Live data from Hacker News

ProtonMail includes Google Recaptcha for login

github.com

11–20 of 308 posts

Re: ProtonMail includes Google Recaptcha for login

#11
post #5

That stinks. I'm on Fastmail but its hard point has to do with being based in Australia and the recent government efforts of forcing entities to comply with police inquiries. Fastmail's side of the story: https://fastmail.blog/legal-policy/aabill-and-fastmail/

Fastmail rightly points out that the Australian law has no meaningful impact on them. They do not offer an end-to-end encrypted service, and hence, don't need to backdoor it.

The vast majority of mail services will hand your data to the government on court order. Though if your mail is hosted in a different country than you live in, it's arguably more frustrating for them to do so, since they must use international agreements to get it.

If state ordered surveillance is in your threat model, you need a very different type of mail service than almost everyone else.

Re: ProtonMail includes Google Recaptcha for login

#13
I was scratching my head this week when they were releasing the time the 'Hamas' bomb threat email came in with regard to Belarus high-jacking that flight.

It seemed rather fine-grained knowledge of specific communications that doesn't serve the narrative of privacy first. The articles I read made it sound like ProtonMail had just decided to share details on it rather than a more formal, court-ordered process.

I know in this situation there aren't too many people who would raise questions, but it did strike me as strange given how they market their service.

Re: ProtonMail includes Google Recaptcha for login

#15
post #14

Also seems particularly odd to even have recaptcha on the email login page. Who cares if robots check email so it doesn’t seem user friendly to prove humanity to read email or get a login error.

Not at all. You want to prevent robots from logging in as other users, for example when trying credentials stuffing.

Re: ProtonMail includes Google Recaptcha for login

#16
Try to register a new Protonmail email address normally and you can do so without supplying too much information. Try to do so through Tor, and you will not be able to proceed without “verifying” the account with a phone number. This pattern (they want either your IP or a phone number) tells me they’re likely interested in tying accounts to real identities and shouldn’t be trusted with anything private. I would even go so far as to suspect Protonmail of being a honeypot. Oh…I’ll just leave this here:

https://privacy-watchdog.io/truth-about-protonmail/

Re: ProtonMail includes Google Recaptcha for login

#17
post #14

Also seems particularly odd to even have recaptcha on the email login page. Who cares if robots check email so it doesn’t seem user friendly to prove humanity to read email or get a login error.

robots use email systems so they can get "free" way to send their stuff. I also work for e-mail company and this is very big problem to us. Sadly recaptcha before and cloudflare captcha now are one of the irreplaceable tools to fight with spammers for us...

Re: ProtonMail includes Google Recaptcha for login

#18

Try to register a new Protonmail email address normally and you can do so without supplying too much information. Try to do so through Tor, and you will not be able to proceed without “verifying” the account with a phone number. This pattern (they want either your IP or a phone number) tells me they’re likely interested in tying accounts to real identities and shouldn’t be trusted with anything private. I would even…

[deleted]

Re: ProtonMail includes Google Recaptcha for login

#19

I just tried logging into Protonmail in my regular browser and with a private mode window and didn't get a captcha in either case. Not saying it may not appear for others but I didn't see it.

Perhaps they do client fingerprinting across browsers so they didn't need to verify you ...

Re: ProtonMail includes Google Recaptcha for login

#20

I just tried logging into Protonmail in my regular browser and with a private mode window and didn't get a captcha in either case. Not saying it may not appear for others but I didn't see it.

Modern google captcha (v3??) doesn't show a captcha if they already have enough data about you. E.g. through 3rd party cookies, or by fingerprinting anything from your browser to your mouse movement and typing pattern. (Not sure what exactly they currently use, so this are just examples of what they might use).
Post reply on HN