4 ms·

Their response on twitter [1]: "The recaptcha, when it shows up (in rare situations), is sandboxed so that it doesn't send any data to Google. We are also in t

Their response on twitter [1]: "The recaptcha, when it shows up (in rare situations), is sandboxed so that it doesn't send any data to Google. We are also in the process of replacing it with hcaptcha." Not sure what possible sandboxing they could be referring to - if they load the captcha in an iframe from a different origin then it is true that Google's javascript can't access things on the Protonmail origin, but the concern seems to be that your data is sent to Google (which is still happening even with sandboxing, their tweet cannot be correct), not that Google's recaptcha javascript would have done something malicious on the Protonmail origin (which seems unlikely). In any case, at least they're moving to hcaptcha. [1]: https://twitter.com/ProtonMail/status/1398657423913668614 https://twitter.com/ProtonMail/status/1398657423913668614

clairity 5y ago
hcaptcha is not much better than recaptcha, in that its only ‘improvement’ is shifting data extraction from google to cloudflare. also, captcha in general shifts burden onto and penalizes legitimate users, especially privacy-conscious ones, in addition to malicious ones. that is, false positive rates are too high to achieve acceptable false negative rates. it would be better not to use a centralized captcha service, if one must be used at all.
- ysavir 5y ago
  Do you have any suggestions for alternatives?
  - clairity 5y ago
    write your own? many personal tech blogs do this for comment forms and the like. any kind of ambiguity that’s natural for a human to parse accurately but not obvious for a machine is fair game. most bots won’t one-off a solution for smaller sites, so it doesn’t need to be too fancy. for larger ones where one-off customizations might be more likely, lots of engineering resources go toward security and fraud prevention already, so they can afford more sophistication. but more importantly, in the long term, it needs policy and legal progress. it needs to be costly and international (via treaties/sanctions).
    - colesantiago 5y ago
      > write your own? many personal tech blogs do this for comment forms and the like. Until they get broken by botnets and we are back to where we started by using Google ReCaptcha.
- eatbots 5y ago
  This is not actually true: every relevant aspect is different from a privacy perspective, both technical and legal. Looking only at the technical differences, hCaptcha lets enterprise users like Proton locally scrub any info like IPs prior to sending to hCaptcha. It can be set up so that the user makes no direct connection at all to the service, and the code runs inside of a sandboxed IFRAME. As for false positive vs false negative rates, not sure what you consider too high. We've been able to demonstrate FP rates under 0.005% when measured against known-good/bad signals from customers, which is as good as it gets. (disclosure: work there)
  - clairity 5y ago
    those things can be true and still not negate the issues mentioned, since not enough information is provided to make a fair assessment. it can be set up a certain way, but the incentives are against that, so is it actually set up that way? iframes aren’t perfectly isolated either. and without a curve of false positive vs. false negative rates, no conclusion can be made of the optimality. even 0.005% is still likely hundreds of thousands a day for larger sites, and being only a demonstration means it’s an ideal measure, not a practical one.
  - ashneo76 5y ago
    And yet I ge t stuck endless captcha. Without disclosing what a known good/bad signal is, you are essentially trust a black box and a random account on the internet
- briefcomment 5y ago
  hcaptcha is so much harder than recaptcha. You actually have to spend a couple seconds per photo sometimes. Not ideal for users.
  - raverbashing 5y ago
    Really not sure about it, Google lets you do it quickly but if you do it, they'll just throw more problems at you it seems.
alisonkisk 5y ago
What data is being sent to Google? Besides the user interacting with Google to solve the captcha? Or is that the problem?
- rantwasp 5y ago
  the ip, any fingerprinting that the captcha code does. so in effect google can tie you to this visit later if you interact with anything that has a captcha. now these two thinks are liked in the borg’s memory. so if you use google (anything while logged in, even once) now google knows everything else you do
OminousWeapons 5y ago
I can't speak to the sandboxing, but their implementation is definitely non-standard considering that I don't see Google or gstatic appearing in umatrix when I go through the logon process and they aren't flagging me for captcha even though I am coming out of a known VPN endpoint which trips recaptcha on every other site that employs it.

clairity 5y ago

hcaptcha is not much better than recaptcha, in that its only ‘improvement’ is shifting data extraction from google to cloudflare. also, captcha in general shifts burden onto and penalizes legitimate users, especially privacy-conscious ones, in addition to malicious ones. that is, false positive rates are too high to achieve acceptable false negative rates. it would be better not to use a centralized captcha service, if one must be used at all.

ysavir 5y ago
Do you have any suggestions for alternatives?
- clairity 5y ago
  write your own? many personal tech blogs do this for comment forms and the like. any kind of ambiguity that’s natural for a human to parse accurately but not obvious for a machine is fair game. most bots won’t one-off a solution for smaller sites, so it doesn’t need to be too fancy. for larger ones where one-off customizations might be more likely, lots of engineering resources go toward security and fraud prevention already, so they can afford more sophistication. but more importantly, in the long term, it needs policy and legal progress. it needs to be costly and international (via treaties/sanctions).
  - colesantiago 5y ago
    > write your own? many personal tech blogs do this for comment forms and the like. Until they get broken by botnets and we are back to where we started by using Google ReCaptcha.
eatbots 5y ago
This is not actually true: every relevant aspect is different from a privacy perspective, both technical and legal. Looking only at the technical differences, hCaptcha lets enterprise users like Proton locally scrub any info like IPs prior to sending to hCaptcha. It can be set up so that the user makes no direct connection at all to the service, and the code runs inside of a sandboxed IFRAME. As for false positive vs false negative rates, not sure what you consider too high. We've been able to demonstrate FP rates under 0.005% when measured against known-good/bad signals from customers, which is as good as it gets. (disclosure: work there)
- clairity 5y ago
  those things can be true and still not negate the issues mentioned, since not enough information is provided to make a fair assessment. it can be set up a certain way, but the incentives are against that, so is it actually set up that way? iframes aren’t perfectly isolated either. and without a curve of false positive vs. false negative rates, no conclusion can be made of the optimality. even 0.005% is still likely hundreds of thousands a day for larger sites, and being only a demonstration means it’s an ideal measure, not a practical one.
- ashneo76 5y ago
  And yet I ge t stuck endless captcha. Without disclosing what a known good/bad signal is, you are essentially trust a black box and a random account on the internet
briefcomment 5y ago
hcaptcha is so much harder than recaptcha. You actually have to spend a couple seconds per photo sometimes. Not ideal for users.
- raverbashing 5y ago
  Really not sure about it, Google lets you do it quickly but if you do it, they'll just throw more problems at you it seems.

alisonkisk 5y ago

What data is being sent to Google? Besides the user interacting with Google to solve the captcha? Or is that the problem?

rantwasp 5y ago
the ip, any fingerprinting that the captcha code does. so in effect google can tie you to this visit later if you interact with anything that has a captcha. now these two thinks are liked in the borg’s memory. so if you use google (anything while logged in, even once) now google knows everything else you do

OminousWeapons 5y ago

I can't speak to the sandboxing, but their implementation is definitely non-standard considering that I don't see Google or gstatic appearing in umatrix when I go through the logon process and they aren't flagging me for captcha even though I am coming out of a known VPN endpoint which trips recaptcha on every other site that employs it.