Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail includes Google Recaptcha for login

github.com

Post reply on HN
Print view View original

91–100 of 308 posts

Re: ProtonMail includes Google Recaptcha for login

#91

Post by clairity »

ysavir wrote: post #78
clairity wrote: post #61

Earlier quoted context omitted.

hcaptcha is not much better than recaptcha, in that its only ‘improvement’ is shifting data extraction from google to cloudflare. also, captcha in general shifts burden onto and penalizes legitimate users, especially privacy-conscious ones, in addition to malicious ones. that is, false positive rates are too high to achieve acceptable false negative rates. it would be better not to use a centralized captcha service,…

Do you have any suggestions for alternatives?

write your own? many personal tech blogs do this for comment forms and the like. any kind of ambiguity that’s natural for a human to parse accurately but not obvious for a machine is fair game. most bots won’t one-off a solution for smaller sites, so it doesn’t need to be too fancy. for larger ones where one-off customizations might be more likely, lots of engineering resources go toward security and fraud prevention already, so they can afford more sophistication.

but more importantly, in the long term, it needs policy and legal progress. it needs to be costly and international (via treaties/sanctions).

Re: ProtonMail includes Google Recaptcha for login

#92

Post by aboringusername »

Although it seems to go against the spirit of Protonmail and its ethos I'm not exactly sure there are many good options, hcaptcha is the lesser of two evils and a fundamental requirement on the modern web.

Even HN requires a recaptcha if you fail too many times (and it's also based on IP).

If you want to blame anyone blame:

1: The bad actors spamming logins

2: Google for essentially monopolizing captcha

hcaptcha proves there's a market/demand for alternatives, this is HN, if you dislike it, go build a better alternative than Google's and I am sure PM will be only too pleased to switch.

Complaining is easy, actually changing something is more difficult.

(P.S I challenge anyone to deploy a system used by tens of thousands and not have any abuse/rate limiting systems, you'll soon be turning to captcha's at some point)

Re: ProtonMail includes Google Recaptcha for login

#93

Post by neltnerb »

cookiengineer wrote: post #2

Last week ProtonMail integrated Google's Recaptcha to their Login Page. As a project that advocates Privacy and Security, and was an immediate response to the Snowden Leaks, I find this kinda ironic that they now set the Google PREFs cookie for all of their users - while they still maintain the same marketing on their website. And well, I am looking for new options now, I guess.

As much as I appreciate this comment, it is weird that it floated to the very top when the article is about location tracking built into Android by Google.

Protonmail might have issues, but the threat of some leaked information through javascript and/or cookies (hello google fonts!) can be attributed to literally every site that uses recaptcha whereas the article is talking about a much, much worse practice of tracking physical location constantly and making it difficult or impossible to use your phone without giving that information to Google.

I hope protonmail finds a better way, and agree that it's not in keeping with their stance on privacy, but it is distracting from what Google is actually doing with phones by talking about an entirely unrelated issue.

No offense intended to the parent, the comment is interesting, it's just not about the article at all and yet is the top comment at the time I write this.

Re: ProtonMail includes Google Recaptcha for login

#94

Post by inamiyar »

buu700 wrote: post #70
cowpig wrote: post #47

When I started my company we chose to use Protonmail. My advice to anyone who wants secure email: don't use protonmail. The email search is completely useless. I don't understand how it can possibly be so difficult to do a substring search on a corpus and rank them in some kind of sane way. Searching for old emails based on content is an exercise in futility. After a few years of using an email service, search become…

They charge for users that are disabled Took me a second to figure out that you weren't claiming accessibility was only supported at an extra cost.

I didn't get it till reading this.

Re: ProtonMail includes Google Recaptcha for login

#95

Post by inamiyar »

cyberpunk wrote: post #67
jjcon wrote: post #56

Earlier quoted context omitted.

I’ll second this, I love the idea of proton mail but the product isn’t anywhere close to ready for daily driving. Great for the occasional should it arise however. Encryption should be a selling point and it seems like they use it more as an excuse.

Hmm, I use it for everything, but I’m using the bridge with apple mail.app, maybe that’s a bit of the happy path for searching.. No real complaints besides the bridge sometimes pegging a cpu until I HUP it..

I also use the bridge with Thunderbird with no problems.

Re: ProtonMail includes Google Recaptcha for login

#96

Post by owly »

protonmail wrote: post #79

A few comments about this. A very small fraction of logins get the CAPTCHA challenge. We, and other services, face unrelenting brute force attacks on our login endpoints. If you are seeing a CAPTCHA on login, chances are that something about your connection is suspicious to our system. It's far from perfect, and we continue to improve it, but at most a percent or two of users are seeing CAPTCHA at any time. The CAPTC…

Thank you for explaining here, I really appreciate the work you’re doing and understand the non-trivial work it takes to protect users. While l’d love a Google free experience for PM, I also love having a near zero chance of a brute force attack. I’m a paid PM user and have been using it since the very early beta days. I never see the CAPTCHA on any OS, but I only connect from about 5 different IPs or while using ProtonVPN.

Off topic: please implement font size adjustment capability on iOS!

Re: ProtonMail includes Google Recaptcha for login

#97

Post by amelius »

cowpig wrote: post #47

When I started my company we chose to use Protonmail. My advice to anyone who wants secure email: don't use protonmail. The email search is completely useless. I don't understand how it can possibly be so difficult to do a substring search on a corpus and rank them in some kind of sane way. Searching for old emails based on content is an exercise in futility. After a few years of using an email service, search become…

It used to be the case that both ProtonMail and FastMail were frequently recommended on HN. So, how is FastMail doing in comparison?

Re: ProtonMail includes Google Recaptcha for login

#98

Post by cookiengineer »

jimmaswell wrote: post #28
secfirstmd wrote: post #21

Earlier quoted context omitted.

Yep noticed this a long time ago and am very suspicious

A visitor from TOR is extraordinarily more likely to be abusive. It makes total sense to put up extra barriers, which is still short of blocking TOR users altogether, which is also fair for webmasters who don't want to deal with it.

> A visitor from TOR is extraordinarily more likely to be abusive. It makes total sense to put up extra barriers, which is still short of blocking TOR users altogether, which is also fair for webmasters who don't want to deal with it.

And why is that again? I want to understand that argument.

In case of DDoS scenario: Well, too late, traffic already served and server already done the workload.

In case of password brute forcing: Well, then implement a latency, or cryptographical challenge to delay it more efficiently.

In case of "evil" human: Well, if a human can get past your security so easily, then your approach to security through obfuscation might be wrong.

So, again, what is the scenario where a captcha helps you to avoid being "attacked" by malicious actors?

Re: ProtonMail includes Google Recaptcha for login

#99

Post by inamiyar »

edoceo wrote: post #82

Another user-hostile. Folks laugh when I say I run my own email (FreeBSD/Postfix) and "why build your own mail client"? Because, inevitably, all these for profit service providers turn against me.

The problem with running my own email is I don't want the hassle of convincing Google I'm not spam.

Re: ProtonMail includes Google Recaptcha for login

#100

Post by rantwasp »

protonmail wrote: post #62
Hard_Space wrote: post #55

Earlier quoted context omitted.

I have two PM accounts. Since implementation, every single login includes Captcha. I log in twice a day, Captcha is never omitted.

If you are using Tor or VPN, this might be the case. Another possibility is that you (or somebody on your network, or ISP in the case of NAT/shared mobile IP), have installed an app that is using an SDK like Luminati [1] or similar, which is causing the IP to be abused in the brute force attempts our anti-abuse systems are trying to prevent. [1] https://www.trendmicro.com/vinfo/hk-en/security/news/cybercr...

why was implementing captcha a thing you considered and do you understand the deep implications it has on your users?
Post reply on HN