Hacker News Reader

Comment by protonmail | Hacker News Reader

If you are using Tor or VPN, this might be the case. Another possibility is that you (or somebody on your network, or ISP in the case of NAT/shared mobile IP), have installed an app that is using an SDK like Luminati [1] or similar, which is causing the IP to be abused in the brute force attempts our anti-abuse systems are trying to prevent.

[1] https://www.trendmicro.com/vinfo/hk-en/security/news/cybercr...

View on HN

why was implementing captcha a thing you considered and do you understand the deep implications it has on your users?

There is more information in the Github thread, but in short, it was done with extreme reluctance (and we are already in the process of implementing hcaptcha) as a result of login attacks from millions of residential IP addresses.

Never used HolaVPN (apparently a prerequisite for Luminati). Never heard of it. Only turn my VPN on once in a blue moon for a few minutes.

Luminati, and companies like that, distribute an SDK to many app developers. App developers incorporate the SDK, and your device is unwittingly turned into a proxy network endpoint, and the app developer gets paid for this. A surprising number of apps do this, so you could have an app installed doing this without even being aware, as it would only be disclosed in the app's privacy policy, which people don't actually read.

Perhaps a list of apps would be helpful, otherwise it seems kind of a vague deflection.

That's not something ProtonMail can provide you with. It's like asking them to list you all apps that use the Facebook SDK or something like that.

What was described above is correct though. One popular app (which had legal troubles recently) made money with Luminati:

https://torrentfreak.com/mobdro-luminati-proxy-service-suspe...

Something is clearly happening server-side, not client-side. The original post cites two weeks since this began, and I confirm. Surely we have not all contracted this problem in this time?

Reply on news.ycombinator.com