4 ms·

This headline is unfortunately misleading. Recaptcha is not used on every login (this is verifiable). It only appears in rare situations when it is required to

This headline is unfortunately misleading. Recaptcha is not used on every login (this is verifiable). It only appears in rare situations when it is required to prevent abuse.

Hard_Space 5y ago
I have two PM accounts. Since implementation, every single login includes Captcha. I log in twice a day, Captcha is never omitted.
- jjcon 5y ago
  I’m also seeing it every time
  - octopoc 5y ago
    Are you using Tor or a VPN? That could be why. Not that that makes it any less annoying.
    - Hard_Space 5y ago
      Neither. Firefox on non-VPN broadband.
- protonmail 5y ago
  If you are using Tor or VPN, this might be the case. Another possibility is that you (or somebody on your network, or ISP in the case of NAT/shared mobile IP), have installed an app that is using an SDK like Luminati [1] or similar, which is causing the IP to be abused in the brute force attempts our anti-abuse systems are trying to prevent. [1] https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/shining-a-light-on-the-risks-of-holavpn-and-luminati https://www.trendmicro.com/vinfo/hk-en/security/news/cybercr...
  - Hard_Space 5y ago
    Never used HolaVPN (apparently a prerequisite for Luminati). Never heard of it. Only turn my VPN on once in a blue moon for a few minutes.
    - protonmail 5y ago
      Luminati, and companies like that, distribute an SDK to many app developers. App developers incorporate the SDK, and your device is unwittingly turned into a proxy network endpoint, and the app developer gets paid for this. A surprising number of apps do this, so you could have an app installed doing this without even being aware, as it would only be disclosed in the app's privacy policy, which people don't actually read.
      - Hard_Space 5y ago
        Perhaps a list of apps would be helpful, otherwise it seems kind of a vague deflection.
        celsoazevedo 5y ago
        That's not something ProtonMail can provide you with. It's like asking them to list you all apps that use the Facebook SDK or something like that. What was described above is correct though. One popular app (which had legal troubles recently) made money with Luminati: https://torrentfreak.com/mobdro-luminati-proxy-service-suspended-service-to-pirate-app-210315/ https://torrentfreak.com/mobdro-luminati-proxy-service-suspe...
        Hard_Space 5y ago
        Something is clearly happening server-side, not client-side. The original post cites two weeks since this began, and I confirm. Surely we have not all contracted this problem in this time?
  - rantwasp 5y ago
- pndy 5y ago
  I have 3 accounts which I'm using quite active throughout the week and I haven't seen any captcha on any of these, neither on Windows nor Linux; I'm using PM since I've moved from GMail in 2018. I'm in Poland, using one of most popular landline ISP
octopoc 5y ago
Yeah I can't remember the last time I got a captcha of any kind, so it has definitely been rare for me.
- Aachen 5y ago
  That probably means you have tracking enabled. I'm not a protonmail user (I host my own email) but from my general experience with recaptcha, try opening it in a private navigation window. If recaptcha doesn't ask you to solve anything, they've already been tracking you to make up its mind. Of course, whether this is fine by you is up to you, but it sounds like you might be unaware of this.
  - protonmail 5y ago
    No, there's no tracking in ProtonMail. Captchas appearing is entirely based upon IP reputation and number of recent login attempts.
    - Aachen 5y ago
      Thanks for clarifying! Showing a captcha, though perhaps not Google's, under those conditions sounds sensible. I didn't know that as a non-user (I use your VPN, fwiw :) ).
    - yorwba 5y ago
      Maybe you could also display that information when you show a captcha. "We've observed x login attempts from your IP in the last y days." Usually you wouldn't want to make it easy for botnet owners to find out they've been caught, but since displaying the captcha already reveals that, having an explanation might help regular users who got a low-reputation IP assigned.
  - octopoc 5y ago
    Thanks, I appreciate it! I still don't see the captcha even when I use a private window thought. Browser is Brave on Mac. Also outside the private window I have shields up, which means trackers, ads, cross-site cookies and fingerprinting are all blocked. Edit: also it says there are 0 items blocked

This headline is unfortunately misleading. Recaptcha is not used on every login (this is verifiable). It only appears in rare situations when it is required to prevent abuse.

Hard_Space 5y ago

I have two PM accounts. Since implementation, every single login includes Captcha. I log in twice a day, Captcha is never omitted.

jjcon 5y ago
I’m also seeing it every time
- octopoc 5y ago
  Are you using Tor or a VPN? That could be why. Not that that makes it any less annoying.
  - Hard_Space 5y ago
    Neither. Firefox on non-VPN broadband.
protonmail 5y ago
If you are using Tor or VPN, this might be the case. Another possibility is that you (or somebody on your network, or ISP in the case of NAT/shared mobile IP), have installed an app that is using an SDK like Luminati [1] or similar, which is causing the IP to be abused in the brute force attempts our anti-abuse systems are trying to prevent. [1] https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/shining-a-light-on-the-risks-of-holavpn-and-luminati https://www.trendmicro.com/vinfo/hk-en/security/news/cybercr...
- Hard_Space 5y ago
  Never used HolaVPN (apparently a prerequisite for Luminati). Never heard of it. Only turn my VPN on once in a blue moon for a few minutes.
  - protonmail 5y ago
    Luminati, and companies like that, distribute an SDK to many app developers. App developers incorporate the SDK, and your device is unwittingly turned into a proxy network endpoint, and the app developer gets paid for this. A surprising number of apps do this, so you could have an app installed doing this without even being aware, as it would only be disclosed in the app's privacy policy, which people don't actually read.
    - Hard_Space 5y ago
      Perhaps a list of apps would be helpful, otherwise it seems kind of a vague deflection.
      - celsoazevedo 5y ago
        That's not something ProtonMail can provide you with. It's like asking them to list you all apps that use the Facebook SDK or something like that. What was described above is correct though. One popular app (which had legal troubles recently) made money with Luminati: https://torrentfreak.com/mobdro-luminati-proxy-service-suspended-service-to-pirate-app-210315/ https://torrentfreak.com/mobdro-luminati-proxy-service-suspe...
        Hard_Space 5y ago
        Something is clearly happening server-side, not client-side. The original post cites two weeks since this began, and I confirm. Surely we have not all contracted this problem in this time?
- rantwasp 5y ago
pndy 5y ago
I have 3 accounts which I'm using quite active throughout the week and I haven't seen any captcha on any of these, neither on Windows nor Linux; I'm using PM since I've moved from GMail in 2018. I'm in Poland, using one of most popular landline ISP

octopoc 5y ago

Yeah I can't remember the last time I got a captcha of any kind, so it has definitely been rare for me.

Aachen 5y ago
That probably means you have tracking enabled. I'm not a protonmail user (I host my own email) but from my general experience with recaptcha, try opening it in a private navigation window. If recaptcha doesn't ask you to solve anything, they've already been tracking you to make up its mind. Of course, whether this is fine by you is up to you, but it sounds like you might be unaware of this.
- protonmail 5y ago
  No, there's no tracking in ProtonMail. Captchas appearing is entirely based upon IP reputation and number of recent login attempts.
  - Aachen 5y ago
    Thanks for clarifying! Showing a captcha, though perhaps not Google's, under those conditions sounds sensible. I didn't know that as a non-user (I use your VPN, fwiw :) ).
  - yorwba 5y ago
    Maybe you could also display that information when you show a captcha. "We've observed x login attempts from your IP in the last y days." Usually you wouldn't want to make it easy for botnet owners to find out they've been caught, but since displaying the captcha already reveals that, having an explanation might help regular users who got a low-reputation IP assigned.
- octopoc 5y ago
  Thanks, I appreciate it! I still don't see the captcha even when I use a private window thought. Browser is Brave on Mac. Also outside the private window I have shields up, which means trackers, ads, cross-site cookies and fingerprinting are all blocked. Edit: also it says there are 0 items blocked