17 ms·

ProtonMail includes Google Recaptcha for login

287 points by Hard_Space 5y ago

cookiengineer 5y ago
Last week ProtonMail integrated Google's Recaptcha to their Login Page. As a project that advocates Privacy and Security, and was an immediate response to the Snowden Leaks, I find this kinda ironic that they now set the Google PREFs cookie for all of their users - while they still maintain the same marketing on their website. And well, I am looking for new options now, I guess.
- KMnO4 5y ago
  Have you contacted them? It doesn’t take a whole team of people to implement recaptcha. Could just be the mistake of one engineer who was tasked to “add a captcha to the login form”. I hope you don’t assume the worst without investigating further.
  - jorvi 5y ago
    They could have also just opted for hCaptcha, which is both much more private and doesn't excessively punish people who reduce their fingerprint.
  - VWWHFSfQ 5y ago
    If one single person is allowed to add a privacy compromising service to one of the most important pages on their website (the login page) then there are deep, fundamental flaws in the organization that brings into question the security of the entire platform.
  - cookiengineer 5y ago
    Well, if something like this doesn't get caught down the production line, they might have bigger issues regarding security. But I agree with you, I think I should give them a chance to respond to this. Personally, I think this is a serious issue. I opened up a GitHub issue for their frontend (as they do not have any security disclosure contact possibility as it seems): https://github.com/ProtonMail/WebClient/issues/242 https://github.com/ProtonMail/WebClient/issues/242
  - dmt0 5y ago
    They use UserVoice for voting on issues (not sure if anyone ever looks at it). Here's one for recaptcha, and it's one of the most voted on tickets: https://protonmail.uservoice.com/forums/284483-protonmail/suggestions/40059430-do-not-use-google-recaptcha https://protonmail.uservoice.com/forums/284483-protonmail/su...
- neltnerb 5y ago
  As much as I appreciate this comment, it is weird that it floated to the very top when the article is about location tracking built into Android by Google. Protonmail might have issues, but the threat of some leaked information through javascript and/or cookies (hello google fonts!) can be attributed to literally every site that uses recaptcha whereas the article is talking about a much, much worse practice of tracking physical location constantly and making it difficult or impossible to use your phone without giving that information to Google. I hope protonmail finds a better way, and agree that it's not in keeping with their stance on privacy, but it is distracting from what Google is actually doing with phones by talking about an entirely unrelated issue. No offense intended to the parent, the comment is interesting, it's just not about the article at all and yet is the top comment at the time I write this.
  - dmurray 5y ago
    Agreed! Proton could do better, but conflating their privacy approach (or, say, Apple's or Mozilla's) with Google's is exactly what Google would want you to do. "See - everyone harvests your data, at least we tend to keep it in house". Don't let the perfect be the enemy of the good.
    - deleted 5y ago
      [deleted]
- dang 5y ago
  This comment was originally posted to a different thread: Google made it nearly impossible for users to keep their location private - https://news.ycombinator.com/item?id=27324755 https://news.ycombinator.com/item?id=27324755 Since it's more on-topic here, I've moved it hither.
otachack 5y ago
That stinks. I'm on Fastmail but its hard point has to do with being based in Australia and the recent government efforts of forcing entities to comply with police inquiries. Fastmail's side of the story: https://fastmail.blog/legal-policy/aabill-and-fastmail/ https://fastmail.blog/legal-policy/aabill-and-fastmail/
- Tarq0n 5y ago
  Being subject to state surveillance and surveillance capitalism are related but different concerns.
- ocdtrekkie 5y ago
  Fastmail rightly points out that the Australian law has no meaningful impact on them. They do not offer an end-to-end encrypted service, and hence, don't need to backdoor it. The vast majority of mail services will hand your data to the government on court order. Though if your mail is hosted in a different country than you live in, it's arguably more frustrating for them to do so, since they must use international agreements to get it. If state ordered surveillance is in your threat model, you need a very different type of mail service than almost everyone else.
  - pbhjpbhj 5y ago
    >it's arguably more frustrating for them to do so, since they must use international agreements to get it. // Caution, abject speculation: I thought spooks like this kind of thing because they can do illegal things in other jurisdictions that they're restrained from doing in their own - or get foreign agents to spy on you to avoid getting a warrant. Like they can route traffic to another country, then have affects there hack you to avoid laws that curtail actions against your own citizens. I don't know, just seemed like one point of groups like Five-eyes.
    - laurent92 5y ago
      But in any case, they are not buddies, not even colleagues in the same office floor. They at least need to find contacts in the remote country and persuade them to spend time for their task. Sometimes that’s all it takes to prevent them from passively collecting signals, unless you are an important target.
somedude895 5y ago
Wow I did not know that. What a blunder. I guess I'll have to reconsider my subscription as well then.
aboringusername 5y ago
Although it seems to go against the spirit of Protonmail and its ethos I'm not exactly sure there are many good options, hcaptcha is the lesser of two evils and a fundamental requirement on the modern web. Even HN requires a recaptcha if you fail too many times (and it's also based on IP). If you want to blame anyone blame: 1: The bad actors spamming logins 2: Google for essentially monopolizing captcha hcaptcha proves there's a market/demand for alternatives, this is HN, if you dislike it, go build a better alternative than Google's and I am sure PM will be only too pleased to switch. Complaining is easy, actually changing something is more difficult. (P.S I challenge anyone to deploy a system used by tens of thousands and not have any abuse/rate limiting systems, you'll soon be turning to captcha's at some point)
- nxpnsv 5y ago
  Seems there on the case already... https://twitter.com/ProtonMail/status/1398657423913668614 https://twitter.com/ProtonMail/status/1398657423913668614
- MattGaiser 5y ago
  I built a system that had all of a 100 or so users before some abuser came along. Limiting web abuse is a huge problem that requires solutions.
  - disqard 5y ago
    Would you be able to share what your solution looked like? Thanks in advance!
    - MattGaiser 5y ago
      We just installed reCAPTCHA and blocked Tor IPs. Nothing that special.
- nemothekid 5y ago
  I wouldn't say Google is monopolizing captcha, its that captcha is hard and you essentially need to come up some expensive problem that is hard for computers but easy for humans. Personally, I hate hCaptcha more than recaptcha, Craigslist uses it for their contact forms and I hate. hCaptcha is much more difficult and tedious than recaptcha.
keb_ 5y ago
I can recommend Migadu. Worth it if you already pay for a domain (which you should, imo, to have a portable e-mail address). I pay for the $19 annual plan and find it sufficient, and I love the flexibility of the admin panel.
- lazyload 5y ago
  +1 for Migadu! I'd been a paying customer for Protonmail for a few years now but stuff like this had slowly been pushing me away. A few months ago I set up Migadu with my own domain and it's worked without issue ever since. Another plus is that I can finally use my own email clients without having to deal with proton bridge
- ______- 5y ago
  Live link for anyone interested in this: https://www.migadu.com/ https://www.migadu.com/
- lioeters 5y ago
  Yes, I second your recommendation of Migadu. I've helped set up dozens of email accounts for clients there, and we've been happy with their service.
- owly 5y ago
  While visiting Migadu’s site, seems like a good option for some but new users should definitely read their drawbacks list before committing to it. No 2FA and no encryption. Therefore not a replacement for something like ProtonMail or TutaNota. https://www.migadu.com/procon/ https://www.migadu.com/procon/
- nichos 5y ago
  I considered Migadu, but saw their stance on freespeech and decided not to go with them: https://www.migadu.com/use/#anti-violence-commitment https://www.migadu.com/use/#anti-violence-commitment "Hate speech" is too vague and highly subjective and just leads to censorship.
  - hda2 5y ago
boardwaalk 5y ago
I just tried logging into Protonmail in my regular browser and with a private mode window and didn't get a captcha in either case. Not saying it may not appear for others but I didn't see it.
- pbhjpbhj 5y ago
  Perhaps they do client fingerprinting across browsers so they didn't need to verify you ...
- dathinab 5y ago
  Modern google captcha (v3??) doesn't show a captcha if they already have enough data about you. E.g. through 3rd party cookies, or by fingerprinting anything from your browser to your mouse movement and typing pattern. (Not sure what exactly they currently use, so this are just examples of what they might use).
  - sleavey 5y ago
    Ok now I'm kinda relieved that I still see reCAPTCHA so much... Locked down Firefox user here.
- thayne 5y ago
  Google's recaptcha does have an invisible mode, where it doesn't show you a captcha unless it thinks you are a bot. Which it determines by tracking your online activity...
alexanderdmitri 5y ago
I was scratching my head this week when they were releasing the time the 'Hamas' bomb threat email came in with regard to Belarus high-jacking that flight. It seemed rather fine-grained knowledge of specific communications that doesn't serve the narrative of privacy first. The articles I read made it sound like ProtonMail had just decided to share details on it rather than a more formal, court-ordered process. I know in this situation there aren't too many people who would raise questions, but it did strike me as strange given how they market their service.
- Jiocus 5y ago
  I understand what you mean, but it's important to understand the technological side here. Protonmail offers an email service, and despite all privacy marketing, very little of that applies to emails which enters or leave their own systems. This is a requirement if their users are to communicate with a non-Protonmail address. Any message that interface with the standard email network is better off regarded as public communication. I can only imagine the legal implications that would compel Protonmail to assist law enforcement after their Service was misused and complicit in an alleged bomb threat. Their Terms of Service surely outline that illegal activity will void their protection as far as possible. Keeping communications inside their in-house, zero-knowledge email service on the other hand, would make it very hard for Protonmail to produce any of this information. That is their actual privacy offer, as far as I understand. To Protonmails defense, I haven't heard that this email has successfully been linked to any real identity past the phony Sulanov alias.
prepend 5y ago
Also seems particularly odd to even have recaptcha on the email login page. Who cares if robots check email so it doesn’t seem user friendly to prove humanity to read email or get a login error.
- Xylakant 5y ago
  Not at all. You want to prevent robots from logging in as other users, for example when trying credentials stuffing.
  - chrismorgan 5y ago
    That’s what per-IP and per-user rate limiting is for—by themselves, those two are close to sufficient. Any form of CAPTCHA would be a terrible sole defence (such things don’t block bots, they just make it a bit more expensive and help a bit with drive-by attacks), and adds very little for defence-in-depth, while introducing new problems where you inconvenience and block access to your real customers. I find the inclusion of reCAPTCHA on a login page of a supposedly security-conscious entity very surprising. (Sign up is a different matter; there it will have very meaningful benefits and lower costs.)
    - Xylakant 5y ago
      Per user does not help when doing credential stuffing - the attacker tries known credentials from a leak, it’s not random cracking. Per IP blocks can be circumvented by using a botnet and slowing your attack.
      - wearywanderer 5y ago
        What we have here is users who don't re-use passwords being inconvenienced to protect those who do. Doubtlessly this is very progressive, as those who reuse passwords have less "has a fucking clue"-privilege. But nonetheless this does not sit right with me.
      - chrismorgan 5y ago
IAmGraydon 5y ago
Try to register a new Protonmail email address normally and you can do so without supplying too much information. Try to do so through Tor, and you will not be able to proceed without “verifying” the account with a phone number. This pattern (they want either your IP or a phone number) tells me they’re likely interested in tying accounts to real identities and shouldn’t be trusted with anything private. I would even go so far as to suspect Protonmail of being a honeypot. Oh…I’ll just leave this here: https://privacy-watchdog.io/truth-about-protonmail/ https://privacy-watchdog.io/truth-about-protonmail/
- deleted 5y ago
  [deleted]
- secfirstmd 5y ago
  Yep noticed this a long time ago and am very suspicious
  - jimmaswell 5y ago
    A visitor from TOR is extraordinarily more likely to be abusive. It makes total sense to put up extra barriers, which is still short of blocking TOR users altogether, which is also fair for webmasters who don't want to deal with it.
    - vmception 5y ago
      I’ve always found it weird how people jump hoops to be apologists for Protonmail Does anybody else find that weird? “I completely misunderstood Swiss privacy laws and fell for a sales pitch from an email and VPN company that goes out of its way to track every user no matter how they sign up! Its to avoid email abuse, exclusively!”
      - jimmaswell 5y ago
        I've never even heard of Protonmail. I just think it's silly to fault anyone for blocking/limiting TOR connections.
______- 5y ago
> I find this very absurd to see. This is absurd indeed. hCaptcha[0] is a better alternative though, and I wouldn't mind if they used that instead of reCaptcha. I never liked the carpal tunnel that reCaptcha introduces. [0] https://www.hcaptcha.com/ https://www.hcaptcha.com/
- OminousWeapons 5y ago
  If you're script blocking, hcaptcha also only requires one reload of the page as opposed to two for Google (enabling Google then enabling Gstatic)
- axegon_ 5y ago
  Even as recent as 5 years ago I liked the idea of a captchas. I still understand the purpose behind them but recently I've started getting really annoyed by them(whether that be reCaptcha or hcaptcha or anything else). They are just everywhere and it gets incredibly tedious to have to solve one every odd click or so. And it gets even worse if you use a vpn or tunnel or god forbid tor: there's no way to solve them there AT ALL. Which is the sad part: despite the tons of innovation in ML, captchas seem to rely on recursion of hardcoded rules which pile up indefinitely the moment you step outside your "start your computer and open up a browser" behavior. Kind of sad considering the abundance of information browsers pass on with each request.
  - abawany 5y ago
    In some cases, it seems the companies deploy them to coerce and punish: 'logged out, did you? you deserve this captcha for trying to thwart our tracking, peasant! work this useless problem for us for free!' Looking at you, Meetup.
    - lallysingh 5y ago
      IIUC, they do help limit some classes of DDOS attacks.
  - ______- 5y ago
    > Recently I've started getting really annoyed by them In the end, the services that are using captchas are the services that become the least liked, and users will start migrating to other services that don't use captchas, so there's a business penalty for using them. On the other hand, if you want to filter out bad actors, then captchas are the way to go. The reason I recommended hCaptcha is because they're easier to solve, and sometimes Google's reCaptcha offering is so complex and hard-to-solve that it starts inducing carpal tunnel / RSI symptoms (at least for me). I don't get so easily fatigued & inflamed with hCaptcha though.
______- 5y ago
hCaptcha[0] is a better alternative though, and I wouldn't mind if Protonmail used that instead of reCaptcha. I never liked the carpal tunnel that reCaptcha introduces. [0] https://www.hcaptcha.com/ https://www.hcaptcha.com/
______- 5y ago
I can understand requiring a captcha for registering, but not for logging in. Also: does anyone know if they have to do this even if you have a Protonmail cookie set in your session?
- cloudboogie 5y ago
  I wonder if it's a response to the recent incident with Ryanair plane got grounded by Belarus. I believe an anonymous email with a bomb threat was sent with ProtonMail.
jorgBaller 5y ago
germans...
arkadiyt 5y ago
Their response on twitter [1]: "The recaptcha, when it shows up (in rare situations), is sandboxed so that it doesn't send any data to Google. We are also in the process of replacing it with hcaptcha." Not sure what possible sandboxing they could be referring to - if they load the captcha in an iframe from a different origin then it is true that Google's javascript can't access things on the Protonmail origin, but the concern seems to be that your data is sent to Google (which is still happening even with sandboxing, their tweet cannot be correct), not that Google's recaptcha javascript would have done something malicious on the Protonmail origin (which seems unlikely). In any case, at least they're moving to hcaptcha. [1]: https://twitter.com/ProtonMail/status/1398657423913668614 https://twitter.com/ProtonMail/status/1398657423913668614
- clairity 5y ago
  hcaptcha is not much better than recaptcha, in that its only ‘improvement’ is shifting data extraction from google to cloudflare. also, captcha in general shifts burden onto and penalizes legitimate users, especially privacy-conscious ones, in addition to malicious ones. that is, false positive rates are too high to achieve acceptable false negative rates. it would be better not to use a centralized captcha service, if one must be used at all.
  - ysavir 5y ago
    Do you have any suggestions for alternatives?
    - clairity 5y ago
      write your own? many personal tech blogs do this for comment forms and the like. any kind of ambiguity that’s natural for a human to parse accurately but not obvious for a machine is fair game. most bots won’t one-off a solution for smaller sites, so it doesn’t need to be too fancy. for larger ones where one-off customizations might be more likely, lots of engineering resources go toward security and fraud prevention already, so they can afford more sophistication. but more importantly, in the long term, it needs policy and legal progress. it needs to be costly and international (via treaties/sanctions).
cowpig 5y ago
When I started my company we chose to use Protonmail. My advice to anyone who wants secure email: don't use protonmail. The email search is completely useless. I don't understand how it can possibly be so difficult to do a substring search on a corpus and rank them in some kind of sane way. Searching for old emails based on content is an exercise in futility. After a few years of using an email service, search becomes really important. It is exceedingly difficult to pull data out. You need dev ops skills to do it. They charge for users that are disabled, and you can only stop paying for them if all of the associated data is deleted. So they effectively hold your data hostage (yes, you can get it out but it time-consuming and requires technical skills). I finally bit the bullet and paid a dev ops person (and gave him access to all my data) and switched to fastmail (at least it's not google) a few months ago. It's been an incredible relief.
- protonmail 5y ago
  A few clarifications. There is an export tool that is available. The reason we must count disabled addresses towards your quota is because if we did not do that, we would be susceptible to an attack where a paid user could run through our address space by creating and disabling addresses continuously, so some limits are required. You can remove disabled addresses, but only by contacting support.
  - notafraudster 5y ago
    This is a sort of weird reply. The person you're replying to isn't saying "you need to allow an attacker to create and disable millions of addresses to DOS you". They're saying "you need to allow medium to longer term clients that de-activate very small portions of their overall number of accounts to not have to pay for those". You already have a system to measure account numbers, so what makes it impossible to also measure active account %ages
    - protonmail 5y ago
      Sorry if our answer wasn't clear. You can de-activate, but it must be manually requested through support.
protonmail 5y ago
This headline is unfortunately misleading. Recaptcha is not used on every login (this is verifiable). It only appears in rare situations when it is required to prevent abuse.
- Hard_Space 5y ago
  I have two PM accounts. Since implementation, every single login includes Captcha. I log in twice a day, Captcha is never omitted.
  - jjcon 5y ago
    I’m also seeing it every time
    - octopoc 5y ago
      Are you using Tor or a VPN? That could be why. Not that that makes it any less annoying.
      - Hard_Space 5y ago
        Neither. Firefox on non-VPN broadband.
  - protonmail 5y ago
    If you are using Tor or VPN, this might be the case. Another possibility is that you (or somebody on your network, or ISP in the case of NAT/shared mobile IP), have installed an app that is using an SDK like Luminati [1] or similar, which is causing the IP to be abused in the brute force attempts our anti-abuse systems are trying to prevent. [1] https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/shining-a-light-on-the-risks-of-holavpn-and-luminati https://www.trendmicro.com/vinfo/hk-en/security/news/cybercr...
    - Hard_Space 5y ago
      Never used HolaVPN (apparently a prerequisite for Luminati). Never heard of it. Only turn my VPN on once in a blue moon for a few minutes.
protonmail 5y ago
A few comments about this. A very small fraction of logins get the CAPTCHA challenge. We, and other services, face unrelenting brute force attacks on our login endpoints. If you are seeing a CAPTCHA on login, chances are that something about your connection is suspicious to our system. It's far from perfect, and we continue to improve it, but at most a percent or two of users are seeing CAPTCHA at any time. The CAPTCHA is run in an iframe on a separate domain to sandbox it from the Proton login flow prevent it from compromising the webapp. Obviously Google still gets some information, but we do all we can to limit this. CAPTCHAs are very hard to build, especially considering Google has a habit of clearing the field with it's own captcha-breaking code. Most companies do not have the resources to build their own. We had an alternative CAPTCHA we were going to use as a replacement a few years ago and then the company behind it went bankrupt. We are currently looking to replace ReCAPTCHA with hcaptcha, which should alleviate some of these problems. We have other strategies which we are also exploring to try to reduce the need for CAPTCHAs entirely, but these are also not trivial to build and integrate into all clients. TL;DR It's a small fraction of users who are affected, it's necessary to protect our users from brute force login attacks, we don't like it either and are working hard on replacements.
- owly 5y ago
  Thank you for explaining here, I really appreciate the work you’re doing and understand the non-trivial work it takes to protect users. While l’d love a Google free experience for PM, I also love having a near zero chance of a brute force attack. I’m a paid PM user and have been using it since the very early beta days. I never see the CAPTCHA on any OS, but I only connect from about 5 different IPs or while using ProtonVPN. Off topic: please implement font size adjustment capability on iOS!
  - totalZero 5y ago
    This isn't an explanation, insofar as it's identical to the bartbutler post in the submission itself.
    - escr0w 5y ago
edoceo 5y ago
Another user-hostile. Folks laugh when I say I run my own email (FreeBSD/Postfix) and "why build your own mail client"? Because, inevitably, all these for profit service providers turn against me.
- rantwasp 5y ago
  i would not laugh. think it’s impressive and must eat a lot of time
  - ipaddr 5y ago
    Setting up dovecot, postfix to receive emails is a fun few hours that have continued to work forever. Sending mail to gmail requires setting up extra processes that most times won't work anyways. Sending mail from an unknown ip is like sending it from a blacklisted address. To avoid this I use my isp to send the mail. Setup time including thunderbird settings is under an 2 hours for many.
  - edoceo 5y ago
    Not really. Once Postfix, Dovecot, DNS stuff, DKIM, it "just works". I did lose some time, three years ago fiddling with spamassaaain vs rspamd but mail, after the not-really-that-hard-at-all setup. I mean, folk handle way more complex stuff (k8s) but balk at a bit of time on this old, boring, stable set-it-and-forget-it self-hosted wonder.
  - jjav 5y ago
    > i would not laugh. think it’s impressive and must eat a lot of time It does not. I set up my latest/current email hosting in about 2011. Very minimal work on it since then. There's really nothing to do once it's working. Only work I can think of I've spent on it since 2011 is: regular OS updates (which take basically no time), added SPF and later DKIM support, added Let's Encrypt cert. That's it in ten years.
- inamiyar 5y ago
  The problem with running my own email is I don't want the hassle of convincing Google I'm not spam.
francoisz 5y ago
posteo.de
pphysch 5y ago
An email/SaaS provider that explicitly markets themselves as "private", complaining that "CAPTCHAs are very hard to build", and will therefore sacrifice user privacy is too rich. What in tarnation are we paying you for?
msh 5y ago
I don't know if the hn protonmail account is an official account or a fan account, but it seems quite unprofessional and really scares me off being a protonmail customer.
- protonmail 5y ago
  We apologize for that. It's a weekend and we are working on giving folks responses as quickly as possible. Therefore, the responses are more to the point than usual.
  - Mike86534 5y ago
    Don't worry. It's just a minority of princesses complaining. This "news" was a waste of time. Non issue.
grammers 5y ago
Tutanota uses an open source captcha. I guess their goal is to get rid of Google completely: https://tutanota.com/blog/posts/open-source-email/ https://tutanota.com/blog/posts/open-source-email/
rgj 5y ago
ProtonMail apparently also releases details about their customers email sending timestamps to the press. Very strange and not a good sign IMHO. https://www.reuters.com/world/europe/email-bomb-threat-sent-after-bloggers-plane-was-diverted-over-belarus-swiss-2021-05-27/ https://www.reuters.com/world/europe/email-bomb-threat-sent-...
bromquinn 5y ago
Weird. I’ve been using ProtonMail for years as my primary email, and I don’t think I’ve ever seen a captcha. This includes when I visit ProtonMail over VPN’s or in a private window
throwawayboise 5y ago
I'm on a few email lists, and nearly without exception the people with protonmail accounts are entitled, inconsiderate, abusive, or out-and-out trolls. It was so consistent I went so far as to killfile any posts from protonmail accounts.
eatbots 5y ago
As a fan of ProtonMail, will just add a few points: Every popular online service today is being continuously attacked. Bad actors get a lot of economic value from credential stuffing, account takeovers, and fake registrations, especially on email services. This is why CAPTCHAs exist. They are one of the better tools in the defender's arsenal to increase the cost of attacks. Building and maintaining a good CAPTCHA service is both hard and requires a high level of continuous development, since every day people are waking up and trying to figure out how to break it. This means almost every company that tried building their own in the past has switched to either hCaptcha or Google, since it is not practical for even large companies to maintain their own solution these days. Why was ProtonMail originally using Google? Probably because for many years it was the only plausible option until hCaptcha came around, and they needed to protect their users. We're working with them now to switch over to the enterprise version of hCaptcha, which: 1) includes privacy-preserving features that let them decide exactly what user data hCaptcha sees and when, and 2) guarantees what happens to any data received via a data processing agreement, and 3) isn't run by an ad network. hCaptcha doesn't care who you are and ensures all data is ephemeral, since unlike Google we're not trying to sell ads targeting you. (disclosure: work there)
- 10000truths 5y ago
  > Building and maintaining a good CAPTCHA service is both hard and requires a high level of continuous development, since every day people are waking up and trying to figure out how to break it. This means almost every company that tried building their own in the past has switched to either hCaptcha or Google, since it is not practical for even large companies to maintain their own solution these days. I’m under the impression that the bottleneck isn’t “high level of continuous development” so much as it is just having a large enough data set of Internet activity to conduct statistical analyses on. Cloudflare and Google are obviously in a good position for this, since a significant amount of Internet traffic goes through them. But I can’t create a startup to invent the next Captcha unless I magically discover a flash drive containing a giant corpus of HTTP requests made by billions of modern devices around the planet.
pkw792 5y ago
Why all the senseless bickering? If you don't like ProtonMail, don't use it! Choose whatever else, and go bicker or rave about that instead.
neurostimulant 5y ago
Someone mentioned about using proof of work as an alternative to capthca. Sounds interesting, but will this actually effective in real world? I assume even selenium can pass it without a problem because all it did was making the client busy for a little while, so will it actually effective at reducing brute force rate? Also, do botnet operators have capability to deploy selenium-based workload to their botnet army?
- efficax 5y ago
  proof of work originated to stop spam. But it’s a question of cost. If it costs less to bypass bot detection than the money made by the bot activity, then they’ll do it, whether captcha farms or doing proof of work calculations.
some_account_ 5y ago
A few weeks ago I noticed that Reddit also started using Google Recaptcha for account creation. Even though I only saw it on creation, and not on login, the possibility of associating a strong identifying fingerprint with a presumably anonymous throwaway user account was concerning.
Aeolun 5y ago
What I don’t understand is how any privacy focused service would ever choose Google as their captcha of choice. It’s just flies so flabbergastingly in the face of the entire point of the thing that I might as well stop using them.
- protonmail 5y ago
  It only appears for a tiny fraction of users. When recaptcha was first added in 2014, it was the only captcha service that wasn't broken. Today there is also hcaptcha, which we are working on implementing and will switch to that shortly.
deleted 5y ago
[deleted]
CynicusRex 5y ago
Ever since the following ProtonMail tweet about bitcoin, I migrated to Vivaldi Browser's email service. At least Vivaldi's team recognizes that crypto“currencies” are nothing but pyramid Ponzi schemes. https://twitter.com/ProtonMail/status/1395719559215210496 https://twitter.com/ProtonMail/status/1395719559215210496
c01n 5y ago
The reason I use Protonmail is to stay far as possible from Google (gmail), this is highly disappointing.
permo-w 5y ago
> [from a commenter on the OP, in reply to the Protonmail response] If an Incognito Mode Web Browser with a graphical user that actively moves his mouse, types in the password in non-automated manner, key by key - not copy/pasted and not auto-inserted within a millisecond - seems suspicious by your system - then I have to say your ways of identifying or classifying suspicious behaviour is very flawed. There are way better, already solved ways, to do this. If you know this, then I guarantee that the people making spam bots know this too. this is a very naïve argument

287 points by Hard_Space 5y ago

Last week ProtonMail integrated Google's Recaptcha to their Login Page. As a project that advocates Privacy and Security, and was an immediate response to the Snowden Leaks, I find this kinda ironic that they now set the Google PREFs cookie for all of their users - while they still maintain the same marketing on their website. And well, I am looking for new options now, I guess.

KMnO4 5y ago
Have you contacted them? It doesn’t take a whole team of people to implement recaptcha. Could just be the mistake of one engineer who was tasked to “add a captcha to the login form”. I hope you don’t assume the worst without investigating further.
- jorvi 5y ago
  They could have also just opted for hCaptcha, which is both much more private and doesn't excessively punish people who reduce their fingerprint.
- VWWHFSfQ 5y ago
  If one single person is allowed to add a privacy compromising service to one of the most important pages on their website (the login page) then there are deep, fundamental flaws in the organization that brings into question the security of the entire platform.
- cookiengineer 5y ago
  Well, if something like this doesn't get caught down the production line, they might have bigger issues regarding security. But I agree with you, I think I should give them a chance to respond to this. Personally, I think this is a serious issue. I opened up a GitHub issue for their frontend (as they do not have any security disclosure contact possibility as it seems): https://github.com/ProtonMail/WebClient/issues/242 https://github.com/ProtonMail/WebClient/issues/242
- dmt0 5y ago
  They use UserVoice for voting on issues (not sure if anyone ever looks at it). Here's one for recaptcha, and it's one of the most voted on tickets: https://protonmail.uservoice.com/forums/284483-protonmail/suggestions/40059430-do-not-use-google-recaptcha https://protonmail.uservoice.com/forums/284483-protonmail/su...
neltnerb 5y ago
As much as I appreciate this comment, it is weird that it floated to the very top when the article is about location tracking built into Android by Google. Protonmail might have issues, but the threat of some leaked information through javascript and/or cookies (hello google fonts!) can be attributed to literally every site that uses recaptcha whereas the article is talking about a much, much worse practice of tracking physical location constantly and making it difficult or impossible to use your phone without giving that information to Google. I hope protonmail finds a better way, and agree that it's not in keeping with their stance on privacy, but it is distracting from what Google is actually doing with phones by talking about an entirely unrelated issue. No offense intended to the parent, the comment is interesting, it's just not about the article at all and yet is the top comment at the time I write this.
- dmurray 5y ago
  Agreed! Proton could do better, but conflating their privacy approach (or, say, Apple's or Mozilla's) with Google's is exactly what Google would want you to do. "See - everyone harvests your data, at least we tend to keep it in house". Don't let the perfect be the enemy of the good.
  - deleted 5y ago
    [deleted]
dang 5y ago
This comment was originally posted to a different thread: Google made it nearly impossible for users to keep their location private - https://news.ycombinator.com/item?id=27324755 https://news.ycombinator.com/item?id=27324755 Since it's more on-topic here, I've moved it hither.

otachack 5y ago

That stinks. I'm on Fastmail but its hard point has to do with being based in Australia and the recent government efforts of forcing entities to comply with police inquiries. Fastmail's side of the story: https://fastmail.blog/legal-policy/aabill-and-fastmail/ https://fastmail.blog/legal-policy/aabill-and-fastmail/

Tarq0n 5y ago
Being subject to state surveillance and surveillance capitalism are related but different concerns.
ocdtrekkie 5y ago
Fastmail rightly points out that the Australian law has no meaningful impact on them. They do not offer an end-to-end encrypted service, and hence, don't need to backdoor it. The vast majority of mail services will hand your data to the government on court order. Though if your mail is hosted in a different country than you live in, it's arguably more frustrating for them to do so, since they must use international agreements to get it. If state ordered surveillance is in your threat model, you need a very different type of mail service than almost everyone else.
- pbhjpbhj 5y ago
  >it's arguably more frustrating for them to do so, since they must use international agreements to get it. // Caution, abject speculation: I thought spooks like this kind of thing because they can do illegal things in other jurisdictions that they're restrained from doing in their own - or get foreign agents to spy on you to avoid getting a warrant. Like they can route traffic to another country, then have affects there hack you to avoid laws that curtail actions against your own citizens. I don't know, just seemed like one point of groups like Five-eyes.
  - laurent92 5y ago
    But in any case, they are not buddies, not even colleagues in the same office floor. They at least need to find contacts in the remote country and persuade them to spend time for their task. Sometimes that’s all it takes to prevent them from passively collecting signals, unless you are an important target.

somedude895 5y ago

Wow I did not know that. What a blunder. I guess I'll have to reconsider my subscription as well then.

aboringusername 5y ago

Although it seems to go against the spirit of Protonmail and its ethos I'm not exactly sure there are many good options, hcaptcha is the lesser of two evils and a fundamental requirement on the modern web. Even HN requires a recaptcha if you fail too many times (and it's also based on IP). If you want to blame anyone blame: 1: The bad actors spamming logins 2: Google for essentially monopolizing captcha hcaptcha proves there's a market/demand for alternatives, this is HN, if you dislike it, go build a better alternative than Google's and I am sure PM will be only too pleased to switch. Complaining is easy, actually changing something is more difficult. (P.S I challenge anyone to deploy a system used by tens of thousands and not have any abuse/rate limiting systems, you'll soon be turning to captcha's at some point)

nxpnsv 5y ago
Seems there on the case already... https://twitter.com/ProtonMail/status/1398657423913668614 https://twitter.com/ProtonMail/status/1398657423913668614
MattGaiser 5y ago
I built a system that had all of a 100 or so users before some abuser came along. Limiting web abuse is a huge problem that requires solutions.
- disqard 5y ago
  Would you be able to share what your solution looked like? Thanks in advance!
  - MattGaiser 5y ago
    We just installed reCAPTCHA and blocked Tor IPs. Nothing that special.
nemothekid 5y ago
I wouldn't say Google is monopolizing captcha, its that captcha is hard and you essentially need to come up some expensive problem that is hard for computers but easy for humans. Personally, I hate hCaptcha more than recaptcha, Craigslist uses it for their contact forms and I hate. hCaptcha is much more difficult and tedious than recaptcha.

keb_ 5y ago

I can recommend Migadu. Worth it if you already pay for a domain (which you should, imo, to have a portable e-mail address). I pay for the $19 annual plan and find it sufficient, and I love the flexibility of the admin panel.

lazyload 5y ago
+1 for Migadu! I'd been a paying customer for Protonmail for a few years now but stuff like this had slowly been pushing me away. A few months ago I set up Migadu with my own domain and it's worked without issue ever since. Another plus is that I can finally use my own email clients without having to deal with proton bridge
______- 5y ago
Live link for anyone interested in this: https://www.migadu.com/ https://www.migadu.com/
lioeters 5y ago
Yes, I second your recommendation of Migadu. I've helped set up dozens of email accounts for clients there, and we've been happy with their service.
owly 5y ago
While visiting Migadu’s site, seems like a good option for some but new users should definitely read their drawbacks list before committing to it. No 2FA and no encryption. Therefore not a replacement for something like ProtonMail or TutaNota. https://www.migadu.com/procon/ https://www.migadu.com/procon/
nichos 5y ago
I considered Migadu, but saw their stance on freespeech and decided not to go with them: https://www.migadu.com/use/#anti-violence-commitment https://www.migadu.com/use/#anti-violence-commitment "Hate speech" is too vague and highly subjective and just leads to censorship.
- hda2 5y ago

boardwaalk 5y ago

I just tried logging into Protonmail in my regular browser and with a private mode window and didn't get a captcha in either case. Not saying it may not appear for others but I didn't see it.

pbhjpbhj 5y ago
Perhaps they do client fingerprinting across browsers so they didn't need to verify you ...
dathinab 5y ago
Modern google captcha (v3??) doesn't show a captcha if they already have enough data about you. E.g. through 3rd party cookies, or by fingerprinting anything from your browser to your mouse movement and typing pattern. (Not sure what exactly they currently use, so this are just examples of what they might use).
- sleavey 5y ago
  Ok now I'm kinda relieved that I still see reCAPTCHA so much... Locked down Firefox user here.
thayne 5y ago
Google's recaptcha does have an invisible mode, where it doesn't show you a captcha unless it thinks you are a bot. Which it determines by tracking your online activity...

alexanderdmitri 5y ago

I was scratching my head this week when they were releasing the time the 'Hamas' bomb threat email came in with regard to Belarus high-jacking that flight. It seemed rather fine-grained knowledge of specific communications that doesn't serve the narrative of privacy first. The articles I read made it sound like ProtonMail had just decided to share details on it rather than a more formal, court-ordered process. I know in this situation there aren't too many people who would raise questions, but it did strike me as strange given how they market their service.

Jiocus 5y ago
I understand what you mean, but it's important to understand the technological side here. Protonmail offers an email service, and despite all privacy marketing, very little of that applies to emails which enters or leave their own systems. This is a requirement if their users are to communicate with a non-Protonmail address. Any message that interface with the standard email network is better off regarded as public communication. I can only imagine the legal implications that would compel Protonmail to assist law enforcement after their Service was misused and complicit in an alleged bomb threat. Their Terms of Service surely outline that illegal activity will void their protection as far as possible. Keeping communications inside their in-house, zero-knowledge email service on the other hand, would make it very hard for Protonmail to produce any of this information. That is their actual privacy offer, as far as I understand. To Protonmails defense, I haven't heard that this email has successfully been linked to any real identity past the phony Sulanov alias.

prepend 5y ago

Also seems particularly odd to even have recaptcha on the email login page. Who cares if robots check email so it doesn’t seem user friendly to prove humanity to read email or get a login error.

Xylakant 5y ago
Not at all. You want to prevent robots from logging in as other users, for example when trying credentials stuffing.
- chrismorgan 5y ago
  That’s what per-IP and per-user rate limiting is for—by themselves, those two are close to sufficient. Any form of CAPTCHA would be a terrible sole defence (such things don’t block bots, they just make it a bit more expensive and help a bit with drive-by attacks), and adds very little for defence-in-depth, while introducing new problems where you inconvenience and block access to your real customers. I find the inclusion of reCAPTCHA on a login page of a supposedly security-conscious entity very surprising. (Sign up is a different matter; there it will have very meaningful benefits and lower costs.)
  - Xylakant 5y ago
    Per user does not help when doing credential stuffing - the attacker tries known credentials from a leak, it’s not random cracking. Per IP blocks can be circumvented by using a botnet and slowing your attack.
    - wearywanderer 5y ago
      What we have here is users who don't re-use passwords being inconvenienced to protect those who do. Doubtlessly this is very progressive, as those who reuse passwords have less "has a fucking clue"-privilege. But nonetheless this does not sit right with me.
    - chrismorgan 5y ago

IAmGraydon 5y ago

Try to register a new Protonmail email address normally and you can do so without supplying too much information. Try to do so through Tor, and you will not be able to proceed without “verifying” the account with a phone number. This pattern (they want either your IP or a phone number) tells me they’re likely interested in tying accounts to real identities and shouldn’t be trusted with anything private. I would even go so far as to suspect Protonmail of being a honeypot. Oh…I’ll just leave this here: https://privacy-watchdog.io/truth-about-protonmail/ https://privacy-watchdog.io/truth-about-protonmail/

deleted 5y ago
[deleted]
secfirstmd 5y ago
Yep noticed this a long time ago and am very suspicious
- jimmaswell 5y ago
  A visitor from TOR is extraordinarily more likely to be abusive. It makes total sense to put up extra barriers, which is still short of blocking TOR users altogether, which is also fair for webmasters who don't want to deal with it.
  - vmception 5y ago
    I’ve always found it weird how people jump hoops to be apologists for Protonmail Does anybody else find that weird? “I completely misunderstood Swiss privacy laws and fell for a sales pitch from an email and VPN company that goes out of its way to track every user no matter how they sign up! Its to avoid email abuse, exclusively!”
    - jimmaswell 5y ago
      I've never even heard of Protonmail. I just think it's silly to fault anyone for blocking/limiting TOR connections.

______- 5y ago

> I find this very absurd to see. This is absurd indeed. hCaptcha[0] is a better alternative though, and I wouldn't mind if they used that instead of reCaptcha. I never liked the carpal tunnel that reCaptcha introduces. [0] https://www.hcaptcha.com/ https://www.hcaptcha.com/

OminousWeapons 5y ago
If you're script blocking, hcaptcha also only requires one reload of the page as opposed to two for Google (enabling Google then enabling Gstatic)
axegon_ 5y ago
Even as recent as 5 years ago I liked the idea of a captchas. I still understand the purpose behind them but recently I've started getting really annoyed by them(whether that be reCaptcha or hcaptcha or anything else). They are just everywhere and it gets incredibly tedious to have to solve one every odd click or so. And it gets even worse if you use a vpn or tunnel or god forbid tor: there's no way to solve them there AT ALL. Which is the sad part: despite the tons of innovation in ML, captchas seem to rely on recursion of hardcoded rules which pile up indefinitely the moment you step outside your "start your computer and open up a browser" behavior. Kind of sad considering the abundance of information browsers pass on with each request.
- abawany 5y ago
  In some cases, it seems the companies deploy them to coerce and punish: 'logged out, did you? you deserve this captcha for trying to thwart our tracking, peasant! work this useless problem for us for free!' Looking at you, Meetup.
  - lallysingh 5y ago
    IIUC, they do help limit some classes of DDOS attacks.
- ______- 5y ago
  > Recently I've started getting really annoyed by them In the end, the services that are using captchas are the services that become the least liked, and users will start migrating to other services that don't use captchas, so there's a business penalty for using them. On the other hand, if you want to filter out bad actors, then captchas are the way to go. The reason I recommended hCaptcha is because they're easier to solve, and sometimes Google's reCaptcha offering is so complex and hard-to-solve that it starts inducing carpal tunnel / RSI symptoms (at least for me). I don't get so easily fatigued & inflamed with hCaptcha though.

______- 5y ago

hCaptcha[0] is a better alternative though, and I wouldn't mind if Protonmail used that instead of reCaptcha. I never liked the carpal tunnel that reCaptcha introduces. [0] https://www.hcaptcha.com/ https://www.hcaptcha.com/

______- 5y ago

I can understand requiring a captcha for registering, but not for logging in. Also: does anyone know if they have to do this even if you have a Protonmail cookie set in your session?

cloudboogie 5y ago
I wonder if it's a response to the recent incident with Ryanair plane got grounded by Belarus. I believe an anonymous email with a bomb threat was sent with ProtonMail.

jorgBaller 5y ago

germans...

arkadiyt 5y ago

Their response on twitter [1]: "The recaptcha, when it shows up (in rare situations), is sandboxed so that it doesn't send any data to Google. We are also in the process of replacing it with hcaptcha." Not sure what possible sandboxing they could be referring to - if they load the captcha in an iframe from a different origin then it is true that Google's javascript can't access things on the Protonmail origin, but the concern seems to be that your data is sent to Google (which is still happening even with sandboxing, their tweet cannot be correct), not that Google's recaptcha javascript would have done something malicious on the Protonmail origin (which seems unlikely). In any case, at least they're moving to hcaptcha. [1]: https://twitter.com/ProtonMail/status/1398657423913668614 https://twitter.com/ProtonMail/status/1398657423913668614

clairity 5y ago
hcaptcha is not much better than recaptcha, in that its only ‘improvement’ is shifting data extraction from google to cloudflare. also, captcha in general shifts burden onto and penalizes legitimate users, especially privacy-conscious ones, in addition to malicious ones. that is, false positive rates are too high to achieve acceptable false negative rates. it would be better not to use a centralized captcha service, if one must be used at all.
- ysavir 5y ago
  Do you have any suggestions for alternatives?
  - clairity 5y ago
    write your own? many personal tech blogs do this for comment forms and the like. any kind of ambiguity that’s natural for a human to parse accurately but not obvious for a machine is fair game. most bots won’t one-off a solution for smaller sites, so it doesn’t need to be too fancy. for larger ones where one-off customizations might be more likely, lots of engineering resources go toward security and fraud prevention already, so they can afford more sophistication. but more importantly, in the long term, it needs policy and legal progress. it needs to be costly and international (via treaties/sanctions).

cowpig 5y ago

When I started my company we chose to use Protonmail. My advice to anyone who wants secure email: don't use protonmail. The email search is completely useless. I don't understand how it can possibly be so difficult to do a substring search on a corpus and rank them in some kind of sane way. Searching for old emails based on content is an exercise in futility. After a few years of using an email service, search becomes really important. It is exceedingly difficult to pull data out. You need dev ops skills to do it. They charge for users that are disabled, and you can only stop paying for them if all of the associated data is deleted. So they effectively hold your data hostage (yes, you can get it out but it time-consuming and requires technical skills). I finally bit the bullet and paid a dev ops person (and gave him access to all my data) and switched to fastmail (at least it's not google) a few months ago. It's been an incredible relief.

protonmail 5y ago
A few clarifications. There is an export tool that is available. The reason we must count disabled addresses towards your quota is because if we did not do that, we would be susceptible to an attack where a paid user could run through our address space by creating and disabling addresses continuously, so some limits are required. You can remove disabled addresses, but only by contacting support.
- notafraudster 5y ago
  This is a sort of weird reply. The person you're replying to isn't saying "you need to allow an attacker to create and disable millions of addresses to DOS you". They're saying "you need to allow medium to longer term clients that de-activate very small portions of their overall number of accounts to not have to pay for those". You already have a system to measure account numbers, so what makes it impossible to also measure active account %ages
  - protonmail 5y ago
    Sorry if our answer wasn't clear. You can de-activate, but it must be manually requested through support.

protonmail 5y ago

This headline is unfortunately misleading. Recaptcha is not used on every login (this is verifiable). It only appears in rare situations when it is required to prevent abuse.

Hard_Space 5y ago
I have two PM accounts. Since implementation, every single login includes Captcha. I log in twice a day, Captcha is never omitted.
- jjcon 5y ago
  I’m also seeing it every time
  - octopoc 5y ago
    Are you using Tor or a VPN? That could be why. Not that that makes it any less annoying.
    - Hard_Space 5y ago
      Neither. Firefox on non-VPN broadband.
- protonmail 5y ago
  If you are using Tor or VPN, this might be the case. Another possibility is that you (or somebody on your network, or ISP in the case of NAT/shared mobile IP), have installed an app that is using an SDK like Luminati [1] or similar, which is causing the IP to be abused in the brute force attempts our anti-abuse systems are trying to prevent. [1] https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/shining-a-light-on-the-risks-of-holavpn-and-luminati https://www.trendmicro.com/vinfo/hk-en/security/news/cybercr...
  - Hard_Space 5y ago
    Never used HolaVPN (apparently a prerequisite for Luminati). Never heard of it. Only turn my VPN on once in a blue moon for a few minutes.

protonmail 5y ago

A few comments about this. A very small fraction of logins get the CAPTCHA challenge. We, and other services, face unrelenting brute force attacks on our login endpoints. If you are seeing a CAPTCHA on login, chances are that something about your connection is suspicious to our system. It's far from perfect, and we continue to improve it, but at most a percent or two of users are seeing CAPTCHA at any time. The CAPTCHA is run in an iframe on a separate domain to sandbox it from the Proton login flow prevent it from compromising the webapp. Obviously Google still gets some information, but we do all we can to limit this. CAPTCHAs are very hard to build, especially considering Google has a habit of clearing the field with it's own captcha-breaking code. Most companies do not have the resources to build their own. We had an alternative CAPTCHA we were going to use as a replacement a few years ago and then the company behind it went bankrupt. We are currently looking to replace ReCAPTCHA with hcaptcha, which should alleviate some of these problems. We have other strategies which we are also exploring to try to reduce the need for CAPTCHAs entirely, but these are also not trivial to build and integrate into all clients. TL;DR It's a small fraction of users who are affected, it's necessary to protect our users from brute force login attacks, we don't like it either and are working hard on replacements.

owly 5y ago
Thank you for explaining here, I really appreciate the work you’re doing and understand the non-trivial work it takes to protect users. While l’d love a Google free experience for PM, I also love having a near zero chance of a brute force attack. I’m a paid PM user and have been using it since the very early beta days. I never see the CAPTCHA on any OS, but I only connect from about 5 different IPs or while using ProtonVPN. Off topic: please implement font size adjustment capability on iOS!
- totalZero 5y ago
  This isn't an explanation, insofar as it's identical to the bartbutler post in the submission itself.
  - escr0w 5y ago

edoceo 5y ago

Another user-hostile. Folks laugh when I say I run my own email (FreeBSD/Postfix) and "why build your own mail client"? Because, inevitably, all these for profit service providers turn against me.

rantwasp 5y ago
i would not laugh. think it’s impressive and must eat a lot of time
- ipaddr 5y ago
  Setting up dovecot, postfix to receive emails is a fun few hours that have continued to work forever. Sending mail to gmail requires setting up extra processes that most times won't work anyways. Sending mail from an unknown ip is like sending it from a blacklisted address. To avoid this I use my isp to send the mail. Setup time including thunderbird settings is under an 2 hours for many.
- edoceo 5y ago
  Not really. Once Postfix, Dovecot, DNS stuff, DKIM, it "just works". I did lose some time, three years ago fiddling with spamassaaain vs rspamd but mail, after the not-really-that-hard-at-all setup. I mean, folk handle way more complex stuff (k8s) but balk at a bit of time on this old, boring, stable set-it-and-forget-it self-hosted wonder.
- jjav 5y ago
  > i would not laugh. think it’s impressive and must eat a lot of time It does not. I set up my latest/current email hosting in about 2011. Very minimal work on it since then. There's really nothing to do once it's working. Only work I can think of I've spent on it since 2011 is: regular OS updates (which take basically no time), added SPF and later DKIM support, added Let's Encrypt cert. That's it in ten years.
inamiyar 5y ago
The problem with running my own email is I don't want the hassle of convincing Google I'm not spam.

francoisz 5y ago

posteo.de

pphysch 5y ago

An email/SaaS provider that explicitly markets themselves as "private", complaining that "CAPTCHAs are very hard to build", and will therefore sacrifice user privacy is too rich. What in tarnation are we paying you for?

msh 5y ago

I don't know if the hn protonmail account is an official account or a fan account, but it seems quite unprofessional and really scares me off being a protonmail customer.

protonmail 5y ago
We apologize for that. It's a weekend and we are working on giving folks responses as quickly as possible. Therefore, the responses are more to the point than usual.
- Mike86534 5y ago
  Don't worry. It's just a minority of princesses complaining. This "news" was a waste of time. Non issue.

grammers 5y ago

Tutanota uses an open source captcha. I guess their goal is to get rid of Google completely: https://tutanota.com/blog/posts/open-source-email/ https://tutanota.com/blog/posts/open-source-email/

rgj 5y ago

ProtonMail apparently also releases details about their customers email sending timestamps to the press. Very strange and not a good sign IMHO. https://www.reuters.com/world/europe/email-bomb-threat-sent-after-bloggers-plane-was-diverted-over-belarus-swiss-2021-05-27/ https://www.reuters.com/world/europe/email-bomb-threat-sent-...

bromquinn 5y ago

Weird. I’ve been using ProtonMail for years as my primary email, and I don’t think I’ve ever seen a captcha. This includes when I visit ProtonMail over VPN’s or in a private window

throwawayboise 5y ago

I'm on a few email lists, and nearly without exception the people with protonmail accounts are entitled, inconsiderate, abusive, or out-and-out trolls. It was so consistent I went so far as to killfile any posts from protonmail accounts.

eatbots 5y ago

As a fan of ProtonMail, will just add a few points: Every popular online service today is being continuously attacked. Bad actors get a lot of economic value from credential stuffing, account takeovers, and fake registrations, especially on email services. This is why CAPTCHAs exist. They are one of the better tools in the defender's arsenal to increase the cost of attacks. Building and maintaining a good CAPTCHA service is both hard and requires a high level of continuous development, since every day people are waking up and trying to figure out how to break it. This means almost every company that tried building their own in the past has switched to either hCaptcha or Google, since it is not practical for even large companies to maintain their own solution these days. Why was ProtonMail originally using Google? Probably because for many years it was the only plausible option until hCaptcha came around, and they needed to protect their users. We're working with them now to switch over to the enterprise version of hCaptcha, which: 1) includes privacy-preserving features that let them decide exactly what user data hCaptcha sees and when, and 2) guarantees what happens to any data received via a data processing agreement, and 3) isn't run by an ad network. hCaptcha doesn't care who you are and ensures all data is ephemeral, since unlike Google we're not trying to sell ads targeting you. (disclosure: work there)

10000truths 5y ago
> Building and maintaining a good CAPTCHA service is both hard and requires a high level of continuous development, since every day people are waking up and trying to figure out how to break it. This means almost every company that tried building their own in the past has switched to either hCaptcha or Google, since it is not practical for even large companies to maintain their own solution these days. I’m under the impression that the bottleneck isn’t “high level of continuous development” so much as it is just having a large enough data set of Internet activity to conduct statistical analyses on. Cloudflare and Google are obviously in a good position for this, since a significant amount of Internet traffic goes through them. But I can’t create a startup to invent the next Captcha unless I magically discover a flash drive containing a giant corpus of HTTP requests made by billions of modern devices around the planet.

pkw792 5y ago

Why all the senseless bickering? If you don't like ProtonMail, don't use it! Choose whatever else, and go bicker or rave about that instead.

neurostimulant 5y ago

Someone mentioned about using proof of work as an alternative to capthca. Sounds interesting, but will this actually effective in real world? I assume even selenium can pass it without a problem because all it did was making the client busy for a little while, so will it actually effective at reducing brute force rate? Also, do botnet operators have capability to deploy selenium-based workload to their botnet army?

efficax 5y ago
proof of work originated to stop spam. But it’s a question of cost. If it costs less to bypass bot detection than the money made by the bot activity, then they’ll do it, whether captcha farms or doing proof of work calculations.

some_account_ 5y ago

A few weeks ago I noticed that Reddit also started using Google Recaptcha for account creation. Even though I only saw it on creation, and not on login, the possibility of associating a strong identifying fingerprint with a presumably anonymous throwaway user account was concerning.

Aeolun 5y ago

What I don’t understand is how any privacy focused service would ever choose Google as their captcha of choice. It’s just flies so flabbergastingly in the face of the entire point of the thing that I might as well stop using them.

protonmail 5y ago
It only appears for a tiny fraction of users. When recaptcha was first added in 2014, it was the only captcha service that wasn't broken. Today there is also hcaptcha, which we are working on implementing and will switch to that shortly.

deleted 5y ago

[deleted]

CynicusRex 5y ago

Ever since the following ProtonMail tweet about bitcoin, I migrated to Vivaldi Browser's email service. At least Vivaldi's team recognizes that crypto“currencies” are nothing but pyramid Ponzi schemes. https://twitter.com/ProtonMail/status/1395719559215210496 https://twitter.com/ProtonMail/status/1395719559215210496

c01n 5y ago

The reason I use Protonmail is to stay far as possible from Google (gmail), this is highly disappointing.

permo-w 5y ago

> [from a commenter on the OP, in reply to the Protonmail response] If an Incognito Mode Web Browser with a graphical user that actively moves his mouse, types in the password in non-automated manner, key by key - not copy/pasted and not auto-inserted within a millisecond - seems suspicious by your system - then I have to say your ways of identifying or classifying suspicious behaviour is very flawed. There are way better, already solved ways, to do this. If you know this, then I guarantee that the people making spam bots know this too. this is a very naïve argument