
There was an attack against the Proton network - Belphemur
https://protonstatus.com/
======
Simorgh
Protonmail provides my only non-work email address for everything. Is it a
good idea to have multiple email accounts with multiple service providers?
Seems inconvenient. But then, perhaps I am taking a risk with my current set
up.

~~~
tyingq
SMTP is pretty resilient. Unless you have some critical process where email
can’t be delayed a few hours, I wouldn’t worry about it. You could, if needed,
get your own domain, and swap MX records to a different provider if something
like this arises. Yandex might be a good backup. They have a pretty good, and
free, service that allows you to bring your own domain.

------
wand3r
> There was a DDoS attack directed against the Proton network. We have
> mitigated the attack and recovered all services.

This was issued at about 11:15am eastern time.

------
rurban
Thanksfully it's only mail. So any outage is not critical. It really needs to
be bombarded 4 days for 100% to cause real lossage.

~~~
yigitdemirag
They have VPN service as well. It could be critical for VPN.

------
Insanity
I was wondering why I did but have access earlier today :-) just assumed it
was a 'normal' outage

------
alborzmassah
Why would someone want to take down protonmail..?

~~~
saganus
Maybe it's a way to test the attacker's infrastructure against a semi-hardened
target?

I say "semi" because it still seems like a small-ish player, and while I do
trust PM to have some very capable people handling their infrastructure, I
doubt they have tens of millions in their security budget (vs e.g. Cloudflare
or Google or perhaps certain banks).

------
sillysaurus3
What are the steps to mitigate a large-scale DDoS?

Say you're running a website fronted by Cloudflare, for example.

~~~
spyridonas
GitHub fought the largest ever recorded ddos using Akamai Prolexic. At least
according to Wired. [https://www.wired.com/story/github-ddos-
memcached](https://www.wired.com/story/github-ddos-memcached)

I think protonmail is experiencing the same type of attack (memcached
amplified)

~~~
FreeFull
After the Github attack, there was a larger, 1.7Tbps DDoS against an unnamed
client of Arbor Networks using the same memcached tactic. I hope someone is
working on getting all those open memcached servers secured..

~~~
sp332
Victor Gevers, co-founder and chairman of the GDI Foundation, says there are
already substantially fewer vulnerable servers.
[https://mobile.twitter.com/0xDUDE/status/971515743589322752](https://mobile.twitter.com/0xDUDE/status/971515743589322752)

