4 ms·

Last week ProtonMail integrated Google's Recaptcha to their Login Page. As a project that advocates Privacy and Security, and was an immediate response to the

Last week ProtonMail integrated Google's Recaptcha to their Login Page. As a project that advocates Privacy and Security, and was an immediate response to the Snowden Leaks, I find this kinda ironic that they now set the Google PREFs cookie for all of their users - while they still maintain the same marketing on their website. And well, I am looking for new options now, I guess.

KMnO4 5y ago
Have you contacted them? It doesn’t take a whole team of people to implement recaptcha. Could just be the mistake of one engineer who was tasked to “add a captcha to the login form”. I hope you don’t assume the worst without investigating further.
- jorvi 5y ago
  They could have also just opted for hCaptcha, which is both much more private and doesn't excessively punish people who reduce their fingerprint.
- VWWHFSfQ 5y ago
  If one single person is allowed to add a privacy compromising service to one of the most important pages on their website (the login page) then there are deep, fundamental flaws in the organization that brings into question the security of the entire platform.
- cookiengineer 5y ago
  Well, if something like this doesn't get caught down the production line, they might have bigger issues regarding security. But I agree with you, I think I should give them a chance to respond to this. Personally, I think this is a serious issue. I opened up a GitHub issue for their frontend (as they do not have any security disclosure contact possibility as it seems): https://github.com/ProtonMail/WebClient/issues/242 https://github.com/ProtonMail/WebClient/issues/242
- dmt0 5y ago
  They use UserVoice for voting on issues (not sure if anyone ever looks at it). Here's one for recaptcha, and it's one of the most voted on tickets: https://protonmail.uservoice.com/forums/284483-protonmail/suggestions/40059430-do-not-use-google-recaptcha https://protonmail.uservoice.com/forums/284483-protonmail/su...
neltnerb 5y ago
As much as I appreciate this comment, it is weird that it floated to the very top when the article is about location tracking built into Android by Google. Protonmail might have issues, but the threat of some leaked information through javascript and/or cookies (hello google fonts!) can be attributed to literally every site that uses recaptcha whereas the article is talking about a much, much worse practice of tracking physical location constantly and making it difficult or impossible to use your phone without giving that information to Google. I hope protonmail finds a better way, and agree that it's not in keeping with their stance on privacy, but it is distracting from what Google is actually doing with phones by talking about an entirely unrelated issue. No offense intended to the parent, the comment is interesting, it's just not about the article at all and yet is the top comment at the time I write this.
- dmurray 5y ago
  Agreed! Proton could do better, but conflating their privacy approach (or, say, Apple's or Mozilla's) with Google's is exactly what Google would want you to do. "See - everyone harvests your data, at least we tend to keep it in house". Don't let the perfect be the enemy of the good.
  - deleted 5y ago
    [deleted]
dang 5y ago
This comment was originally posted to a different thread: Google made it nearly impossible for users to keep their location private - https://news.ycombinator.com/item?id=27324755 https://news.ycombinator.com/item?id=27324755 Since it's more on-topic here, I've moved it hither.

KMnO4 5y ago

Have you contacted them? It doesn’t take a whole team of people to implement recaptcha. Could just be the mistake of one engineer who was tasked to “add a captcha to the login form”. I hope you don’t assume the worst without investigating further.

jorvi 5y ago
They could have also just opted for hCaptcha, which is both much more private and doesn't excessively punish people who reduce their fingerprint.
VWWHFSfQ 5y ago
If one single person is allowed to add a privacy compromising service to one of the most important pages on their website (the login page) then there are deep, fundamental flaws in the organization that brings into question the security of the entire platform.
cookiengineer 5y ago
Well, if something like this doesn't get caught down the production line, they might have bigger issues regarding security. But I agree with you, I think I should give them a chance to respond to this. Personally, I think this is a serious issue. I opened up a GitHub issue for their frontend (as they do not have any security disclosure contact possibility as it seems): https://github.com/ProtonMail/WebClient/issues/242 https://github.com/ProtonMail/WebClient/issues/242
dmt0 5y ago
They use UserVoice for voting on issues (not sure if anyone ever looks at it). Here's one for recaptcha, and it's one of the most voted on tickets: https://protonmail.uservoice.com/forums/284483-protonmail/suggestions/40059430-do-not-use-google-recaptcha https://protonmail.uservoice.com/forums/284483-protonmail/su...

neltnerb 5y ago

As much as I appreciate this comment, it is weird that it floated to the very top when the article is about location tracking built into Android by Google. Protonmail might have issues, but the threat of some leaked information through javascript and/or cookies (hello google fonts!) can be attributed to literally every site that uses recaptcha whereas the article is talking about a much, much worse practice of tracking physical location constantly and making it difficult or impossible to use your phone without giving that information to Google. I hope protonmail finds a better way, and agree that it's not in keeping with their stance on privacy, but it is distracting from what Google is actually doing with phones by talking about an entirely unrelated issue. No offense intended to the parent, the comment is interesting, it's just not about the article at all and yet is the top comment at the time I write this.

dmurray 5y ago
Agreed! Proton could do better, but conflating their privacy approach (or, say, Apple's or Mozilla's) with Google's is exactly what Google would want you to do. "See - everyone harvests your data, at least we tend to keep it in house". Don't let the perfect be the enemy of the good.
- deleted 5y ago
  [deleted]

dang 5y ago

This comment was originally posted to a different thread: Google made it nearly impossible for users to keep their location private - https://news.ycombinator.com/item?id=27324755 https://news.ycombinator.com/item?id=27324755 Since it's more on-topic here, I've moved it hither.