Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail includes Google Recaptcha for login

github.com

Post reply on HN
Print view View original

101–110 of 308 posts

Re: ProtonMail includes Google Recaptcha for login

#101

Post by pndy »

Hard_Space wrote: post #55
protonmail wrote: post #53

This headline is unfortunately misleading. Recaptcha is not used on every login (this is verifiable). It only appears in rare situations when it is required to prevent abuse.

I have two PM accounts. Since implementation, every single login includes Captcha. I log in twice a day, Captcha is never omitted.

I have 3 accounts which I'm using quite active throughout the week and I haven't seen any captcha on any of these, neither on Windows nor Linux; I'm using PM since I've moved from GMail in 2018.

I'm in Poland, using one of most popular landline ISP

Re: ProtonMail includes Google Recaptcha for login

#102

Post by totalZero »

owly wrote: post #96
protonmail wrote: post #79

A few comments about this. A very small fraction of logins get the CAPTCHA challenge. We, and other services, face unrelenting brute force attacks on our login endpoints. If you are seeing a CAPTCHA on login, chances are that something about your connection is suspicious to our system. It's far from perfect, and we continue to improve it, but at most a percent or two of users are seeing CAPTCHA at any time. The CAPTC…

Thank you for explaining here, I really appreciate the work you’re doing and understand the non-trivial work it takes to protect users. While l’d love a Google free experience for PM, I also love having a near zero chance of a brute force attack. I’m a paid PM user and have been using it since the very early beta days. I never see the CAPTCHA on any OS, but I only connect from about 5 different IPs or while using Pro…

This isn't an explanation, insofar as it's identical to the bartbutler post in the submission itself.

Re: ProtonMail includes Google Recaptcha for login

#103

Post by eatbots »

clairity wrote: post #61
arkadiyt wrote: post #43

Their response on twitter [1]: "The recaptcha, when it shows up (in rare situations), is sandboxed so that it doesn't send any data to Google. We are also in the process of replacing it with hcaptcha." Not sure what possible sandboxing they could be referring to - if they load the captcha in an iframe from a different origin then it is true that Google's javascript can't access things on the Protonmail origin, but th…

hcaptcha is not much better than recaptcha, in that its only ‘improvement’ is shifting data extraction from google to cloudflare. also, captcha in general shifts burden onto and penalizes legitimate users, especially privacy-conscious ones, in addition to malicious ones. that is, false positive rates are too high to achieve acceptable false negative rates. it would be better not to use a centralized captcha service,…

This is not actually true: every relevant aspect is different from a privacy perspective, both technical and legal.

Looking only at the technical differences, hCaptcha lets enterprise users like Proton locally scrub any info like IPs prior to sending to hCaptcha. It can be set up so that the user makes no direct connection at all to the service, and the code runs inside of a sandboxed IFRAME.

As for false positive vs false negative rates, not sure what you consider too high. We've been able to demonstrate FP rates under 0.005% when measured against known-good/bad signals from customers, which is as good as it gets.

(disclosure: work there)

Re: ProtonMail includes Google Recaptcha for login

#104

Post by vbezhenar »

amelius wrote: post #97
cowpig wrote: post #47

When I started my company we chose to use Protonmail. My advice to anyone who wants secure email: don't use protonmail. The email search is completely useless. I don't understand how it can possibly be so difficult to do a substring search on a corpus and rank them in some kind of sane way. Searching for old emails based on content is an exercise in futility. After a few years of using an email service, search become…

It used to be the case that both ProtonMail and FastMail were frequently recommended on HN. So, how is FastMail doing in comparison?

I'm not entirely happy with fastmail. Too much of legitimate mail ends up in Spam. They even put aliexpress mails to spam, that kind of domain surely must be whitelisted. I'd prefer more spam in inbox, because right now I have to check spam every the time to ensure that nothing is lost.

Re: ProtonMail includes Google Recaptcha for login

#105

Post by nxpnsv »

aboringusername wrote: post #92

Although it seems to go against the spirit of Protonmail and its ethos I'm not exactly sure there are many good options, hcaptcha is the lesser of two evils and a fundamental requirement on the modern web. Even HN requires a recaptcha if you fail too many times (and it's also based on IP). If you want to blame anyone blame: 1: The bad actors spamming logins 2: Google for essentially monopolizing captcha hcaptcha prov…

Seems there on the case already... https://twitter.com/ProtonMail/status/1398657423913668614

Re: ProtonMail includes Google Recaptcha for login

#106

Post by rantwasp »

inamiyar wrote: post #99
edoceo wrote: post #82

Another user-hostile. Folks laugh when I say I run my own email (FreeBSD/Postfix) and "why build your own mail client"? Because, inevitably, all these for profit service providers turn against me.

The problem with running my own email is I don't want the hassle of convincing Google I'm not spam.

gonna replace and evil with another one, but you can use amazon workmail (they have the spf, dkim, dmarc stuff figured out) with your own domain.

it takes 10 minutes to setup. it does not have a flashy web ui - but if you do imap it doesn’t matter.

cost: 12$/year for the domain, 4$/month for the user, 0.5$/month for the route53 zone

so 5.5$/month to kick gmail to the curb. the gov is still gonna get your emails if they want them.

Re: ProtonMail includes Google Recaptcha for login

#107

Post by loh »

amelius wrote: post #97
cowpig wrote: post #47

When I started my company we chose to use Protonmail. My advice to anyone who wants secure email: don't use protonmail. The email search is completely useless. I don't understand how it can possibly be so difficult to do a substring search on a corpus and rank them in some kind of sane way. Searching for old emails based on content is an exercise in futility. After a few years of using an email service, search become…

It used to be the case that both ProtonMail and FastMail were frequently recommended on HN. So, how is FastMail doing in comparison?

Check out TricepMail.com. I'm curious to see what HN thinks of it.

Re: ProtonMail includes Google Recaptcha for login

#108

Post by ______- »

bassdropvroom wrote: post #65
______- wrote: post #30

> I find this very absurd to see. This is absurd indeed. hCaptcha[0] is a better alternative though, and I wouldn't mind if they used that instead of reCaptcha. I never liked the carpal tunnel that reCaptcha introduces. [0] https://www.hcaptcha.com/

I don't understand the love for hCaptcha. The only thing it has going for it is being outside of the Google brand and that it is cheaper. Outside that, we don't know that they don't do the same shady shit Google does, they're equally as bad as reCaptcha, and they're equally inaccessible.

> The only thing it has going for it is being outside of the Google brand and that it is cheaper.

I find hCaptchas easier to solve though. My carpal tunnel in my wrist doesn't flare up and I don't get RSI[0].

reCaptcha is notoriously complex & difficult to solve if you suffer from RSI or joint inflammation.

[0] https://en.wikipedia.org/wiki/Repetitive_strain_injury

Re: ProtonMail includes Google Recaptcha for login

#109

Post by Aachen »

protonmail wrote: post #76
Aachen wrote: post #68

Earlier quoted context omitted.

That probably means you have tracking enabled. I'm not a protonmail user (I host my own email) but from my general experience with recaptcha, try opening it in a private navigation window. If recaptcha doesn't ask you to solve anything, they've already been tracking you to make up its mind. Of course, whether this is fine by you is up to you, but it sounds like you might be unaware of this.

No, there's no tracking in ProtonMail. Captchas appearing is entirely based upon IP reputation and number of recent login attempts.

Thanks for clarifying! Showing a captcha, though perhaps not Google's, under those conditions sounds sensible. I didn't know that as a non-user (I use your VPN, fwiw :) ).

Re: ProtonMail includes Google Recaptcha for login

#110

Post by brundolf »

jjcon wrote: post #56
cowpig wrote: post #47

When I started my company we chose to use Protonmail. My advice to anyone who wants secure email: don't use protonmail. The email search is completely useless. I don't understand how it can possibly be so difficult to do a substring search on a corpus and rank them in some kind of sane way. Searching for old emails based on content is an exercise in futility. After a few years of using an email service, search become…

I’ll second this, I love the idea of proton mail but the product isn’t anywhere close to ready for daily driving. Great for the occasional should it arise however. Encryption should be a selling point and it seems like they use it more as an excuse.

I've been using it for 2.5 years for my personal email (I don't do anything super complicated with email; mostly service notifications, the occasional correspondence with friends or recruiters or such). As far as UX, it's pretty mediocre (on both web and mobile) but it gets the job done for my purposes.
Post reply on HN