<story><title>ProtonMail includes Google Recaptcha for login</title><url>https://github.com/ProtonMail/WebClient/issues/242</url></story><parent_chain><item><author>protonmail</author><text>A few comments about this.&lt;p&gt;A very small fraction of logins get the CAPTCHA challenge. We, and other services, face unrelenting brute force attacks on our login endpoints. If you are seeing a CAPTCHA on login, chances are that something about your connection is suspicious to our system. It&amp;#x27;s far from perfect, and we continue to improve it, but at most a percent or two of users are seeing CAPTCHA at any time.&lt;p&gt;The CAPTCHA is run in an iframe on a separate domain to sandbox it from the Proton login flow prevent it from compromising the webapp. Obviously Google still gets some information, but we do all we can to limit this.&lt;p&gt;CAPTCHAs are very hard to build, especially considering Google has a habit of clearing the field with it&amp;#x27;s own captcha-breaking code. Most companies do not have the resources to build their own. We had an alternative CAPTCHA we were going to use as a replacement a few years ago and then the company behind it went bankrupt. We are currently looking to replace ReCAPTCHA with hcaptcha, which should alleviate some of these problems.&lt;p&gt;We have other strategies which we are also exploring to try to reduce the need for CAPTCHAs entirely, but these are also not trivial to build and integrate into all clients.&lt;p&gt;TL;DR It&amp;#x27;s a small fraction of users who are affected, it&amp;#x27;s necessary to protect our users from brute force login attacks, we don&amp;#x27;t like it either and are working hard on replacements.</text></item></parent_chain><comment><author>neilv</author><text>I&amp;#x27;m going to put you on a spot a bit, because this seems important to ProtonMail&amp;#x27;s viability, and I want you to keep succeeding...&lt;p&gt;&amp;gt; &lt;i&gt;Obviously Google still gets some information, but we do all we can to limit this.&lt;/i&gt;&lt;p&gt;When you cause a request to be made for ReCaptcha, it seems that you&amp;#x27;re leaking enough information to (in many cases) link a possibly-pseudonymous Protonmail account to an identifiable individual.&lt;p&gt;(For example, even if you leak nothing else than &lt;i&gt;times&lt;/i&gt; that individuals identifiable by Google logged into &lt;i&gt;unidentified&lt;/i&gt; ProtonMail accounts, Google can already see various external activity of specific ProtonMail accounts, and you&amp;#x27;ve given them temporal correlations between activity of pseudonymous accounts and logins by identifiable individuals.  That&amp;#x27;s not the only example, but even that alone seems a significant risk.)&lt;p&gt;And it&amp;#x27;s seems to be a real risk: Google is in the business of doing things like that, has a track record of doing things like that, and presumably is more than capable enough of doing it some more.&lt;p&gt;&amp;gt; &lt;i&gt;but at most a percent or two of users are seeing CAPTCHA at any time.&lt;/i&gt;&lt;p&gt;That sounds like a lot.  And the &amp;quot;at any time&amp;quot; sounds like an even higher percentage of users are potentially being compromised by the use of ReCaptcha.&lt;p&gt;&amp;gt; &lt;i&gt;we don&amp;#x27;t like it either&lt;/i&gt;&lt;p&gt;I&amp;#x27;m not yet convinced that this is the least of all evils.  And I don&amp;#x27;t know how much you have to dislike it before you decide not to do it.&lt;p&gt;For persuasive effect, is it helpful to imagine the reaction of your philosophical adversaries, when they heard that ProtonMail was using ReCaptcha?  I just imagined some of them laughing derisively or incredulously.  I don&amp;#x27;t say that to be mean, but I don&amp;#x27;t understand the rationale for using ReCaptcha, and I want to emphasize that it seems to be a problem that threatens ProtonMail&amp;#x27;s raison d&amp;#x27;etre and&amp;#x2F;or brand image.&lt;p&gt;(BTW, I&amp;#x27;m assuming this ReCaptcha choice &lt;i&gt;isn&amp;#x27;t&lt;/i&gt; due to legally-compelled cooperation in unmasking specific accounts -- in which case I wouldn&amp;#x27;t say anything -- since, in that case, I expect you&amp;#x27;d find a way to comply without misrepresenting the rationale to everyone else.  I&amp;#x27;ve seen ProtonMail thinking ahead to avoid related conflicting obligations and assurances.)&lt;p&gt;(BTW, I&amp;#x27;m speaking here of Google as an adversary of your customers, and therefore of you, only because that seems to be how your product is positioned, and why you have customers at all, rather than everyone just using GMail.  I&amp;#x27;m not saying that Google is bad; only that I think it should be considered an adversary from your perspective.)</text></comment>
<story><title>ProtonMail includes Google Recaptcha for login</title><url>https://github.com/ProtonMail/WebClient/issues/242</url></story><parent_chain><item><author>protonmail</author><text>A few comments about this.&lt;p&gt;A very small fraction of logins get the CAPTCHA challenge. We, and other services, face unrelenting brute force attacks on our login endpoints. If you are seeing a CAPTCHA on login, chances are that something about your connection is suspicious to our system. It&amp;#x27;s far from perfect, and we continue to improve it, but at most a percent or two of users are seeing CAPTCHA at any time.&lt;p&gt;The CAPTCHA is run in an iframe on a separate domain to sandbox it from the Proton login flow prevent it from compromising the webapp. Obviously Google still gets some information, but we do all we can to limit this.&lt;p&gt;CAPTCHAs are very hard to build, especially considering Google has a habit of clearing the field with it&amp;#x27;s own captcha-breaking code. Most companies do not have the resources to build their own. We had an alternative CAPTCHA we were going to use as a replacement a few years ago and then the company behind it went bankrupt. We are currently looking to replace ReCAPTCHA with hcaptcha, which should alleviate some of these problems.&lt;p&gt;We have other strategies which we are also exploring to try to reduce the need for CAPTCHAs entirely, but these are also not trivial to build and integrate into all clients.&lt;p&gt;TL;DR It&amp;#x27;s a small fraction of users who are affected, it&amp;#x27;s necessary to protect our users from brute force login attacks, we don&amp;#x27;t like it either and are working hard on replacements.</text></item></parent_chain><comment><author>owly</author><text>Thank you for explaining here, I really appreciate the work you’re doing and understand the non-trivial work it takes to protect users. While l’d love a Google free experience for PM, I also love having a near zero chance of a brute force attack. I’m a paid PM user and have been using it since the very early beta days. I never see the CAPTCHA on any OS, but I only connect from about 5 different IPs or while using ProtonVPN.&lt;p&gt;Off topic: please implement font size adjustment capability on iOS!</text></comment>