Hacker News Reader

Comment by protonmail | Hacker News Reader

This headline is unfortunately misleading. Recaptcha is not used on every login (this is verifiable). It only appears in rare situations when it is required to prevent abuse.

View on HN

I have two PM accounts. Since implementation, every single login includes Captcha. I log in twice a day, Captcha is never omitted.

I’m also seeing it every time

Are you using Tor or a VPN? That could be why. Not that that makes it any less annoying.

Neither. Firefox on non-VPN broadband.

If you are using Tor or VPN, this might be the case. Another possibility is that you (or somebody on your network, or ISP in the case of NAT/shared mobile IP), have installed an app that is using an SDK like Luminati [1] or similar, which is causing the IP to be abused in the brute force attempts our anti-abuse systems are trying to prevent.

[1] https://www.trendmicro.com/vinfo/hk-en/security/news/cybercr...

Never used HolaVPN (apparently a prerequisite for Luminati). Never heard of it. Only turn my VPN on once in a blue moon for a few minutes.

Luminati, and companies like that, distribute an SDK to many app developers. App developers incorporate the SDK, and your device is unwittingly turned into a proxy network endpoint, and the app developer gets paid for this. A surprising number of apps do this, so you could have an app installed doing this without even being aware, as it would only be disclosed in the app's privacy policy, which people don't actually read.

Perhaps a list of apps would be helpful, otherwise it seems kind of a vague deflection.

That's not something ProtonMail can provide you with. It's like asking them to list you all apps that use the Facebook SDK or something like that.

What was described above is correct though. One popular app (which had legal troubles recently) made money with Luminati:

https://torrentfreak.com/mobdro-luminati-proxy-service-suspe...

Something is clearly happening server-side, not client-side. The original post cites two weeks since this began, and I confirm. Surely we have not all contracted this problem in this time?

why was implementing captcha a thing you considered and do you understand the deep implications it has on your users?

There is more information in the Github thread, but in short, it was done with extreme reluctance (and we are already in the process of implementing hcaptcha) as a result of login attacks from millions of residential IP addresses.

I have 3 accounts which I'm using quite active throughout the week and I haven't seen any captcha on any of these, neither on Windows nor Linux; I'm using PM since I've moved from GMail in 2018.

I'm in Poland, using one of most popular landline ISP

Yeah I can't remember the last time I got a captcha of any kind, so it has definitely been rare for me.

That probably means you have tracking enabled. I'm not a protonmail user (I host my own email) but from my general experience with recaptcha, try opening it in a private navigation window. If recaptcha doesn't ask you to solve anything, they've already been tracking you to make up its mind. Of course, whether this is fine by you is up to you, but it sounds like you might be unaware of this.

No, there's no tracking in ProtonMail. Captchas appearing is entirely based upon IP reputation and number of recent login attempts.

Thanks for clarifying! Showing a captcha, though perhaps not Google's, under those conditions sounds sensible. I didn't know that as a non-user (I use your VPN, fwiw :) ).

Maybe you could also display that information when you show a captcha. "We've observed x login attempts from your IP in the last y days."

Usually you wouldn't want to make it easy for botnet owners to find out they've been caught, but since displaying the captcha already reveals that, having an explanation might help regular users who got a low-reputation IP assigned.

Thanks, I appreciate it! I still don't see the captcha even when I use a private window thought. Browser is Brave on Mac. Also outside the private window I have shields up, which means trackers, ads, cross-site cookies and fingerprinting are all blocked.

Edit: also it says there are 0 items blocked

I use to get it everytime. Since I logged in from my desktop never again.

Reply on news.ycombinator.com