Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail includes Google Recaptcha for login

github.com

Post reply on HN
Print view View original

111–120 of 308 posts

Re: ProtonMail includes Google Recaptcha for login

#111

Post by notafraudster »

protonmail wrote: post #48
cowpig wrote: post #47

When I started my company we chose to use Protonmail. My advice to anyone who wants secure email: don't use protonmail. The email search is completely useless. I don't understand how it can possibly be so difficult to do a substring search on a corpus and rank them in some kind of sane way. Searching for old emails based on content is an exercise in futility. After a few years of using an email service, search become…

A few clarifications. There is an export tool that is available. The reason we must count disabled addresses towards your quota is because if we did not do that, we would be susceptible to an attack where a paid user could run through our address space by creating and disabling addresses continuously, so some limits are required. You can remove disabled addresses, but only by contacting support.

This is a sort of weird reply. The person you're replying to isn't saying "you need to allow an attacker to create and disable millions of addresses to DOS you". They're saying "you need to allow medium to longer term clients that de-activate very small portions of their overall number of accounts to not have to pay for those". You already have a system to measure account numbers, so what makes it impossible to also measure active account %ages

Re: ProtonMail includes Google Recaptcha for login

#112

Post by ______- »

memco wrote: post #84
______- wrote: post #57

Earlier quoted context omitted.

> Recently I've started getting really annoyed by them In the end, the services that are using captchas are the services that become the least liked, and users will start migrating to other services that don't use captchas, so there's a business penalty for using them. On the other hand, if you want to filter out bad actors, then captchas are the way to go. The reason I recommended hCaptcha is because they're easier…

I’m wondering how TOTP compares as a solution here: would you be able to filter out bad actors similarly by using that instead of a captcha?

For a list of companies implementing this or U2F, check here: https://www.dongleauth.info/

Re: ProtonMail includes Google Recaptcha for login

#113

Post by MattGaiser »

aboringusername wrote: post #92

Although it seems to go against the spirit of Protonmail and its ethos I'm not exactly sure there are many good options, hcaptcha is the lesser of two evils and a fundamental requirement on the modern web. Even HN requires a recaptcha if you fail too many times (and it's also based on IP). If you want to blame anyone blame: 1: The bad actors spamming logins 2: Google for essentially monopolizing captcha hcaptcha prov…

I built a system that had all of a 100 or so users before some abuser came along. Limiting web abuse is a huge problem that requires solutions.

Re: ProtonMail includes Google Recaptcha for login

#114

Post by owly »

toastercat wrote: post #10

I can recommend Migadu. Worth it if you already pay for a domain (which you should, imo, to have a portable e-mail address). I pay for the $19 annual plan and find it sufficient, and I love the flexibility of the admin panel.

While visiting Migadu’s site, seems like a good option for some but new users should definitely read their drawbacks list before committing to it. No 2FA and no encryption. Therefore not a replacement for something like ProtonMail or TutaNota. https://www.migadu.com/procon/

Re: ProtonMail includes Google Recaptcha for login

#116

Post by protonmail »

notafraudster wrote: post #111
protonmail wrote: post #48

Earlier quoted context omitted.

A few clarifications. There is an export tool that is available. The reason we must count disabled addresses towards your quota is because if we did not do that, we would be susceptible to an attack where a paid user could run through our address space by creating and disabling addresses continuously, so some limits are required. You can remove disabled addresses, but only by contacting support.

This is a sort of weird reply. The person you're replying to isn't saying "you need to allow an attacker to create and disable millions of addresses to DOS you". They're saying "you need to allow medium to longer term clients that de-activate very small portions of their overall number of accounts to not have to pay for those". You already have a system to measure account numbers, so what makes it impossible to also…

Sorry if our answer wasn't clear. You can de-activate, but it must be manually requested through support.

Re: ProtonMail includes Google Recaptcha for login

#117

Post by protonmail »

rantwasp wrote: post #100
protonmail wrote: post #62

Earlier quoted context omitted.

If you are using Tor or VPN, this might be the case. Another possibility is that you (or somebody on your network, or ISP in the case of NAT/shared mobile IP), have installed an app that is using an SDK like Luminati [1] or similar, which is causing the IP to be abused in the brute force attempts our anti-abuse systems are trying to prevent. [1] https://www.trendmicro.com/vinfo/hk-en/security/news/cybercr...

why was implementing captcha a thing you considered and do you understand the deep implications it has on your users?

There is more information in the Github thread, but in short, it was done with extreme reluctance (and we are already in the process of implementing hcaptcha) as a result of login attacks from millions of residential IP addresses.

Re: ProtonMail includes Google Recaptcha for login

#118

Post by brundolf »

navanchauhan wrote: post #90
fnord77 wrote: post #64

Earlier quoted context omitted.

aren't all messages encrypted on the server? that would make search difficult because no server process could read them. all your emails would have to be pulled into the client for decryption first.

Not really, it depends on each service provider. You can imagine each user as a folder in the /var/mail directory, it depends on your implementation to encrypt the folder or not. Gmail encrypts all in-transit e-mails but I cannot find a reference for encrypting on their servers

Their point is that ProtonMail specifically does encrypt emails on the server. That's their headlining feature. Only clients are supposed to be able to decrypt them.

Re: ProtonMail includes Google Recaptcha for login

#119

Post by dna_polymerase »

cowpig wrote: post #47

When I started my company we chose to use Protonmail. My advice to anyone who wants secure email: don't use protonmail. The email search is completely useless. I don't understand how it can possibly be so difficult to do a substring search on a corpus and rank them in some kind of sane way. Searching for old emails based on content is an exercise in futility. After a few years of using an email service, search become…

That's what you get for making stupid decisions based on ideology instead of facts.

Protonmail says it very clearly that all mail is encrypted on their servers. If you expect search functionality from them you don't get encryption. You bought into some random surveillance state propaganda.

Google isn't interested in the mail of your random startup, they are happy expanding their cloud footprint. In return you get good search and top notch mail servers.

Make sane decisions instead of ideological ones. Product-wise there is not a thing wrong in the world with GMail.

Re: ProtonMail includes Google Recaptcha for login

#120

Post by xaduha »

______- wrote: post #112
memco wrote: post #84

Earlier quoted context omitted.

I’m wondering how TOTP compares as a solution here: would you be able to filter out bad actors similarly by using that instead of a captcha?

For a list of companies implementing this or U2F, check here: https://www.dongleauth.info/

https://2fa.directory is another one
Post reply on HN