Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail includes Google Recaptcha for login

github.com

Post reply on HN
Print view View original

141–150 of 308 posts

Re: ProtonMail includes Google Recaptcha for login

#141

Post by darkhorse22 »

cookiengineer wrote: post #98
jimmaswell wrote: post #28

Earlier quoted context omitted.

A visitor from TOR is extraordinarily more likely to be abusive. It makes total sense to put up extra barriers, which is still short of blocking TOR users altogether, which is also fair for webmasters who don't want to deal with it.

> A visitor from TOR is extraordinarily more likely to be abusive. It makes total sense to put up extra barriers, which is still short of blocking TOR users altogether, which is also fair for webmasters who don't want to deal with it. And why is that again? I want to understand that argument. In case of DDoS scenario: Well, too late, traffic already served and server already done the workload. In case of password bru…

The mindset is basically: Programming is hard so we're going to block as many non-paying customers as possible to limit the blast radius when we inevitably fuck up. And inconvenience those paying users too, because we can't figure out how to mitigate DoS attacks at the edge. And then we'll give a talk at a Next.js conference or something.

Re: ProtonMail includes Google Recaptcha for login

#142

Post by texasbigdata »

alpaca128 wrote: post #130
bassdropvroom wrote: post #51

Earlier quoted context omitted.

Note: due to the design of PM, the search is done client-side rather than server-side. It's not an excuse but at the very least, full-text search is harder.

Full-text search within the average amount of a single user's emails is trivial and fast on any modern PC. Smartphones do it for autocompletion suggestions every time you type a letter. The only thing taking longer than a few milliseconds is the initial indexing.

This sort of comment is frustrating. How many times has XYZ site had broken search? It seems to _not_ be a trivial problem still.

Re: ProtonMail includes Google Recaptcha for login

#143

Post by clairity »

eatbots wrote: post #103
clairity wrote: post #61

Earlier quoted context omitted.

hcaptcha is not much better than recaptcha, in that its only ‘improvement’ is shifting data extraction from google to cloudflare. also, captcha in general shifts burden onto and penalizes legitimate users, especially privacy-conscious ones, in addition to malicious ones. that is, false positive rates are too high to achieve acceptable false negative rates. it would be better not to use a centralized captcha service,…

This is not actually true: every relevant aspect is different from a privacy perspective, both technical and legal. Looking only at the technical differences, hCaptcha lets enterprise users like Proton locally scrub any info like IPs prior to sending to hCaptcha. It can be set up so that the user makes no direct connection at all to the service, and the code runs inside of a sandboxed IFRAME. As for false positive vs…

those things can be true and still not negate the issues mentioned, since not enough information is provided to make a fair assessment. it can be set up a certain way, but the incentives are against that, so is it actually set up that way? iframes aren’t perfectly isolated either. and without a curve of false positive vs. false negative rates, no conclusion can be made of the optimality. even 0.005% is still likely hundreds of thousands a day for larger sites, and being only a demonstration means it’s an ideal measure, not a practical one.

Re: ProtonMail includes Google Recaptcha for login

#145

Post by trulyme »

vbezhenar wrote: post #104
amelius wrote: post #97

Earlier quoted context omitted.

It used to be the case that both ProtonMail and FastMail were frequently recommended on HN. So, how is FastMail doing in comparison?

I'm not entirely happy with fastmail. Too much of legitimate mail ends up in Spam. They even put aliexpress mails to spam, that kind of domain surely must be whitelisted. I'd prefer more spam in inbox, because right now I have to check spam every the time to ensure that nothing is lost.

A bit off-topic, but I'm constantly surprised that e-mail companies are so bad at this. If I, as a user, keep corresponding with someone, what kind of brain-dead system keeps putting their mails to spam? (answer: gmail) I am communicating with them, do you really think they are spamming me? It's so frustrating. And yes, their SPF & similar headers are correct (or at least they seem to be, as G of course doesn't tell me why it went to spam). I know I can setup filters, but I thought they had that "smart" machine learning thingy? Or at least some simple "if" statements? /rant

Re: ProtonMail includes Google Recaptcha for login

#146

Post by alias_neo »

alpaca128 wrote: post #130
bassdropvroom wrote: post #51

Earlier quoted context omitted.

Note: due to the design of PM, the search is done client-side rather than server-side. It's not an excuse but at the very least, full-text search is harder.

Full-text search within the average amount of a single user's emails is trivial and fast on any modern PC. Smartphones do it for autocompletion suggestions every time you type a letter. The only thing taking longer than a few milliseconds is the initial indexing.

Doesn't that assume you _have_ all of the emails on your device on order to search them?

I know for a fact, Gmail on my phone doesn't have the ~15 years of email in my account downloaded. I bet that would take significantly longer to download than the actual search would would take to perform.

If the things to be searched aren't already on the client, a client side search doesn't seem too useful to me, regardless of how much compute power you have.

Re: ProtonMail includes Google Recaptcha for login

#147

Post by wyxuan »

cyberpunk wrote: post #67
jjcon wrote: post #56

Earlier quoted context omitted.

I’ll second this, I love the idea of proton mail but the product isn’t anywhere close to ready for daily driving. Great for the occasional should it arise however. Encryption should be a selling point and it seems like they use it more as an excuse.

Hmm, I use it for everything, but I’m using the bridge with apple mail.app, maybe that’s a bit of the happy path for searching.. No real complaints besides the bridge sometimes pegging a cpu until I HUP it..

Apple mail app searching sucks. Might just be my personal experience but I find it easier to just search for email on gmail

Re: ProtonMail includes Google Recaptcha for login

#149

Post by fractalf »

amelius wrote: post #97
cowpig wrote: post #47

When I started my company we chose to use Protonmail. My advice to anyone who wants secure email: don't use protonmail. The email search is completely useless. I don't understand how it can possibly be so difficult to do a substring search on a corpus and rank them in some kind of sane way. Searching for old emails based on content is an exercise in futility. After a few years of using an email service, search become…

It used to be the case that both ProtonMail and FastMail were frequently recommended on HN. So, how is FastMail doing in comparison?

I've used fastmail for 20 years and Im very happy about it. Before that I used telnet to a server and running pine. While traveling in India I got fed up by the lag so I decided to try out this web-mail thing that everyone was talking about. I came across an Indian IT magazine that compared all the big players at the time, and fastmail came up on top. Easy choose, never liked big corp anyway. I've since tried out most alternatives, buy nothing could match my need as well as fastmail. Thumbs up!

Re: ProtonMail includes Google Recaptcha for login

#150

Post by OminousWeapons »

arkadiyt wrote: post #43

Their response on twitter [1]: "The recaptcha, when it shows up (in rare situations), is sandboxed so that it doesn't send any data to Google. We are also in the process of replacing it with hcaptcha." Not sure what possible sandboxing they could be referring to - if they load the captcha in an iframe from a different origin then it is true that Google's javascript can't access things on the Protonmail origin, but th…

I can't speak to the sandboxing, but their implementation is definitely non-standard considering that I don't see Google or gstatic appearing in umatrix when I go through the logon process and they aren't flagging me for captcha even though I am coming out of a known VPN endpoint which trips recaptcha on every other site that employs it.
Post reply on HN