Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail includes Google Recaptcha for login

github.com

Post reply on HN
Print view View original

231–240 of 308 posts

Re: ProtonMail includes Google Recaptcha for login

#231

Post by rantwasp »

intricatedetail wrote: post #218
rantwasp wrote: post #106

Earlier quoted context omitted.

gonna replace and evil with another one, but you can use amazon workmail (they have the spf, dkim, dmarc stuff figured out) with your own domain. it takes 10 minutes to setup. it does not have a flashy web ui - but if you do imap it doesn’t matter. cost: 12$/year for the domain, 4$/month for the user, 0.5$/month for the route53 zone so 5.5$/month to kick gmail to the curb. the gov is still gonna get your emails if th…

But does it mean Amazon reads your email?

you need to figure that out yourself. Does Amazon look at your files in S3? Do they inspect your API traffic? Look at the files on your EC2 instances?

Did I mention that Amazon has datacenters in places with stronger privacy laws (Germany cough cough)?

Re: ProtonMail includes Google Recaptcha for login

#232

Post by drivebycomment »

cookiengineer wrote: post #191
mannerheim wrote: post #161

Earlier quoted context omitted.

What about the case of someone signing up for thousands of accounts?

> What about the case of someone signing up for thousands of accounts? My question is related to the specific /login page, not the registration page. I understand the benefit for blocking spammer signups, but not for the current case of the login page where users have an account already, were verified that the account/password was correct (captcha appears in second step), and then have to enter a second decryption pa…

It increases the cost of credential stuffing attack, which is very common nowadays.

Re: ProtonMail includes Google Recaptcha for login

#233

Post by abdullahkhalids »

gerash wrote: post #227
abdullahkhalids wrote: post #219

Earlier quoted context omitted.

Google is discovering that this particular user is ripe for advertising security related products.

So the ultimate risk of using ReCAPTCHA on proton mail is that Google might find out I'm more tech savvy than the average? Fine by me.

Those are your values. Other people have values that they don't want to be tracked and profiles made on them as they move around on the internet.

Re: ProtonMail includes Google Recaptcha for login

#234

Post by mdoms »

zxzax wrote: post #226
mdoms wrote: post #211

Earlier quoted context omitted.

I don't know how anyone could look at protonmail's responses and not assume bad faith. They're obfuscating the issue so they can make technically correct but effectively useless excuses for crappy behaviour.

I'm not sure what you mean -- it makes sense to me that if you are paying for an email service, they would continue to charge you as long as you store and access those emails in their server, and they would have to take steps to prevent abuse from people who might try to store too much data. Can you be more specific about what the behavior is? Maybe you could show a good way that another email provider has solved thi…

Can you name another corporate email provider that doesn't free up seats when users are deactivated? To my knowledge this is how all of Proton Mail's competitors charge for seats - at least all the ones I know of.

Re: ProtonMail includes Google Recaptcha for login

#235

Post by Dylan16807 »

gerash wrote: post #203
minitech wrote: post #170

Earlier quoted context omitted.

> If you expect search functionality from them you don't get encryption. It’s not as if the client can’t maintain an encrypted index, they just haven’t implemented it. Also, apart from all of the important advantages of encryption, there’s always the privacy angle compared to Gmail: Google uses mail to target ads and scrape purchases, which a lot of people don’t want.

I think a full index of the contents of hundreds or thousands of emails and their attachments is soon going to take a lot of space and be slow on a mobile device. Also if you have multiple clients, which one is going to update the index and how do they sync up? Building index on a mobile device potentially kills its battery esp. if it needs to index pdfs and images. So it needs to be done while charging over night wh…

> I think a full index of the contents of hundreds or thousands of emails and their attachments is soon going to take a lot of space and be slow on a mobile device.

The index doesn't need the attachments, does it? At a couple kilobytes per message you can fit a whole lot of text into a reasonable amount of phone storage. And there's no reason it should be slow.

> Also if you have multiple clients, which one is going to update the index and how do they sync up?

Each client can either independently index new emails as they come in or upload something like a compressed csv of new entries for the index database. A hundred new emails should only take milliseconds to process.

> if it needs to index pdfs and images.

How do you index images? Indexing pdfs is much more of a nicety than a necessity, and it could be a setting on whether you want to spend the data. It shouldn't take long though, as far as I know. You don't need to render it or anything.

> If multiple mobile clients build their own indices syncing them and merge conflicts might arise.

If they build their own then you don't need to sync.

If they share and do sync, I still don't see how you'd get merge conflicts. Emails don't change, and index updates are just adding and removing entire emails.

Re: ProtonMail includes Google Recaptcha for login

#236

Post by doublejay1999 »

infogulch wrote: post #230
protonmail wrote: post #79

A few comments about this. A very small fraction of logins get the CAPTCHA challenge. We, and other services, face unrelenting brute force attacks on our login endpoints. If you are seeing a CAPTCHA on login, chances are that something about your connection is suspicious to our system. It's far from perfect, and we continue to improve it, but at most a percent or two of users are seeing CAPTCHA at any time. The CAPTC…

Maybe some basic stats would concretize the problem for some commenters. E.g. What was the ratio of failed logins to successful ones before implementing captcha? Now that you've implemented captcha, what is that ratio among the population of users not presented with captcha, compared to to population that is? How many attempts did adding the captcha stop?

> concretize

dear god

Re: ProtonMail includes Google Recaptcha for login

#237

Post by Dylan16807 »

zxzax wrote: post #225
Dylan16807 wrote: post #208

Earlier quoted context omitted.

If you have to contact support to stop paying for an account you're not using, that's definitely a missing feature.

That seems like a misreading, the very toplevel post says that you can stop paying by deleting all the data. Then the response says you can also do that by contacting support. Did I miss something?

The way I'm reading it, you need support's help to delete everything, but I admit I'm not sure if that's the correct reading.

Re: ProtonMail includes Google Recaptcha for login

#238

Post by gerash »

minitech wrote: post #224
gerash wrote: post #203

Earlier quoted context omitted.

I think a full index of the contents of hundreds or thousands of emails and their attachments is soon going to take a lot of space and be slow on a mobile device. Also if you have multiple clients, which one is going to update the index and how do they sync up? Building index on a mobile device potentially kills its battery esp. if it needs to index pdfs and images. So it needs to be done while charging over night wh…

> I think a full index of the contents of hundreds or thousands of emails and their attachments is soon going to take a lot of space and be slow on a mobile device. I initially read “hundreds of thousands” and would have agreed that it might be a problem for those rare users (not even sure about that), but no, “hundreds or thousands” is a trivial amount of data. Normal mailbox operations already need to synchronize s…

Implementing that is easier said than done.

I'd like to first see a real example of a mail service that in addition to e2e encryption is also best in class in terms of usability (quality and speed of search, spam filtering, auto categorization, ...).

For my use cases, usability comes first and e2e encryption comes second or even third (after price)

Re: ProtonMail includes Google Recaptcha for login

#239

Post by nightski »

amelius wrote: post #97
cowpig wrote: post #47

When I started my company we chose to use Protonmail. My advice to anyone who wants secure email: don't use protonmail. The email search is completely useless. I don't understand how it can possibly be so difficult to do a substring search on a corpus and rank them in some kind of sane way. Searching for old emails based on content is an exercise in futility. After a few years of using an email service, search become…

It used to be the case that both ProtonMail and FastMail were frequently recommended on HN. So, how is FastMail doing in comparison?

Long time fastmail user and I love it. Simple and works great. Use it for business and personal now.

Re: ProtonMail includes Google Recaptcha for login

#240

Post by protonmail »

infogulch wrote: post #230
protonmail wrote: post #79

A few comments about this. A very small fraction of logins get the CAPTCHA challenge. We, and other services, face unrelenting brute force attacks on our login endpoints. If you are seeing a CAPTCHA on login, chances are that something about your connection is suspicious to our system. It's far from perfect, and we continue to improve it, but at most a percent or two of users are seeing CAPTCHA at any time. The CAPTC…

Maybe some basic stats would concretize the problem for some commenters. E.g. What was the ratio of failed logins to successful ones before implementing captcha? Now that you've implemented captcha, what is that ratio among the population of users not presented with captcha, compared to to population that is? How many attempts did adding the captcha stop?

We were a bit surprised by the sudden reaction today. We have been using reCaptcha as one tool (among many) to fight abuse for years now. For example, here's a thread from 4 years ago mentioning it [1]. It is triggered most often for signup, but it can also appear for password reset, username lookup, sending mail, payments, login, and any other api routes which can be abused.

That said, we can also understand the reaction. Back in 2014, there were no viable alternatives. Today, there is one alternative, and we started the transition to hCaptcha earlier this year, and will complete it in the coming weeks.

For security reasons, we can't say too much, but some truly massive residential IP botnets have appeared in recent years and can make millions of attempts per day. On really bad days, Captcha can appear for nearly 1% of legitimate users (some who are unwittingly part of the botnet), while blocking nearly all of the malicious attempts.

[1] https://www.reddit.com/r/ProtonMail/comments/5z70cd/when_sig...

Post reply on HN