Hacker News Reader

Comment by Hard_Space | Hacker News Reader

I have two PM accounts. Since implementation, every single login includes Captcha. I log in twice a day, Captcha is never omitted.

View on HN

If you are using Tor or VPN, this might be the case. Another possibility is that you (or somebody on your network, or ISP in the case of NAT/shared mobile IP), have installed an app that is using an SDK like Luminati [1] or similar, which is causing the IP to be abused in the brute force attempts our anti-abuse systems are trying to prevent.

[1] https://www.trendmicro.com/vinfo/hk-en/security/news/cybercr...

why was implementing captcha a thing you considered and do you understand the deep implications it has on your users?

There is more information in the Github thread, but in short, it was done with extreme reluctance (and we are already in the process of implementing hcaptcha) as a result of login attacks from millions of residential IP addresses.

Never used HolaVPN (apparently a prerequisite for Luminati). Never heard of it. Only turn my VPN on once in a blue moon for a few minutes.

Luminati, and companies like that, distribute an SDK to many app developers. App developers incorporate the SDK, and your device is unwittingly turned into a proxy network endpoint, and the app developer gets paid for this. A surprising number of apps do this, so you could have an app installed doing this without even being aware, as it would only be disclosed in the app's privacy policy, which people don't actually read.

Perhaps a list of apps would be helpful, otherwise it seems kind of a vague deflection.

That's not something ProtonMail can provide you with. It's like asking them to list you all apps that use the Facebook SDK or something like that.

What was described above is correct though. One popular app (which had legal troubles recently) made money with Luminati:

https://torrentfreak.com/mobdro-luminati-proxy-service-suspe...

Something is clearly happening server-side, not client-side. The original post cites two weeks since this began, and I confirm. Surely we have not all contracted this problem in this time?

I have 3 accounts which I'm using quite active throughout the week and I haven't seen any captcha on any of these, neither on Windows nor Linux; I'm using PM since I've moved from GMail in 2018.

I'm in Poland, using one of most popular landline ISP

I’m also seeing it every time

Are you using Tor or a VPN? That could be why. Not that that makes it any less annoying.

Neither. Firefox on non-VPN broadband.

Reply on news.ycombinator.com