Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail includes Google Recaptcha for login

github.com

Post reply on HN
Print view View original

61–70 of 308 posts

Re: ProtonMail includes Google Recaptcha for login

#61

Post by clairity »

arkadiyt wrote: post #43

Their response on twitter [1]: "The recaptcha, when it shows up (in rare situations), is sandboxed so that it doesn't send any data to Google. We are also in the process of replacing it with hcaptcha." Not sure what possible sandboxing they could be referring to - if they load the captcha in an iframe from a different origin then it is true that Google's javascript can't access things on the Protonmail origin, but th…

hcaptcha is not much better than recaptcha, in that its only ‘improvement’ is shifting data extraction from google to cloudflare.

also, captcha in general shifts burden onto and penalizes legitimate users, especially privacy-conscious ones, in addition to malicious ones. that is, false positive rates are too high to achieve acceptable false negative rates.

it would be better not to use a centralized captcha service, if one must be used at all.

Re: ProtonMail includes Google Recaptcha for login

#62

Post by protonmail »

Hard_Space wrote: post #55
protonmail wrote: post #53

This headline is unfortunately misleading. Recaptcha is not used on every login (this is verifiable). It only appears in rare situations when it is required to prevent abuse.

I have two PM accounts. Since implementation, every single login includes Captcha. I log in twice a day, Captcha is never omitted.

If you are using Tor or VPN, this might be the case. Another possibility is that you (or somebody on your network, or ISP in the case of NAT/shared mobile IP), have installed an app that is using an SDK like Luminati [1] or similar, which is causing the IP to be abused in the brute force attempts our anti-abuse systems are trying to prevent.

[1] https://www.trendmicro.com/vinfo/hk-en/security/news/cybercr...

Re: ProtonMail includes Google Recaptcha for login

#63

Post by ulimn »

cowpig wrote: post #47

When I started my company we chose to use Protonmail. My advice to anyone who wants secure email: don't use protonmail. The email search is completely useless. I don't understand how it can possibly be so difficult to do a substring search on a corpus and rank them in some kind of sane way. Searching for old emails based on content is an exercise in futility. After a few years of using an email service, search become…

I think the search doesn’t include the message of the email is because it’s encrypted and it would have to decrypt every single email to do it.

// Or something like that, I’m dumb for cryptography :)

Re: ProtonMail includes Google Recaptcha for login

#64

Post by fnord77 »

cowpig wrote: post #47

When I started my company we chose to use Protonmail. My advice to anyone who wants secure email: don't use protonmail. The email search is completely useless. I don't understand how it can possibly be so difficult to do a substring search on a corpus and rank them in some kind of sane way. Searching for old emails based on content is an exercise in futility. After a few years of using an email service, search become…

aren't all messages encrypted on the server? that would make search difficult because no server process could read them. all your emails would have to be pulled into the client for decryption first.

Re: ProtonMail includes Google Recaptcha for login

#65

Post by bassdropvroom »

______- wrote: post #30

> I find this very absurd to see. This is absurd indeed. hCaptcha[0] is a better alternative though, and I wouldn't mind if they used that instead of reCaptcha. I never liked the carpal tunnel that reCaptcha introduces. [0] https://www.hcaptcha.com/

I don't understand the love for hCaptcha. The only thing it has going for it is being outside of the Google brand and that it is cheaper. Outside that, we don't know that they don't do the same shady shit Google does, they're equally as bad as reCaptcha, and they're equally inaccessible.

Re: ProtonMail includes Google Recaptcha for login

#67

Post by cyberpunk »

jjcon wrote: post #56
cowpig wrote: post #47

When I started my company we chose to use Protonmail. My advice to anyone who wants secure email: don't use protonmail. The email search is completely useless. I don't understand how it can possibly be so difficult to do a substring search on a corpus and rank them in some kind of sane way. Searching for old emails based on content is an exercise in futility. After a few years of using an email service, search become…

I’ll second this, I love the idea of proton mail but the product isn’t anywhere close to ready for daily driving. Great for the occasional should it arise however. Encryption should be a selling point and it seems like they use it more as an excuse.

Hmm, I use it for everything, but I’m using the bridge with apple mail.app, maybe that’s a bit of the happy path for searching..

No real complaints besides the bridge sometimes pegging a cpu until I HUP it..

Re: ProtonMail includes Google Recaptcha for login

#68

Post by Aachen »

octopoc wrote: post #59
protonmail wrote: post #53

This headline is unfortunately misleading. Recaptcha is not used on every login (this is verifiable). It only appears in rare situations when it is required to prevent abuse.

Yeah I can't remember the last time I got a captcha of any kind, so it has definitely been rare for me.

That probably means you have tracking enabled. I'm not a protonmail user (I host my own email) but from my general experience with recaptcha, try opening it in a private navigation window. If recaptcha doesn't ask you to solve anything, they've already been tracking you to make up its mind. Of course, whether this is fine by you is up to you, but it sounds like you might be unaware of this.

Re: ProtonMail includes Google Recaptcha for login

#69

Post by mannerheim »

nexuist wrote: post #34
IAmGraydon wrote: post #16

Try to register a new Protonmail email address normally and you can do so without supplying too much information. Try to do so through Tor, and you will not be able to proceed without “verifying” the account with a phone number. This pattern (they want either your IP or a phone number) tells me they’re likely interested in tying accounts to real identities and shouldn’t be trusted with anything private. I would even…

> they’re likely interested in tying accounts to real identities I don't think it means they're interested in tying accounts to a specific identity, just an identity, to prevent bots or bad actors from signing up for thousands of accounts. This is a necessary reality of being an email provider. If you do not police your outbound mail then other mail servers will block or auto-junk your users' messages. There is no wa…

Perhaps a way to solve it would be to accept a nominal fee of cryptocurrency. Even a one-time fee of e.g. $5 would probably put a damper in someone trying to sign up for thousands of accounts while preserving privacy for real users.

Re: ProtonMail includes Google Recaptcha for login

#70

Post by buu700 »

cowpig wrote: post #47

When I started my company we chose to use Protonmail. My advice to anyone who wants secure email: don't use protonmail. The email search is completely useless. I don't understand how it can possibly be so difficult to do a substring search on a corpus and rank them in some kind of sane way. Searching for old emails based on content is an exercise in futility. After a few years of using an email service, search become…

They charge for users that are disabled

Took me a second to figure out that you weren't claiming accessibility was only supported at an extra cost.

Post reply on HN