Hacker News Reader

Comment by arkadiyt | Hacker News Reader

Their response on twitter [1]:

"The recaptcha, when it shows up (in rare situations), is sandboxed so that it doesn't send any data to Google. We are also in the process of replacing it with hcaptcha."

Not sure what possible sandboxing they could be referring to - if they load the captcha in an iframe from a different origin then it is true that Google's javascript can't access things on the Protonmail origin, but the concern seems to be that your data is sent to Google (which is still happening even with sandboxing, their tweet cannot be correct), not that Google's recaptcha javascript would have done something malicious on the Protonmail origin (which seems unlikely).

In any case, at least they're moving to hcaptcha.

[1]: https://twitter.com/ProtonMail/status/1398657423913668614

View on HN

hcaptcha is not much better than recaptcha, in that its only ‘improvement’ is shifting data extraction from google to cloudflare.

also, captcha in general shifts burden onto and penalizes legitimate users, especially privacy-conscious ones, in addition to malicious ones. that is, false positive rates are too high to achieve acceptable false negative rates.

it would be better not to use a centralized captcha service, if one must be used at all.

This is not actually true: every relevant aspect is different from a privacy perspective, both technical and legal.

Looking only at the technical differences, hCaptcha lets enterprise users like Proton locally scrub any info like IPs prior to sending to hCaptcha. It can be set up so that the user makes no direct connection at all to the service, and the code runs inside of a sandboxed IFRAME.

As for false positive vs false negative rates, not sure what you consider too high. We've been able to demonstrate FP rates under 0.005% when measured against known-good/bad signals from customers, which is as good as it gets.

(disclosure: work there)

those things can be true and still not negate the issues mentioned, since not enough information is provided to make a fair assessment. it can be set up a certain way, but the incentives are against that, so is it actually set up that way? iframes aren’t perfectly isolated either. and without a curve of false positive vs. false negative rates, no conclusion can be made of the optimality. even 0.005% is still likely hundreds of thousands a day for larger sites, and being only a demonstration means it’s an ideal measure, not a practical one.

And yet I ge t stuck endless captcha. Without disclosing what a known good/bad signal is, you are essentially trust a black box and a random account on the internet

Do you have any suggestions for alternatives?

write your own? many personal tech blogs do this for comment forms and the like. any kind of ambiguity that’s natural for a human to parse accurately but not obvious for a machine is fair game. most bots won’t one-off a solution for smaller sites, so it doesn’t need to be too fancy. for larger ones where one-off customizations might be more likely, lots of engineering resources go toward security and fraud prevention already, so they can afford more sophistication.

but more importantly, in the long term, it needs policy and legal progress. it needs to be costly and international (via treaties/sanctions).

> write your own? many personal tech blogs do this for comment forms and the like.

Until they get broken by botnets and we are back to where we started by using Google ReCaptcha.

hcaptcha is so much harder than recaptcha. You actually have to spend a couple seconds per photo sometimes. Not ideal for users.

Really not sure about it, Google lets you do it quickly but if you do it, they'll just throw more problems at you it seems.

I can't speak to the sandboxing, but their implementation is definitely non-standard considering that I don't see Google or gstatic appearing in umatrix when I go through the logon process and they aren't flagging me for captcha even though I am coming out of a known VPN endpoint which trips recaptcha on every other site that employs it.

What data is being sent to Google? Besides the user interacting with Google to solve the captcha? Or is that the problem?

the ip, any fingerprinting that the captcha code does.

so in effect google can tie you to this visit later if you interact with anything that has a captcha. now these two thinks are liked in the borg’s memory.

so if you use google (anything while logged in, even once) now google knows everything else you do

Reply on news.ycombinator.com