Tutanota uses an open source captcha. I guess their goal is to get rid of Google completely: https://tutanota.com/blog/posts/open-source-email/
ProtonMail includes Google Recaptcha for login
131–140 of 308 posts
Re: ProtonMail includes Google Recaptcha for login
#132Earlier quoted context omitted.
That’s what per-IP and per-user rate limiting is for—by themselves, those two are close to sufficient. Any form of CAPTCHA would be a terrible sole defence (such things don’t block bots, they just make it a bit more expensive and help a bit with drive-by attacks), and adds very little for defence-in-depth, while introducing new problems where you inconvenience and block access to your real customers. I find the inclu…
Per user does not help when doing credential stuffing - the attacker tries known credentials from a leak, it’s not random cracking. Per IP blocks can be circumvented by using a botnet and slowing your attack.
What we have here is users who don't re-use passwords being inconvenienced to protect those who do. Doubtlessly this is very progressive, as those who reuse passwords have less "has a fucking clue"-privilege. But nonetheless this does not sit right with me.
Re: ProtonMail includes Google Recaptcha for login
#133Earlier quoted context omitted.
Sorry if our answer wasn't clear. You can de-activate, but it must be manually requested through support.
You’re replies are very frustrating. It’s like you’re completely missing the point of the replies and focusing on very tiny, irrelevant details. Nobody is claiming that you can’t remove deactivated accounts. Only that you charge for them until you go through the rather annoying process of contacting customer support. And then you make some bad excuse that it’s in the name of security because somebody could potentiall…
> Obviously there could be a middle ground of allowing someone to deactivate 5 accounts per month or something.
A improvement like this is indeed in our feature backlog, and something we hope to implement in the future.
Re: ProtonMail includes Google Recaptcha for login
#134Although it seems to go against the spirit of Protonmail and its ethos I'm not exactly sure there are many good options, hcaptcha is the lesser of two evils and a fundamental requirement on the modern web. Even HN requires a recaptcha if you fail too many times (and it's also based on IP). If you want to blame anyone blame: 1: The bad actors spamming logins 2: Google for essentially monopolizing captcha hcaptcha prov…
I wouldn't say Google is monopolizing captcha, its that captcha is hard and you essentially need to come up some expensive problem that is hard for computers but easy for humans.
Personally, I hate hCaptcha more than recaptcha, Craigslist uses it for their contact forms and I hate. hCaptcha is much more difficult and tedious than recaptcha.
Re: ProtonMail includes Google Recaptcha for login
#135A few comments about this. A very small fraction of logins get the CAPTCHA challenge. We, and other services, face unrelenting brute force attacks on our login endpoints. If you are seeing a CAPTCHA on login, chances are that something about your connection is suspicious to our system. It's far from perfect, and we continue to improve it, but at most a percent or two of users are seeing CAPTCHA at any time. The CAPTC…
Thank you for explaining here, I really appreciate the work you’re doing and understand the non-trivial work it takes to protect users. While l’d love a Google free experience for PM, I also love having a near zero chance of a brute force attack. I’m a paid PM user and have been using it since the very early beta days. I never see the CAPTCHA on any OS, but I only connect from about 5 different IPs or while using Pro…
This means ProtonMail know who you are if you did not use third-party VPN.
Re: ProtonMail includes Google Recaptcha for login
#136I don't know if the hn protonmail account is an official account or a fan account, but it seems quite unprofessional and really scares me off being a protonmail customer.
We apologize for that. It's a weekend and we are working on giving folks responses as quickly as possible. Therefore, the responses are more to the point than usual.
Re: ProtonMail includes Google Recaptcha for login
#137Earlier quoted context omitted.
> Recently I've started getting really annoyed by them In the end, the services that are using captchas are the services that become the least liked, and users will start migrating to other services that don't use captchas, so there's a business penalty for using them. On the other hand, if you want to filter out bad actors, then captchas are the way to go. The reason I recommended hCaptcha is because they're easier…
I’m wondering how TOTP compares as a solution here: would you be able to filter out bad actors similarly by using that instead of a captcha?
When you log in with a password server gives you a cookie/token so you stay logged in. It can be invalidated if your IP changes, it expires or something like that. But if you're logged in with 2FA those rules can be relaxed, it's a simple as that if you ask me. Implementation dependent of course.
I don't think those sites show you a captcha before you enter your login and password, but rather on submit. So for that username you don't show them a captcha at all, if they don't have a proper cookie you ask for 2FA.
Re: ProtonMail includes Google Recaptcha for login
#138Earlier quoted context omitted.
Sorry if our answer wasn't clear. You can de-activate, but it must be manually requested through support.
You’re replies are very frustrating. It’s like you’re completely missing the point of the replies and focusing on very tiny, irrelevant details. Nobody is claiming that you can’t remove deactivated accounts. Only that you charge for them until you go through the rather annoying process of contacting customer support. And then you make some bad excuse that it’s in the name of security because somebody could potentiall…
This seems to be assuming bad faith, you've changed a complaint of a missing feature into a different request for a new feature (because contacting support is inconvenient), which are two different things. It would be best to not confuse the issue, and to focus on doing what you can to support the feature request, if that's what you're interested in having.
Re: ProtonMail includes Google Recaptcha for login
#139ProtonMail apparently also releases details about their customers email sending timestamps to the press. Very strange and not a good sign IMHO.
https://www.reuters.com/world/europe/email-bomb-threat-sent-...
Re: ProtonMail includes Google Recaptcha for login
#140Earlier quoted context omitted.
Hmm, I use it for everything, but I’m using the bridge with apple mail.app, maybe that’s a bit of the happy path for searching.. No real complaints besides the bridge sometimes pegging a cpu until I HUP it..
I also use the bridge with Thunderbird with no problems.
Was literally about to posit that as a solution.
It’s way above my pay grade but I wonder if homomorphic encryption could be leveraged at scale without compromising security.