Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail includes Google Recaptcha for login

github.com

Post reply on HN
Print view View original

191–200 of 308 posts

Re: ProtonMail includes Google Recaptcha for login

#191

Post by cookiengineer »

mannerheim wrote: post #161
cookiengineer wrote: post #98

Earlier quoted context omitted.

> A visitor from TOR is extraordinarily more likely to be abusive. It makes total sense to put up extra barriers, which is still short of blocking TOR users altogether, which is also fair for webmasters who don't want to deal with it. And why is that again? I want to understand that argument. In case of DDoS scenario: Well, too late, traffic already served and server already done the workload. In case of password bru…

What about the case of someone signing up for thousands of accounts?

> What about the case of someone signing up for thousands of accounts?

My question is related to the specific /login page, not the registration page.

I understand the benefit for blocking spammer signups, but not for the current case of the login page where users have an account already, were verified that the account/password was correct (captcha appears in second step), and then have to enter a second decryption password manually.

In that scenario there's no argument on the "WHY" a captcha helps. It simply doesn't.

Re: ProtonMail includes Google Recaptcha for login

#193

Post by 10000truths »

eatbots wrote: post #160

As a fan of ProtonMail, will just add a few points: Every popular online service today is being continuously attacked. Bad actors get a lot of economic value from credential stuffing, account takeovers, and fake registrations, especially on email services. This is why CAPTCHAs exist. They are one of the better tools in the defender's arsenal to increase the cost of attacks. Building and maintaining a good CAPTCHA ser…

> Building and maintaining a good CAPTCHA service is both hard and requires a high level of continuous development, since every day people are waking up and trying to figure out how to break it. This means almost every company that tried building their own in the past has switched to either hCaptcha or Google, since it is not practical for even large companies to maintain their own solution these days.

I’m under the impression that the bottleneck isn’t “high level of continuous development” so much as it is just having a large enough data set of Internet activity to conduct statistical analyses on. Cloudflare and Google are obviously in a good position for this, since a significant amount of Internet traffic goes through them. But I can’t create a startup to invent the next Captcha unless I magically discover a flash drive containing a giant corpus of HTTP requests made by billions of modern devices around the planet.

Re: ProtonMail includes Google Recaptcha for login

#194

Post by ipaddr »

mannerheim wrote: post #161
cookiengineer wrote: post #98

Earlier quoted context omitted.

> A visitor from TOR is extraordinarily more likely to be abusive. It makes total sense to put up extra barriers, which is still short of blocking TOR users altogether, which is also fair for webmasters who don't want to deal with it. And why is that again? I want to understand that argument. In case of DDoS scenario: Well, too late, traffic already served and server already done the workload. In case of password bru…

What about the case of someone signing up for thousands of accounts?

Why would that be a problem on surface? You have thousands of users, why do they need to be unique identities?

The only reason I can think of is because they want more unique identities. More unique people means a greater chance for a purchase. More mail accounts just cost more.

The entire business model of free accounts requires someone paying for something extra. By unique identifying people they can limit new accounts and increase their chances of an upsale.

What if they changed how they operated. Instead of looking for more unique identities why not accept multiple addresses and include an ad at the end of every free email letting the receiver know this came from protonmail. That would give a benefit for each email sent and provide more advertising and give users a reason to upsell?

My guess is having that ad after every mail would bother you (the customer) more than having your identity uncovered.

Re: ProtonMail includes Google Recaptcha for login

#195

Post by AsianTits »

protonmail wrote: post #79

A few comments about this. A very small fraction of logins get the CAPTCHA challenge. We, and other services, face unrelenting brute force attacks on our login endpoints. If you are seeing a CAPTCHA on login, chances are that something about your connection is suspicious to our system. It's far from perfect, and we continue to improve it, but at most a percent or two of users are seeing CAPTCHA at any time. The CAPTC…

You can try https://www.hcaptcha.com as an alternative.

Re: ProtonMail includes Google Recaptcha for login

#196

Post by mannerheim »

ipaddr wrote: post #194
mannerheim wrote: post #161

Earlier quoted context omitted.

What about the case of someone signing up for thousands of accounts?

Why would that be a problem on surface? You have thousands of users, why do they need to be unique identities? The only reason I can think of is because they want more unique identities. More unique people means a greater chance for a purchase. More mail accounts just cost more. The entire business model of free accounts requires someone paying for something extra. By unique identifying people they can limit new acco…

I don't think they have a problem with a user creating two or three accounts. It's a problem if someone creates thousands of email accounts to send spam with.

Re: ProtonMail includes Google Recaptcha for login

#197

Post by protonmail »

IAmGraydon wrote: post #16

Try to register a new Protonmail email address normally and you can do so without supplying too much information. Try to do so through Tor, and you will not be able to proceed without “verifying” the account with a phone number. This pattern (they want either your IP or a phone number) tells me they’re likely interested in tying accounts to real identities and shouldn’t be trusted with anything private. I would even…

We don't like the term, but that link is actually fake news, and has been refuted before, for example here: https://serpentsec.1337.cx/i-was-asked-to-review-an-article-...

Re: ProtonMail includes Google Recaptcha for login

#198

Post by a1369209993 »

caymanjim wrote: post #168
mannerheim wrote: post #69

Earlier quoted context omitted.

Perhaps a way to solve it would be to accept a nominal fee of cryptocurrency. Even a one-time fee of e.g. $5 would probably put a damper in someone trying to sign up for thousands of accounts while preserving privacy for real users.

Alas this is a business-ending barrier. Despite its popularity, in the grand scheme of things, not many people have a crypto account. It's also only semi-anonymous, depending on how you fund it. It'd be nice if more businesses accepted crypto, but it isn't viable as a requirement or primary payment mechanism.

The suggestion is to require either a phone number or a cryptocurrency fee, at the user's discretion.

Re: ProtonMail includes Google Recaptcha for login

#199

Post by dang »

AsianTits wrote: post #195
protonmail wrote: post #79

A few comments about this. A very small fraction of logins get the CAPTCHA challenge. We, and other services, face unrelenting brute force attacks on our login endpoints. If you are seeing a CAPTCHA on login, chances are that something about your connection is suspicious to our system. It's far from perfect, and we continue to improve it, but at most a percent or two of users are seeing CAPTCHA at any time. The CAPTC…

You can try https://www.hcaptcha.com as an alternative.

You can't use that sort of username on HN—see https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme.... I've banned the account for now, but if you want to use it with a different name, you're welcome to email hn@ycombinator.com and we'll get you fixed up.

(btw, the GP mentions hcaptcha)

Re: ProtonMail includes Google Recaptcha for login

#200

Post by neurostimulant »

Someone mentioned about using proof of work as an alternative to capthca. Sounds interesting, but will this actually effective in real world? I assume even selenium can pass it without a problem because all it did was making the client busy for a little while, so will it actually effective at reducing brute force rate? Also, do botnet operators have capability to deploy selenium-based workload to their botnet army?
Post reply on HN