Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail includes Google Recaptcha for login

github.com

Post reply on HN
Print view View original

31–40 of 308 posts

Re: ProtonMail includes Google Recaptcha for login

#31

Post by RussianCow »

antiterra wrote: post #26
gloriousternary wrote: post #25

Earlier quoted context omitted.

I'm not saying you're wrong, but that particular source is well known for making big claims with insufficient evidence, and it reads like it was written by a conspiracy theorist. Many of the author's claims have already been (imo, pretty solidly) refuted by Proton. Disclaimer: using protonmail until my current subscription runs out, then selfhosting

Doesn’t self-hosting also have privacy downsides, being that all the hardware is tied to you? I’d imagine whatever minor resistance to wiretapping a multiuser site gave regarding privacy of non-investigated individuals would disappear.

It depends on your threat model. If you’re worried about big companies like Google harvesting your data, self-hosting is a great solution because you remove them from the equation entirely. On the other hand, if you’re worried about three-letter government agencies, you need to go through much more extreme measures. Most people aren’t as concerned with the latter, though.

Re: ProtonMail includes Google Recaptcha for login

#32

Post by BostonEnginerd »

antiterra wrote: post #26
gloriousternary wrote: post #25

Earlier quoted context omitted.

I'm not saying you're wrong, but that particular source is well known for making big claims with insufficient evidence, and it reads like it was written by a conspiracy theorist. Many of the author's claims have already been (imo, pretty solidly) refuted by Proton. Disclaimer: using protonmail until my current subscription runs out, then selfhosting

Doesn’t self-hosting also have privacy downsides, being that all the hardware is tied to you? I’d imagine whatever minor resistance to wiretapping a multiuser site gave regarding privacy of non-investigated individuals would disappear.

The 1986 electronic privacy act consider emails older than 180 days old to be “abandoned” and do not require a warrant to access.

Self-hosting at least means that this should not apply, I think.

Re: ProtonMail includes Google Recaptcha for login

#33

Post by chrismorgan »

malinens wrote: post #17
prepend wrote: post #14

Also seems particularly odd to even have recaptcha on the email login page. Who cares if robots check email so it doesn’t seem user friendly to prove humanity to read email or get a login error.

robots use email systems so they can get "free" way to send their stuff. I also work for e-mail company and this is very big problem to us. Sadly recaptcha before and cloudflare captcha now are one of the irreplaceable tools to fight with spammers for us...

For people signing up, sure. Anything that can send emails containing user-generated content will get abuse that way. But for logging in, it seems odd; unless you require something like it for SMTP access (which I haven’t heard of anyone ever doing), it’s not going to help you block spam-senders.

Re: ProtonMail includes Google Recaptcha for login

#34

Post by nexuist »

IAmGraydon wrote: post #16

Try to register a new Protonmail email address normally and you can do so without supplying too much information. Try to do so through Tor, and you will not be able to proceed without “verifying” the account with a phone number. This pattern (they want either your IP or a phone number) tells me they’re likely interested in tying accounts to real identities and shouldn’t be trusted with anything private. I would even…

> they’re likely interested in tying accounts to real identities

I don't think it means they're interested in tying accounts to a specific identity, just an identity, to prevent bots or bad actors from signing up for thousands of accounts. This is a necessary reality of being an email provider. If you do not police your outbound mail then other mail servers will block or auto-junk your users' messages.

There is no way to preserve privacy while also not becoming a festering ground for Viagra spam mail.

Re: ProtonMail includes Google Recaptcha for login

#35

Post by chrismorgan »

Xylakant wrote: post #15
prepend wrote: post #14

Also seems particularly odd to even have recaptcha on the email login page. Who cares if robots check email so it doesn’t seem user friendly to prove humanity to read email or get a login error.

Not at all. You want to prevent robots from logging in as other users, for example when trying credentials stuffing.

That’s what per-IP and per-user rate limiting is for—by themselves, those two are close to sufficient. Any form of CAPTCHA would be a terrible sole defence (such things don’t block bots, they just make it a bit more expensive and help a bit with drive-by attacks), and adds very little for defence-in-depth, while introducing new problems where you inconvenience and block access to your real customers. I find the inclusion of reCAPTCHA on a login page of a supposedly security-conscious entity very surprising. (Sign up is a different matter; there it will have very meaningful benefits and lower costs.)

Re: ProtonMail includes Google Recaptcha for login

#37

Post by plank_time »

gloriousternary wrote: post #25
IAmGraydon wrote: post #16

Try to register a new Protonmail email address normally and you can do so without supplying too much information. Try to do so through Tor, and you will not be able to proceed without “verifying” the account with a phone number. This pattern (they want either your IP or a phone number) tells me they’re likely interested in tying accounts to real identities and shouldn’t be trusted with anything private. I would even…

I'm not saying you're wrong, but that particular source is well known for making big claims with insufficient evidence, and it reads like it was written by a conspiracy theorist. Many of the author's claims have already been (imo, pretty solidly) refuted by Proton. Disclaimer: using protonmail until my current subscription runs out, then selfhosting

Self hosting these days is almost impossible because most email providers like gmail and yahoo mail will automatically move your emails to spam. It’s all based on IP address and how reliable that IP address is. Self hosting guarantees that all your sent email will end up in spam folders.

Re: ProtonMail includes Google Recaptcha for login

#39

Post by Xylakant »

chrismorgan wrote: post #35
Xylakant wrote: post #15

Earlier quoted context omitted.

Not at all. You want to prevent robots from logging in as other users, for example when trying credentials stuffing.

That’s what per-IP and per-user rate limiting is for—by themselves, those two are close to sufficient. Any form of CAPTCHA would be a terrible sole defence (such things don’t block bots, they just make it a bit more expensive and help a bit with drive-by attacks), and adds very little for defence-in-depth, while introducing new problems where you inconvenience and block access to your real customers. I find the inclu…

Per user does not help when doing credential stuffing - the attacker tries known credentials from a leak, it’s not random cracking. Per IP blocks can be circumvented by using a botnet and slowing your attack.

Re: ProtonMail includes Google Recaptcha for login

#40

Post by ______- »

toastercat wrote: post #10

I can recommend Migadu. Worth it if you already pay for a domain (which you should, imo, to have a portable e-mail address). I pay for the $19 annual plan and find it sufficient, and I love the flexibility of the admin panel.

Live link for anyone interested in this: https://www.migadu.com/
Post reply on HN