<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>neilv</author><text>I&amp;#x27;m going to put you on a spot a bit, because this seems important to ProtonMail&amp;#x27;s viability, and I want you to keep succeeding...&lt;p&gt;&amp;gt; &lt;i&gt;Obviously Google still gets some information, but we do all we can to limit this.&lt;/i&gt;&lt;p&gt;When you cause a request to be made for ReCaptcha, it seems that you&amp;#x27;re leaking enough information to (in many cases) link a possibly-pseudonymous Protonmail account to an identifiable individual.&lt;p&gt;(For example, even if you leak nothing else than &lt;i&gt;times&lt;/i&gt; that individuals identifiable by Google logged into &lt;i&gt;unidentified&lt;/i&gt; ProtonMail accounts, Google can already see various external activity of specific ProtonMail accounts, and you&amp;#x27;ve given them temporal correlations between activity of pseudonymous accounts and logins by identifiable individuals.  That&amp;#x27;s not the only example, but even that alone seems a significant risk.)&lt;p&gt;And it&amp;#x27;s seems to be a real risk: Google is in the business of doing things like that, has a track record of doing things like that, and presumably is more than capable enough of doing it some more.&lt;p&gt;&amp;gt; &lt;i&gt;but at most a percent or two of users are seeing CAPTCHA at any time.&lt;/i&gt;&lt;p&gt;That sounds like a lot.  And the &amp;quot;at any time&amp;quot; sounds like an even higher percentage of users are potentially being compromised by the use of ReCaptcha.&lt;p&gt;&amp;gt; &lt;i&gt;we don&amp;#x27;t like it either&lt;/i&gt;&lt;p&gt;I&amp;#x27;m not yet convinced that this is the least of all evils.  And I don&amp;#x27;t know how much you have to dislike it before you decide not to do it.&lt;p&gt;For persuasive effect, is it helpful to imagine the reaction of your philosophical adversaries, when they heard that ProtonMail was using ReCaptcha?  I just imagined some of them laughing derisively or incredulously.  I don&amp;#x27;t say that to be mean, but I don&amp;#x27;t understand the rationale for using ReCaptcha, and I want to emphasize that it seems to be a problem that threatens ProtonMail&amp;#x27;s raison d&amp;#x27;etre and&amp;#x2F;or brand image.&lt;p&gt;(BTW, I&amp;#x27;m assuming this ReCaptcha choice &lt;i&gt;isn&amp;#x27;t&lt;/i&gt; due to legally-compelled cooperation in unmasking specific accounts -- in which case I wouldn&amp;#x27;t say anything -- since, in that case, I expect you&amp;#x27;d find a way to comply without misrepresenting the rationale to everyone else.  I&amp;#x27;ve seen ProtonMail thinking ahead to avoid related conflicting obligations and assurances.)&lt;p&gt;(BTW, I&amp;#x27;m speaking here of Google as an adversary of your customers, and therefore of you, only because that seems to be how your product is positioned, and why you have customers at all, rather than everyone just using GMail.  I&amp;#x27;m not saying that Google is bad; only that I think it should be considered an adversary from your perspective.)</text><parent_chain><item><author>protonmail</author><text>A few comments about this.&lt;p&gt;A very small fraction of logins get the CAPTCHA challenge. We, and other services, face unrelenting brute force attacks on our login endpoints. If you are seeing a CAPTCHA on login, chances are that something about your connection is suspicious to our system. It&amp;#x27;s far from perfect, and we continue to improve it, but at most a percent or two of users are seeing CAPTCHA at any time.&lt;p&gt;The CAPTCHA is run in an iframe on a separate domain to sandbox it from the Proton login flow prevent it from compromising the webapp. Obviously Google still gets some information, but we do all we can to limit this.&lt;p&gt;CAPTCHAs are very hard to build, especially considering Google has a habit of clearing the field with it&amp;#x27;s own captcha-breaking code. Most companies do not have the resources to build their own. We had an alternative CAPTCHA we were going to use as a replacement a few years ago and then the company behind it went bankrupt. We are currently looking to replace ReCAPTCHA with hcaptcha, which should alleviate some of these problems.&lt;p&gt;We have other strategies which we are also exploring to try to reduce the need for CAPTCHAs entirely, but these are also not trivial to build and integrate into all clients.&lt;p&gt;TL;DR It&amp;#x27;s a small fraction of users who are affected, it&amp;#x27;s necessary to protect our users from brute force login attacks, we don&amp;#x27;t like it either and are working hard on replacements.</text></item></parent_chain></comment><story><title>ProtonMail includes Google Recaptcha for login</title><url>https://github.com/ProtonMail/WebClient/issues/242</url></story>
<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>jjav</author><text>A captcha of any kind on a paid service (or a storefront where I&amp;#x27;m looking to pay money) is an absolute deal breaker for me. I will not be clicking on lights and stopsigns to be able to pay money.</text><parent_chain><item><author>protonmail</author><text>A few comments about this.&lt;p&gt;A very small fraction of logins get the CAPTCHA challenge. We, and other services, face unrelenting brute force attacks on our login endpoints. If you are seeing a CAPTCHA on login, chances are that something about your connection is suspicious to our system. It&amp;#x27;s far from perfect, and we continue to improve it, but at most a percent or two of users are seeing CAPTCHA at any time.&lt;p&gt;The CAPTCHA is run in an iframe on a separate domain to sandbox it from the Proton login flow prevent it from compromising the webapp. Obviously Google still gets some information, but we do all we can to limit this.&lt;p&gt;CAPTCHAs are very hard to build, especially considering Google has a habit of clearing the field with it&amp;#x27;s own captcha-breaking code. Most companies do not have the resources to build their own. We had an alternative CAPTCHA we were going to use as a replacement a few years ago and then the company behind it went bankrupt. We are currently looking to replace ReCAPTCHA with hcaptcha, which should alleviate some of these problems.&lt;p&gt;We have other strategies which we are also exploring to try to reduce the need for CAPTCHAs entirely, but these are also not trivial to build and integrate into all clients.&lt;p&gt;TL;DR It&amp;#x27;s a small fraction of users who are affected, it&amp;#x27;s necessary to protect our users from brute force login attacks, we don&amp;#x27;t like it either and are working hard on replacements.</text></item></parent_chain></comment><story><title>ProtonMail includes Google Recaptcha for login</title><url>https://github.com/ProtonMail/WebClient/issues/242</url></story>