Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail includes Google Recaptcha for login

github.com

Post reply on HN
Print view View original

241–250 of 308 posts

Re: ProtonMail includes Google Recaptcha for login

#241

Post by disqard »

MattGaiser wrote: post #113
aboringusername wrote: post #92

Although it seems to go against the spirit of Protonmail and its ethos I'm not exactly sure there are many good options, hcaptcha is the lesser of two evils and a fundamental requirement on the modern web. Even HN requires a recaptcha if you fail too many times (and it's also based on IP). If you want to blame anyone blame: 1: The bad actors spamming logins 2: Google for essentially monopolizing captcha hcaptcha prov…

I built a system that had all of a 100 or so users before some abuser came along. Limiting web abuse is a huge problem that requires solutions.

Would you be able to share what your solution looked like? Thanks in advance!

Re: ProtonMail includes Google Recaptcha for login

#242

Post by infogulch »

protonmail wrote: post #240
infogulch wrote: post #230

Earlier quoted context omitted.

Maybe some basic stats would concretize the problem for some commenters. E.g. What was the ratio of failed logins to successful ones before implementing captcha? Now that you've implemented captcha, what is that ratio among the population of users not presented with captcha, compared to to population that is? How many attempts did adding the captcha stop?

We were a bit surprised by the sudden reaction today. We have been using reCaptcha as one tool (among many) to fight abuse for years now. For example, here's a thread from 4 years ago mentioning it [1]. It is triggered most often for signup, but it can also appear for password reset, username lookup, sending mail, payments, login, and any other api routes which can be abused. That said, we can also understand the rea…

> For security reasons, we can't say too much

That's reasonable. Thanks for responding.

Re: ProtonMail includes Google Recaptcha for login

#243

Post by gerash »

Dylan16807 wrote: post #235
gerash wrote: post #203

Earlier quoted context omitted.

I think a full index of the contents of hundreds or thousands of emails and their attachments is soon going to take a lot of space and be slow on a mobile device. Also if you have multiple clients, which one is going to update the index and how do they sync up? Building index on a mobile device potentially kills its battery esp. if it needs to index pdfs and images. So it needs to be done while charging over night wh…

> I think a full index of the contents of hundreds or thousands of emails and their attachments is soon going to take a lot of space and be slow on a mobile device. The index doesn't need the attachments, does it? At a couple kilobytes per message you can fit a whole lot of text into a reasonable amount of phone storage. And there's no reason it should be slow. > Also if you have multiple clients, which one is going…

I have a lot of emails that are receipts from various businesses where most of the content is in an attached pdf. Same for image where you'd need to run OCR and some off the shelf object recognition on it but that's less common based on my usage.

Building the index independently on each client means if you login from a new device you need to wait for the index to be built. That said, maybe the index can itself be encrypted and uploaded to the server to be downloaded by new clients. Also building index is potentially expensive on a mobile phone and I don't want to wait for my phone to be plugged in to be able to search recent emails. The alternative would be to have an always on computer at home that decrypts, indexes your emails and then your mobile client updates its database from there. This whole system feel so fragile though.

I'm no expert in cryptography or syncing databases but imagine there are a lot of technical and usability issues.

Re: ProtonMail includes Google Recaptcha for login

#244

Post by bassdropvroom »

______- wrote: post #108
bassdropvroom wrote: post #65

Earlier quoted context omitted.

I don't understand the love for hCaptcha. The only thing it has going for it is being outside of the Google brand and that it is cheaper. Outside that, we don't know that they don't do the same shady shit Google does, they're equally as bad as reCaptcha, and they're equally inaccessible.

> The only thing it has going for it is being outside of the Google brand and that it is cheaper. I find hCaptchas easier to solve though. My carpal tunnel in my wrist doesn't flare up and I don't get RSI[0]. reCaptcha is notoriously complex & difficult to solve if you suffer from RSI or joint inflammation. [0] https://en.wikipedia.org/wiki/Repetitive_strain_injury

Really? Because I've had plenty of Cloudflare hCaptcha protections where I've had to repeat it 3 or more than, with the most being 6.

Maybe I'm just a robot as far as hCaptcha and reCaptcha are concerned.

Re: ProtonMail includes Google Recaptcha for login

#246

Post by Dylan16807 »

gerash wrote: post #243
Dylan16807 wrote: post #235

Earlier quoted context omitted.

> I think a full index of the contents of hundreds or thousands of emails and their attachments is soon going to take a lot of space and be slow on a mobile device. The index doesn't need the attachments, does it? At a couple kilobytes per message you can fit a whole lot of text into a reasonable amount of phone storage. And there's no reason it should be slow. > Also if you have multiple clients, which one is going…

I have a lot of emails that are receipts from various businesses where most of the content is in an attached pdf. Same for image where you'd need to run OCR and some off the shelf object recognition on it but that's less common based on my usage. Building the index independently on each client means if you login from a new device you need to wait for the index to be built. That said, maybe the index can itself be enc…

> Building the index independently on each client means if you login from a new device you need to wait for the index to be built. That said, maybe the index can itself be encrypted and uploaded to the server to be downloaded by new clients.

But how often do you log in from a new phone? And yes it could be.

> Also building index is potentially expensive on a mobile phone and I don't want to wait for my phone to be plugged in to be able to search recent emails.

As I said in more detail before, I don't think it is.

> I'm no expert in cryptography or syncing databases but imagine there are a lot of technical and usability issues.

There's a few. But making an app is already a process of dealing with dozens of technical and usability issues. None of these new ones sound like dealbreakers.

Re: ProtonMail includes Google Recaptcha for login

#247

Post by Aeolun »

Rastonbury wrote: post #215
jjav wrote: post #201

Earlier quoted context omitted.

A captcha of any kind on a paid service (or a storefront where I'm looking to pay money) is an absolute deal breaker for me. I will not be clicking on lights and stopsigns to be able to pay money.

Looks like they feel it's a necessary evil and only hits 1-2 percent of users

That’s no consolation if you are in that 1-2%.

Re: ProtonMail includes Google Recaptcha for login

#248

Post by pseudalopex »

artificial wrote: post #80
BostonEnginerd wrote: post #32

Earlier quoted context omitted.

The 1986 electronic privacy act consider emails older than 180 days old to be “abandoned” and do not require a warrant to access. Self-hosting at least means that this should not apply, I think.

From what I can see there was a House resolution passed in 2017 which protects email. https://www.eff.org/deeplinks/2018/05/email-privacy-act-come...

It never passed the Senate.[1]

[1] https://en.wikipedia.org/wiki/Email_Privacy_Act

Re: ProtonMail includes Google Recaptcha for login

#249

Post by protonmail »

Aeolun wrote: post #245

What I don’t understand is how any privacy focused service would ever choose Google as their captcha of choice. It’s just flies so flabbergastingly in the face of the entire point of the thing that I might as well stop using them.

It only appears for a tiny fraction of users. When recaptcha was first added in 2014, it was the only captcha service that wasn't broken. Today there is also hcaptcha, which we are working on implementing and will switch to that shortly.

Re: ProtonMail includes Google Recaptcha for login

#250

Post by Aeolun »

gerash wrote: post #227
abdullahkhalids wrote: post #219

Earlier quoted context omitted.

Google is discovering that this particular user is ripe for advertising security related products.

So the ultimate risk of using ReCAPTCHA on proton mail is that Google might find out I'm more tech savvy than the average? Fine by me.

No, no. Now Google knows you are using ProtonMail, and by extension the NSA knows you are protonmail, the FBI knows you are using ProtonMail, and so on.

This may or may not be a problem for you.

Post reply on HN