Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail includes Google Recaptcha for login

github.com

Post reply on HN
Print view View original

81–90 of 308 posts

Re: ProtonMail includes Google Recaptcha for login

#81

Post by protonmail »

Hard_Space wrote: post #75
protonmail wrote: post #62

Earlier quoted context omitted.

If you are using Tor or VPN, this might be the case. Another possibility is that you (or somebody on your network, or ISP in the case of NAT/shared mobile IP), have installed an app that is using an SDK like Luminati [1] or similar, which is causing the IP to be abused in the brute force attempts our anti-abuse systems are trying to prevent. [1] https://www.trendmicro.com/vinfo/hk-en/security/news/cybercr...

Never used HolaVPN (apparently a prerequisite for Luminati). Never heard of it. Only turn my VPN on once in a blue moon for a few minutes.

Luminati, and companies like that, distribute an SDK to many app developers. App developers incorporate the SDK, and your device is unwittingly turned into a proxy network endpoint, and the app developer gets paid for this. A surprising number of apps do this, so you could have an app installed doing this without even being aware, as it would only be disclosed in the app's privacy policy, which people don't actually read.

Re: ProtonMail includes Google Recaptcha for login

#83

Post by onkoe »

bassdropvroom wrote: post #65
______- wrote: post #30

> I find this very absurd to see. This is absurd indeed. hCaptcha[0] is a better alternative though, and I wouldn't mind if they used that instead of reCaptcha. I never liked the carpal tunnel that reCaptcha introduces. [0] https://www.hcaptcha.com/

I don't understand the love for hCaptcha. The only thing it has going for it is being outside of the Google brand and that it is cheaper. Outside that, we don't know that they don't do the same shady shit Google does, they're equally as bad as reCaptcha, and they're equally inaccessible.

They use the word privacy a lot, so surely they respect it, right? :(

Re: ProtonMail includes Google Recaptcha for login

#84

Post by memco »

______- wrote: post #57
axegon_ wrote: post #44

Earlier quoted context omitted.

Even as recent as 5 years ago I liked the idea of a captchas. I still understand the purpose behind them but recently I've started getting really annoyed by them(whether that be reCaptcha or hcaptcha or anything else). They are just everywhere and it gets incredibly tedious to have to solve one every odd click or so. And it gets even worse if you use a vpn or tunnel or god forbid tor: there's no way to solve them the…

> Recently I've started getting really annoyed by them In the end, the services that are using captchas are the services that become the least liked, and users will start migrating to other services that don't use captchas, so there's a business penalty for using them. On the other hand, if you want to filter out bad actors, then captchas are the way to go. The reason I recommended hCaptcha is because they're easier…

I’m wondering how TOTP compares as a solution here: would you be able to filter out bad actors similarly by using that instead of a captcha?

Re: ProtonMail includes Google Recaptcha for login

#85

Post by Hard_Space »

protonmail wrote: post #81
Hard_Space wrote: post #75

Earlier quoted context omitted.

Never used HolaVPN (apparently a prerequisite for Luminati). Never heard of it. Only turn my VPN on once in a blue moon for a few minutes.

Luminati, and companies like that, distribute an SDK to many app developers. App developers incorporate the SDK, and your device is unwittingly turned into a proxy network endpoint, and the app developer gets paid for this. A surprising number of apps do this, so you could have an app installed doing this without even being aware, as it would only be disclosed in the app's privacy policy, which people don't actually…

Perhaps a list of apps would be helpful, otherwise it seems kind of a vague deflection.

Re: ProtonMail includes Google Recaptcha for login

#86

Post by rantwasp »

alisonkisk wrote: post #72
arkadiyt wrote: post #43

Their response on twitter [1]: "The recaptcha, when it shows up (in rare situations), is sandboxed so that it doesn't send any data to Google. We are also in the process of replacing it with hcaptcha." Not sure what possible sandboxing they could be referring to - if they load the captcha in an iframe from a different origin then it is true that Google's javascript can't access things on the Protonmail origin, but th…

What data is being sent to Google? Besides the user interacting with Google to solve the captcha? Or is that the problem?

the ip, any fingerprinting that the captcha code does.

so in effect google can tie you to this visit later if you interact with anything that has a captcha. now these two thinks are liked in the borg’s memory.

so if you use google (anything while logged in, even once) now google knows everything else you do

Re: ProtonMail includes Google Recaptcha for login

#87

Post by rantwasp »

edoceo wrote: post #82

Another user-hostile. Folks laugh when I say I run my own email (FreeBSD/Postfix) and "why build your own mail client"? Because, inevitably, all these for profit service providers turn against me.

i would not laugh. think it’s impressive and must eat a lot of time

Re: ProtonMail includes Google Recaptcha for login

#88

Post by yhager »

habibur wrote: post #45
plank_time wrote: post #37

Earlier quoted context omitted.

Self hosting these days is almost impossible because most email providers like gmail and yahoo mail will automatically move your emails to spam. It’s all based on IP address and how reliable that IP address is. Self hosting guarantees that all your sent email will end up in spam folders.

Not necessarily. Had been self hosting for decades and I move the server every two years to a new IP mostly because of server/os refresh. Right now only hotmail bounces mail. Am using DO/Singapore. Other centers fare better.

Same here, been hosting for over a decade now. You do need to be on top of all the latest technologies, and still some problems will arise once in a while. But all in all, it's a pretty smooth operation.

Re: ProtonMail includes Google Recaptcha for login

#89

Post by ipaddr »

octopoc wrote: post #59
protonmail wrote: post #53

This headline is unfortunately misleading. Recaptcha is not used on every login (this is verifiable). It only appears in rare situations when it is required to prevent abuse.

Yeah I can't remember the last time I got a captcha of any kind, so it has definitely been rare for me.

I use to get it everytime. Since I logged in from my desktop never again.

Re: ProtonMail includes Google Recaptcha for login

#90

Post by navanchauhan »

fnord77 wrote: post #64
cowpig wrote: post #47

When I started my company we chose to use Protonmail. My advice to anyone who wants secure email: don't use protonmail. The email search is completely useless. I don't understand how it can possibly be so difficult to do a substring search on a corpus and rank them in some kind of sane way. Searching for old emails based on content is an exercise in futility. After a few years of using an email service, search become…

aren't all messages encrypted on the server? that would make search difficult because no server process could read them. all your emails would have to be pulled into the client for decryption first.

Not really, it depends on each service provider.

You can imagine each user as a folder in the /var/mail directory, it depends on your implementation to encrypt the folder or not. Gmail encrypts all in-transit e-mails but I cannot find a reference for encrypting on their servers

Post reply on HN