Hacker News Reader

Comment by cookiengineer | Hacker News Reader

> A visitor from TOR is extraordinarily more likely to be abusive. It makes total sense to put up extra barriers, which is still short of blocking TOR users altogether, which is also fair for webmasters who don't want to deal with it.

And why is that again? I want to understand that argument.

In case of DDoS scenario: Well, too late, traffic already served and server already done the workload.

In case of password brute forcing: Well, then implement a latency, or cryptographical challenge to delay it more efficiently.

In case of "evil" human: Well, if a human can get past your security so easily, then your approach to security through obfuscation might be wrong.

So, again, what is the scenario where a captcha helps you to avoid being "attacked" by malicious actors?

View on HN

What about the case of someone signing up for thousands of accounts?

> What about the case of someone signing up for thousands of accounts?

My question is related to the specific /login page, not the registration page.

I understand the benefit for blocking spammer signups, but not for the current case of the login page where users have an account already, were verified that the account/password was correct (captcha appears in second step), and then have to enter a second decryption password manually.

In that scenario there's no argument on the "WHY" a captcha helps. It simply doesn't.

It increases the cost of credential stuffing attack, which is very common nowadays.

Why would that be a problem on surface? You have thousands of users, why do they need to be unique identities?

The only reason I can think of is because they want more unique identities. More unique people means a greater chance for a purchase. More mail accounts just cost more.

The entire business model of free accounts requires someone paying for something extra. By unique identifying people they can limit new accounts and increase their chances of an upsale.

What if they changed how they operated. Instead of looking for more unique identities why not accept multiple addresses and include an ad at the end of every free email letting the receiver know this came from protonmail. That would give a benefit for each email sent and provide more advertising and give users a reason to upsell?

My guess is having that ad after every mail would bother you (the customer) more than having your identity uncovered.

I don't think they have a problem with a user creating two or three accounts. It's a problem if someone creates thousands of email accounts to send spam with.

The mindset is basically: Programming is hard so we're going to block as many non-paying customers as possible to limit the blast radius when we inevitably fuck up. And inconvenience those paying users too, because we can't figure out how to mitigate DoS attacks at the edge. And then we'll give a talk at a Next.js conference or something.

Reply on news.ycombinator.com