Hacker News Reader

Well, if something like this doesn't get caught down the production line, they might have bigger issues regarding security.

But I agree with you, I think I should give them a chance to respond to this. Personally, I think this is a serious issue.

I opened up a GitHub issue for their frontend (as they do not have any security disclosure contact possibility as it seems): https://github.com/ProtonMail/WebClient/issues/242

If one single person is allowed to add a privacy compromising service to one of the most important pages on their website (the login page) then there are deep, fundamental flaws in the organization that brings into question the security of the entire platform.

They use UserVoice for voting on issues (not sure if anyone ever looks at it). Here's one for recaptcha, and it's one of the most voted on tickets: https://protonmail.uservoice.com/forums/284483-protonmail/su...

They could have also just opted for hCaptcha, which is both much more private and doesn't excessively punish people who reduce their fingerprint.