this post was submitted on 15 Nov 2025
30 points (61.7% liked)
Privacy
2919 readers
137 users here now
Icon base by Lorc under CC BY 3.0 with modifications to add a gradient
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I'm sure proton would clear the inboxes before making the addresses available, so there's no risk of seeing legitimate mail meant for someone else.
In terms of misdirected mail there are two types:
where a user has made a typo when entering their email somewhere
where a user entered a random email when signing up for a service they didn't care about
Both of these can affect any existing email address (so proton's plans make no difference), and only type 1 could be a privacy risk.
Email addresses aren't secret, nor are they personally identifiable (unless they contain your name or are linked with other personal information) so I don't see a problem here.
Wouldn't the security risk be that if someone thinks the old user is still using that email address, or forgets, they may mistakenly send sensitive into to the person who now has the address...?
Am I missing something?
The previous owners were bots and the accounts were deactivated by proton shortly after registry
Thank you for correcting me :)
Have you read the article? These are old bot accounts that have been disabled for almost a decade. It's in the very first line.
Nope, I didn't, thank you for correcting me :)
I'm a lot better about reading the article than I used to be but sometimes I still don't and just wanna chat about stuff with folks, and in this case that's my bad
this is just completely wrong. obviously Proton wouldn't grant access to existing mails, but the new owner of the address will still receive new emails intended for the previous owner. this is where the main risk lies.
there are most likely accounts with various services attached to these email addresses. you can discover some via data breaches, some via emails they send to you, and some you might discover via trial and error. it might even just be a service telling you that am account already exists when you try to sign up.
combine that with most services allowing account recovery by just using email, even for the services without publicly leaked passwords, you will be able to easily recover access to the accounts and in many cases get access to sensitive information.
The previous owners were bots and the accounts were deactivated shortly after registry
granted, that reduces the risk of real sensitive information being attached to linked accounts, but i'd still not be surprised if there are some accounts attached to them elsewhere if they didn't get banned prior to receiving their first email.
i gotta admit i didn't read the source earlier though, and i agree with your points in general for bot accounts if they have been banned before being used.