Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail includes Google Recaptcha for login

github.com

Post reply on HN
Print view View original

201–210 of 308 posts

Re: ProtonMail includes Google Recaptcha for login

#201

Post by jjav »

protonmail wrote: post #79

A few comments about this. A very small fraction of logins get the CAPTCHA challenge. We, and other services, face unrelenting brute force attacks on our login endpoints. If you are seeing a CAPTCHA on login, chances are that something about your connection is suspicious to our system. It's far from perfect, and we continue to improve it, but at most a percent or two of users are seeing CAPTCHA at any time. The CAPTC…

A captcha of any kind on a paid service (or a storefront where I'm looking to pay money) is an absolute deal breaker for me. I will not be clicking on lights and stopsigns to be able to pay money.

Re: ProtonMail includes Google Recaptcha for login

#202

Post by efficax »

neurostimulant wrote: post #200

Someone mentioned about using proof of work as an alternative to capthca. Sounds interesting, but will this actually effective in real world? I assume even selenium can pass it without a problem because all it did was making the client busy for a little while, so will it actually effective at reducing brute force rate? Also, do botnet operators have capability to deploy selenium-based workload to their botnet army?

proof of work originated to stop spam. But it’s a question of cost. If it costs less to bypass bot detection than the money made by the bot activity, then they’ll do it, whether captcha farms or doing proof of work calculations.

Re: ProtonMail includes Google Recaptcha for login

#203

Post by gerash »

minitech wrote: post #170
dna_polymerase wrote: post #119

Earlier quoted context omitted.

That's what you get for making stupid decisions based on ideology instead of facts. Protonmail says it very clearly that all mail is encrypted on their servers. If you expect search functionality from them you don't get encryption. You bought into some random surveillance state propaganda. Google isn't interested in the mail of your random startup, they are happy expanding their cloud footprint. In return you get goo…

> If you expect search functionality from them you don't get encryption. It’s not as if the client can’t maintain an encrypted index, they just haven’t implemented it. Also, apart from all of the important advantages of encryption, there’s always the privacy angle compared to Gmail: Google uses mail to target ads and scrape purchases, which a lot of people don’t want.

I think a full index of the contents of hundreds or thousands of emails and their attachments is soon going to take a lot of space and be slow on a mobile device.

Also if you have multiple clients, which one is going to update the index and how do they sync up? Building index on a mobile device potentially kills its battery esp. if it needs to index pdfs and images. So it needs to be done while charging over night which means you can only search emails from yesterday. If multiple mobile clients build their own indices merge conflicts might arise.

So yeah, if you're opting for an encrypted email then your search experience will suffer. It's the user's choice obviously.

The advertisement on Gmail is for free accounts btw and it seems extremely dumb. I get ads for Google Fi in Gmail even though I'm a Google Fi subscriber.

Re: ProtonMail includes Google Recaptcha for login

#204

Post by neurostimulant »

vbezhenar wrote: post #104
amelius wrote: post #97

Earlier quoted context omitted.

It used to be the case that both ProtonMail and FastMail were frequently recommended on HN. So, how is FastMail doing in comparison?

I'm not entirely happy with fastmail. Too much of legitimate mail ends up in Spam. They even put aliexpress mails to spam, that kind of domain surely must be whitelisted. I'd prefer more spam in inbox, because right now I have to check spam every the time to ensure that nothing is lost.

To be fair, aliexpress is pretty spammy. If they use simple bayesian filter for their spam filter it's pretty understandable that aliexpress emails ended up being marked as spam.

Re: ProtonMail includes Google Recaptcha for login

#205

Post by beermonster »

plank_time wrote: post #37
gloriousternary wrote: post #25

Earlier quoted context omitted.

I'm not saying you're wrong, but that particular source is well known for making big claims with insufficient evidence, and it reads like it was written by a conspiracy theorist. Many of the author's claims have already been (imo, pretty solidly) refuted by Proton. Disclaimer: using protonmail until my current subscription runs out, then selfhosting

Self hosting these days is almost impossible because most email providers like gmail and yahoo mail will automatically move your emails to spam. It’s all based on IP address and how reliable that IP address is. Self hosting guarantees that all your sent email will end up in spam folders.

If you use SPF/DKIM/DMARC you can still self host.

Re: ProtonMail includes Google Recaptcha for login

#206

Post by jjav »

plank_time wrote: post #37
gloriousternary wrote: post #25

Earlier quoted context omitted.

I'm not saying you're wrong, but that particular source is well known for making big claims with insufficient evidence, and it reads like it was written by a conspiracy theorist. Many of the author's claims have already been (imo, pretty solidly) refuted by Proton. Disclaimer: using protonmail until my current subscription runs out, then selfhosting

Self hosting these days is almost impossible because most email providers like gmail and yahoo mail will automatically move your emails to spam. It’s all based on IP address and how reliable that IP address is. Self hosting guarantees that all your sent email will end up in spam folders.

> Self hosting these days is almost impossible because most email providers like gmail and yahoo mail will automatically move your emails to spam.

This is completely not true. Comes up every time there is a thread related to email. Every time many of us who host our own email servers will explain how it is not true. You can absolutely self-host your email server for your domains, configure it correctly and it will work fine.

gmail has a huge false positive spam identification problem, but it applies to all emails, even those from gmail to gmail.

Re: ProtonMail includes Google Recaptcha for login

#207

Post by b0tzzzzzzman »

CoNet wrote: post #135
owly wrote: post #96

Earlier quoted context omitted.

Thank you for explaining here, I really appreciate the work you’re doing and understand the non-trivial work it takes to protect users. While l’d love a Google free experience for PM, I also love having a near zero chance of a brute force attack. I’m a paid PM user and have been using it since the very early beta days. I never see the CAPTCHA on any OS, but I only connect from about 5 different IPs or while using Pro…

This means ProtonMail know who you are if you did not use third-party VPN.

Yes, but the ussue being pointed out is third party google.. Also being made aware. Many users pay proton for the services. Should we also be upset about payment processors logging this? Last time I tried to make a new protonmail, a phone number or non protonmail account was required. The limit which emails are valid.

They are not what they were, what they stood against. They have been assimilated.

Sad times. But, hey they reply unlike the big G.

Re: ProtonMail includes Google Recaptcha for login

#208

Post by Dylan16807 »

zxzax wrote: post #138
spiderice wrote: post #121

Earlier quoted context omitted.

You’re replies are very frustrating. It’s like you’re completely missing the point of the replies and focusing on very tiny, irrelevant details. Nobody is claiming that you can’t remove deactivated accounts. Only that you charge for them until you go through the rather annoying process of contacting customer support. And then you make some bad excuse that it’s in the name of security because somebody could potentiall…

This seems to be assuming bad faith, you've changed a complaint of a missing feature into a different request for a new feature (because contacting support is inconvenient), which are two different things. It would be best to not confuse the issue, and to focus on doing what you can to support the feature request, if that's what you're interested in having.

If you have to contact support to stop paying for an account you're not using, that's definitely a missing feature.

Re: ProtonMail includes Google Recaptcha for login

#209

Post by gerash »

protonmail wrote: post #79

A few comments about this. A very small fraction of logins get the CAPTCHA challenge. We, and other services, face unrelenting brute force attacks on our login endpoints. If you are seeing a CAPTCHA on login, chances are that something about your connection is suspicious to our system. It's far from perfect, and we continue to improve it, but at most a percent or two of users are seeing CAPTCHA at any time. The CAPTC…

What's the problem with using ReCAPTCHA? Is it not the best tool for the job?

Re: ProtonMail includes Google Recaptcha for login

#210

Post by b0tzzzzzzman »

duckfang wrote: post #125
spiderice wrote: post #121

Earlier quoted context omitted.

You’re replies are very frustrating. It’s like you’re completely missing the point of the replies and focusing on very tiny, irrelevant details. Nobody is claiming that you can’t remove deactivated accounts. Only that you charge for them until you go through the rather annoying process of contacting customer support. And then you make some bad excuse that it’s in the name of security because somebody could potentiall…

This line of discussion from Protonmail is making me greatly reconsider closing my accounts (plural) there for VPN and mail service. This is embarrassing at minimum, and show negative interaction with customers.

Completely agree.
Post reply on HN