Live data from Hacker News

ProtonMail includes Google Recaptcha for login

github.com

301–308 of 308 posts

Re: ProtonMail includes Google Recaptcha for login

#301
post #147

Earlier quoted context omitted.

Hmm, I use it for everything, but I’m using the bridge with apple mail.app, maybe that’s a bit of the happy path for searching.. No real complaints besides the bridge sometimes pegging a cpu until I HUP it..

Apple mail app searching sucks. Might just be my personal experience but I find it easier to just search for email on gmail

It's not just you. Apple mail sucks for search.

Re: ProtonMail includes Google Recaptcha for login

#302

Earlier quoted context omitted.

hcaptcha is not much better than recaptcha, in that its only ‘improvement’ is shifting data extraction from google to cloudflare. also, captcha in general shifts burden onto and penalizes legitimate users, especially privacy-conscious ones, in addition to malicious ones. that is, false positive rates are too high to achieve acceptable false negative rates. it would be better not to use a centralized captcha service,…

This is not actually true: every relevant aspect is different from a privacy perspective, both technical and legal. Looking only at the technical differences, hCaptcha lets enterprise users like Proton locally scrub any info like IPs prior to sending to hCaptcha. It can be set up so that the user makes no direct connection at all to the service, and the code runs inside of a sandboxed IFRAME. As for false positive vs…

And yet I ge t stuck endless captcha. Without disclosing what a known good/bad signal is, you are essentially trust a black box and a random account on the internet

Re: ProtonMail includes Google Recaptcha for login

#303
> [from a commenter on the OP, in reply to the Protonmail response] If an Incognito Mode Web Browser with a graphical user that actively moves his mouse, types in the password in non-automated manner, key by key - not copy/pasted and not auto-inserted within a millisecond - seems suspicious by your system - then I have to say your ways of identifying or classifying suspicious behaviour is very flawed. There are way better, already solved ways, to do this.

If you know this, then I guarantee that the people making spam bots know this too. this is a very naïve argument

Re: ProtonMail includes Google Recaptcha for login

#304

Earlier quoted context omitted.

Sorry if our answer wasn't clear. You can de-activate, but it must be manually requested through support.

You’re replies are very frustrating. It’s like you’re completely missing the point of the replies and focusing on very tiny, irrelevant details. Nobody is claiming that you can’t remove deactivated accounts. Only that you charge for them until you go through the rather annoying process of contacting customer support. And then you make some bad excuse that it’s in the name of security because somebody could potentiall…

It's the same evasive maneuvers that are used on Reddit.

I would kindly suggest you stop wasting your time engaging them in their corp. troll techniques.

If you have additional questions hopefully other members can answer them here.

Re: ProtonMail includes Google Recaptcha for login

#305

Earlier quoted context omitted.

But does it mean Amazon reads your email?

you need to figure that out yourself. Does Amazon look at your files in S3? Do they inspect your API traffic? Look at the files on your EC2 instances? Did I mention that Amazon has datacenters in places with stronger privacy laws (Germany cough cough)?

I don't think companies that are too big to fail are particularly conscious of laws, especially in some European country...

Re: ProtonMail includes Google Recaptcha for login

#306

A few comments about this. A very small fraction of logins get the CAPTCHA challenge. We, and other services, face unrelenting brute force attacks on our login endpoints. If you are seeing a CAPTCHA on login, chances are that something about your connection is suspicious to our system. It's far from perfect, and we continue to improve it, but at most a percent or two of users are seeing CAPTCHA at any time. The CAPTC…

It's not necessary, as you could use a different captcha or challenge segment. Nobody is forcing you to us Google's solution, that is your choice.

Re: ProtonMail includes Google Recaptcha for login

#307
post #209

A few comments about this. A very small fraction of logins get the CAPTCHA challenge. We, and other services, face unrelenting brute force attacks on our login endpoints. If you are seeing a CAPTCHA on login, chances are that something about your connection is suspicious to our system. It's far from perfect, and we continue to improve it, but at most a percent or two of users are seeing CAPTCHA at any time. The CAPTC…

What's the problem with using ReCAPTCHA? Is it not the best tool for the job?

It goes against the very reason of Protonmail existing. If you are to accept privacy leaks by design, you have no reason to use what Protonmail claims to offer in the first place, and just stick with gmail.

Re: ProtonMail includes Google Recaptcha for login

#308

A few comments about this. A very small fraction of logins get the CAPTCHA challenge. We, and other services, face unrelenting brute force attacks on our login endpoints. If you are seeing a CAPTCHA on login, chances are that something about your connection is suspicious to our system. It's far from perfect, and we continue to improve it, but at most a percent or two of users are seeing CAPTCHA at any time. The CAPTC…

This is seriously skirting the issue. OP didn't complain about your use of robot detection. OP complained about your use of GOOGLE's robot detection, which is not privacy preserving. There are many other robot detection services out there, many of which are arguably more effective at detecting robots too.
Post reply on HN