Security hardening ideas

[host 0]

After account creation it would be good idea to add option that can unlink your email from the database for security purposes. If someone get's into your email somehow thereafter he could reset the password and view the connected vpn users ip addresses. Does airvpn send any messages to email like confirmation? If that doesn´t sound good it might be good idea to accept only security question to reset password (option).

Second thing, also cencoring connected users ip addresses like this 11.22.33.xx would be good too.

 

I hope somebody agree with me .

[zhang888 1065]

In case someone gets access to your main real-life email, you probably have a bigger security issue other than

an attacker that would like to reset your password in order to get your real IP. When someone controls important

assets like emails, the threat gets similar to an attacker with physical access.

You can partially mitigate this threat by using a dedicated email for all the less-important services, which will not

put your other activities at risk in case it gets compromized. A gmail with 2FA and a strong password is a good choice.