Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail includes Google Recaptcha for login

github.com

Post reply on HN
Print view View original

121–130 of 308 posts

Re: ProtonMail includes Google Recaptcha for login

#121

Post by spiderice »

protonmail wrote: post #116
notafraudster wrote: post #111

Earlier quoted context omitted.

This is a sort of weird reply. The person you're replying to isn't saying "you need to allow an attacker to create and disable millions of addresses to DOS you". They're saying "you need to allow medium to longer term clients that de-activate very small portions of their overall number of accounts to not have to pay for those". You already have a system to measure account numbers, so what makes it impossible to also…

Sorry if our answer wasn't clear. You can de-activate, but it must be manually requested through support.

You’re replies are very frustrating. It’s like you’re completely missing the point of the replies and focusing on very tiny, irrelevant details. Nobody is claiming that you can’t remove deactivated accounts. Only that you charge for them until you go through the rather annoying process of contacting customer support. And then you make some bad excuse that it’s in the name of security because somebody could potentially make and deactivate millions of accounts. Obviously there could be a middle ground of allowing someone to deactivate 5 accounts per month or something.

I suggest you either stop responding, or actually respond to the issues people have, and don’t make excuses that are paper thin.

Re: ProtonMail includes Google Recaptcha for login

#123

Post by briefcomment »

clairity wrote: post #61
arkadiyt wrote: post #43

Their response on twitter [1]: "The recaptcha, when it shows up (in rare situations), is sandboxed so that it doesn't send any data to Google. We are also in the process of replacing it with hcaptcha." Not sure what possible sandboxing they could be referring to - if they load the captcha in an iframe from a different origin then it is true that Google's javascript can't access things on the Protonmail origin, but th…

hcaptcha is not much better than recaptcha, in that its only ‘improvement’ is shifting data extraction from google to cloudflare. also, captcha in general shifts burden onto and penalizes legitimate users, especially privacy-conscious ones, in addition to malicious ones. that is, false positive rates are too high to achieve acceptable false negative rates. it would be better not to use a centralized captcha service,…

hcaptcha is so much harder than recaptcha. You actually have to spend a couple seconds per photo sometimes. Not ideal for users.

Re: ProtonMail includes Google Recaptcha for login

#124

Post by ipaddr »

rantwasp wrote: post #87
edoceo wrote: post #82

Another user-hostile. Folks laugh when I say I run my own email (FreeBSD/Postfix) and "why build your own mail client"? Because, inevitably, all these for profit service providers turn against me.

i would not laugh. think it’s impressive and must eat a lot of time

Setting up dovecot, postfix to receive emails is a fun few hours that have continued to work forever.

Sending mail to gmail requires setting up extra processes that most times won't work anyways. Sending mail from an unknown ip is like sending it from a blacklisted address. To avoid this I use my isp to send the mail.

Setup time including thunderbird settings is under an 2 hours for many.

Re: ProtonMail includes Google Recaptcha for login

#125

Post by duckfang »

spiderice wrote: post #121
protonmail wrote: post #116

Earlier quoted context omitted.

Sorry if our answer wasn't clear. You can de-activate, but it must be manually requested through support.

You’re replies are very frustrating. It’s like you’re completely missing the point of the replies and focusing on very tiny, irrelevant details. Nobody is claiming that you can’t remove deactivated accounts. Only that you charge for them until you go through the rather annoying process of contacting customer support. And then you make some bad excuse that it’s in the name of security because somebody could potentiall…

This line of discussion from Protonmail is making me greatly reconsider closing my accounts (plural) there for VPN and mail service.

This is embarrassing at minimum, and show negative interaction with customers.

Re: ProtonMail includes Google Recaptcha for login

#126

Post by escr0w »

totalZero wrote: post #102
owly wrote: post #96

Earlier quoted context omitted.

Thank you for explaining here, I really appreciate the work you’re doing and understand the non-trivial work it takes to protect users. While l’d love a Google free experience for PM, I also love having a near zero chance of a brute force attack. I’m a paid PM user and have been using it since the very early beta days. I never see the CAPTCHA on any OS, but I only connect from about 5 different IPs or while using Pro…

This isn't an explanation, insofar as it's identical to the bartbutler post in the submission itself.

I feel like they have pretty much cleared the issue up. Any coder would agree that a captcha service is actually very hard to build. Especially a good one. What they're doing isn't exactly 100% wrong, but it isn't 100% right either. Either way, they're implementing hCaptcha. I see no issue?

Re: ProtonMail includes Google Recaptcha for login

#127

Post by navanchauhan »

brundolf wrote: post #118
navanchauhan wrote: post #90

Earlier quoted context omitted.

Not really, it depends on each service provider. You can imagine each user as a folder in the /var/mail directory, it depends on your implementation to encrypt the folder or not. Gmail encrypts all in-transit e-mails but I cannot find a reference for encrypting on their servers

Their point is that ProtonMail specifically does encrypt emails on the server. That's their headlining feature. Only clients are supposed to be able to decrypt them.

Oh, my bad.

I thought when they were referring to the server, it was email servers in general.

Re: ProtonMail includes Google Recaptcha for login

#129

Post by kmaasrud »

dna_polymerase wrote: post #119
cowpig wrote: post #47

When I started my company we chose to use Protonmail. My advice to anyone who wants secure email: don't use protonmail. The email search is completely useless. I don't understand how it can possibly be so difficult to do a substring search on a corpus and rank them in some kind of sane way. Searching for old emails based on content is an exercise in futility. After a few years of using an email service, search become…

That's what you get for making stupid decisions based on ideology instead of facts. Protonmail says it very clearly that all mail is encrypted on their servers. If you expect search functionality from them you don't get encryption. You bought into some random surveillance state propaganda. Google isn't interested in the mail of your random startup, they are happy expanding their cloud footprint. In return you get goo…

Choosing something you ideologically do not support is not sane

Re: ProtonMail includes Google Recaptcha for login

#130

Post by alpaca128 »

bassdropvroom wrote: post #51
cowpig wrote: post #47

When I started my company we chose to use Protonmail. My advice to anyone who wants secure email: don't use protonmail. The email search is completely useless. I don't understand how it can possibly be so difficult to do a substring search on a corpus and rank them in some kind of sane way. Searching for old emails based on content is an exercise in futility. After a few years of using an email service, search become…

Note: due to the design of PM, the search is done client-side rather than server-side. It's not an excuse but at the very least, full-text search is harder.

Full-text search within the average amount of a single user's emails is trivial and fast on any modern PC. Smartphones do it for autocompletion suggestions every time you type a letter. The only thing taking longer than a few milliseconds is the initial indexing.
Post reply on HN