP address to get flagged
My tablet is running afoul of the Netflix “home” network lock. I speculate it’s either that I have location disabled or Apple Private Relay. Perhaps you have similar?
Do you have two factor authentication set up? A lot of sites - Proton included - institute stricter security measures if you do not have 2FA enabled.
No 2fa, because the password is like 64 random characters stored in Keepass which itself is secured by a 10 word passphrase, 2fa seems redundant IMO.
Can’t Keepass also generate TOTPs?
Proton doesn’t know that your password is 64 characters long because the hash will be the same length regardless. They also don’t know if you’ve reused your password on other sites.
The alert seems to indicate a compromised account, this can mean a lot more than “a bad IP”. Your account may have shown up in a “dump” and they took action to ensure your safety. Have you tried putting your email address into HaveIBeenPwned. While the normal recommendation would be to not put your email address in a random web form, this site is actually run by a well known security researcher and just lets you know if you have shown up in such a dump in the past.
Another possibility would be that they have seen a major change in your IP geolocation in a short time. This is referred to as “improbable travel” and it’s something which many security departments take action on. If you login from an IP address which is associated with Paris, France and then an hour later are logging in from Dubai, UAE, this is going to be flagged. Sure, you might travel between those two locations, but you ain’t doing it in an hour. So, your account gets flagged as possibly compromised.
even if it were a VPN, so what, your company literally runs a VPN
Right, but they may not know that you are using another VPN. So, continuing the issue above of “improbably travel”. If you are on Proton’s VPN, they know all of their exit IP address and likely take them into account. But, if you are using a different company’s VPN, Proton likely doesn’t know all of that company’s exit IP addresses and so can’t account for them. Consider the situation from their perspective:
- You are using some other VPN and they force you to do a password reset.
- Outcome - you’re a bit annoyed, but ultimately your mail account is safe.
- Some attacker has your password and tried to use it to access your mailbox, but Proton stopped the login and forced a password reset.
- Outcome - you are a bit annoyed, but your mail account is safe.
- Some attacker has your password and tried to use it to access your mailbox, and Proton let them in.
- Outcome - You get wrecked and are really unhappy.
No matter what, Proton is going to lose out a bit to you being unhappy. However, if they force the password reset, the worst case is you being slightly annoyed about a password reset. By not taking action, they risk your account being fully compromised, which can be very, very bad for you. So, they are likely to be more proactive in forcing a password reset than you might like. This will be especially true if you do not have any sort of two-factor authentication setup. If the whole game is lost by one password being lost, any whiff of that password being compromised will result in a password reset.
Ultimately, it is am annoyance but one which is actually positive for you. They take your email security seriously enough that, when their system detected something, they took action to keep you safe.
Most cellular data providers I’ve seen use CGNAT.
Hell, the last 3 isps I’ve used have also been CGNAT networks.
And with CGNAT, you share your IP with however many other people. Maybe not at VPN scale, but it’s not 1:1 like it used to be.
- Use mullvad.
- probably ur email got pwned –> use mullvad. That way the only reason your acc will ever be logged into is your own incompetence to secure a 16 char sequence.
