Irony off Proton Mail Advice

The Irony of Security Advice: ProtonMail, Phishing Tips, and an Unfixed Spoofing Vulnerability

ProtonMail recently published a blog post discussing the ASOS data breach specifically, why the hackers went directly to customers and how stolen personal data enables more effective phishing attacks. Their advice to affected users is, frankly, sound guidance:

Change your password immediately if you're an ASOS customer.
Don't engage with anyone claiming to be from ASOS requesting additional information or claiming your account is locked report it through official channels.
Never click links in unexpected emails. Instead, navigate directly to the company's website or app.

Good advice. Hard to argue with any of it.

But here's the problem.

While ProtonMail is teaching users how to spot spoofed and phishing emails, they themselves are sitting on a known sender-spoofing vulnerability in their own platform one that reportedly allows anyone to send emails that appear to come from a legitimate @protonmail.com address. The details are documented publicly here:

According to that research, the issue was brought to their attention and unlike a typical bug bounty payout followed by a patch the vulnerability was reportedly paid out yet left unresolved. That means attackers could craft convincing phishing emails from ProtonMail's own domain, which is precisely the kind of attack ProtonMail is warning ASOS customers about.

Why this matters:

Trust asymmetry. Users inherently trust @protonmail.com addresses because the brand is built around privacy and security. A spoofing flaw in that exact domain is a phisher's dream and far more dangerous than a spoofed ASOS address.

Credibility gap. Publishing security hygiene tips while leaving a known, exploitable vulnerability unfixed undermines the very message being communicated. Security leadership requires leading by example.

Responsible disclosure exists for a reason. Acknowledging (and paying for) a vulnerability without remedying it leaves the entire ecosystem especially ProtonMail's own users exposed.

The takeaway for all of us:

The advice in ProtonMail's post remains valid regardless of who wrote it. But it's also a reminder to hold vendors accountable: don't assume a trusted domain means a safe email. Verify through independent channels, enable multi-factor authentication everywhere possible, and treat any unexpected message even from "reputable" providers with healthy skepticism.

It's not irony that a security company has flaws all software does. The irony is in lecturing users about phishing while an open door to phishing in your own house remains unlocked.

Fix the vulnerability. Then write the blog posts.