5 ms·

If you are using Tor or VPN, this might be the case. Another possibility is that you (or somebody on your network, or ISP in the case of NAT/shared mobile IP),

If you are using Tor or VPN, this might be the case. Another possibility is that you (or somebody on your network, or ISP in the case of NAT/shared mobile IP), have installed an app that is using an SDK like Luminati [1] or similar, which is causing the IP to be abused in the brute force attempts our anti-abuse systems are trying to prevent. [1] https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/shining-a-light-on-the-risks-of-holavpn-and-luminati https://www.trendmicro.com/vinfo/hk-en/security/news/cybercr...

Hard_Space 5y ago
Never used HolaVPN (apparently a prerequisite for Luminati). Never heard of it. Only turn my VPN on once in a blue moon for a few minutes.
- protonmail 5y ago
  Luminati, and companies like that, distribute an SDK to many app developers. App developers incorporate the SDK, and your device is unwittingly turned into a proxy network endpoint, and the app developer gets paid for this. A surprising number of apps do this, so you could have an app installed doing this without even being aware, as it would only be disclosed in the app's privacy policy, which people don't actually read.
  - Hard_Space 5y ago
    Perhaps a list of apps would be helpful, otherwise it seems kind of a vague deflection.
    - celsoazevedo 5y ago
      That's not something ProtonMail can provide you with. It's like asking them to list you all apps that use the Facebook SDK or something like that. What was described above is correct though. One popular app (which had legal troubles recently) made money with Luminati: https://torrentfreak.com/mobdro-luminati-proxy-service-suspended-service-to-pirate-app-210315/ https://torrentfreak.com/mobdro-luminati-proxy-service-suspe...
      - Hard_Space 5y ago
        Something is clearly happening server-side, not client-side. The original post cites two weeks since this began, and I confirm. Surely we have not all contracted this problem in this time?
rantwasp 5y ago
why was implementing captcha a thing you considered and do you understand the deep implications it has on your users?
- protonmail 5y ago
  There is more information in the Github thread, but in short, it was done with extreme reluctance (and we are already in the process of implementing hcaptcha) as a result of login attacks from millions of residential IP addresses.

Hard_Space 5y ago

Never used HolaVPN (apparently a prerequisite for Luminati). Never heard of it. Only turn my VPN on once in a blue moon for a few minutes.

protonmail 5y ago
Luminati, and companies like that, distribute an SDK to many app developers. App developers incorporate the SDK, and your device is unwittingly turned into a proxy network endpoint, and the app developer gets paid for this. A surprising number of apps do this, so you could have an app installed doing this without even being aware, as it would only be disclosed in the app's privacy policy, which people don't actually read.
- Hard_Space 5y ago
  Perhaps a list of apps would be helpful, otherwise it seems kind of a vague deflection.
  - celsoazevedo 5y ago
    That's not something ProtonMail can provide you with. It's like asking them to list you all apps that use the Facebook SDK or something like that. What was described above is correct though. One popular app (which had legal troubles recently) made money with Luminati: https://torrentfreak.com/mobdro-luminati-proxy-service-suspended-service-to-pirate-app-210315/ https://torrentfreak.com/mobdro-luminati-proxy-service-suspe...
    - Hard_Space 5y ago
      Something is clearly happening server-side, not client-side. The original post cites two weeks since this began, and I confirm. Surely we have not all contracted this problem in this time?

rantwasp 5y ago

why was implementing captcha a thing you considered and do you understand the deep implications it has on your users?

protonmail 5y ago
There is more information in the Github thread, but in short, it was done with extreme reluctance (and we are already in the process of implementing hcaptcha) as a result of login attacks from millions of residential IP addresses.