Hcaptcha will soon be open source.
Ask HN: Do we need Google captcha?
21–30 of 81 posts
Re: Ask HN: Do we need Google captcha?
#22Honest question. What’s wrong with Google Recaptcha V3?
No need to select 25 traffic lights. Gives you a score from 0 to 1 so you can decide whether you let them in easily or not.
Re: Ask HN: Do we need Google captcha?
#23It's worse than that. It fingerprints the browser, the OS, and a ton of other stuff. I'd love to see a solution that's privacy-friendly.
not possible because anything based off computation only wards off denial of service attacks, not bots which usually have too much profit. the absolute best you could do is track on the site itself without google, but you still need to track user's data. anything else you can think of can be beaten pretty easily or is going to really hurt your user experience to the point of severe loss of revenue any CAPTCHA custom…
> any CAPTCHA custom to a site will be broken very easily if your business takes off.
For me, this is an interesting and open question. I've taken the view that as long as it's easier to come up with new types of challenges than it is to create an automated means to solve those challenges, CAPTCHAs offer some protection. If you're ok with requiring JavaScript, mouse input, and images (e.g. you don't require your site to be accessible by sight-impaired users who cannot use a mouse), I think people can come up with varied enough challenges to present a problem to bots. How long will that be the case? I don't know.
Re: Ask HN: Do we need Google captcha?
#24To the extent that you'd consider non-Google alternatives, there are multiple different CAPTCHA services, and we at NetToolKit recently launched our own version called Shibboleth: https://www.nettoolkit.com/shibboleth/about You can try out demos at https://www.nettoolkit.com/shibboleth/demo While not open-source, the service is very affordable ($10 for 100,000 CAPTCHAs), and clients get to review user submissions to…
This maze captcha looks trivial to defeat
Re: Ask HN: Do we need Google captcha?
#25From a user point of view on Firefox, Google captcha is a an absolute hell.
Every single time I have to pass few batches of captchas. I'm not on a private window and I'm logged in to Google. So I started to blacklist websites that use Google captcha. and forced myself to change reading habits.
Re: Ask HN: Do we need Google captcha?
#26To the extent that you'd consider non-Google alternatives, there are multiple different CAPTCHA services, and we at NetToolKit recently launched our own version called Shibboleth: https://www.nettoolkit.com/shibboleth/about You can try out demos at https://www.nettoolkit.com/shibboleth/demo While not open-source, the service is very affordable ($10 for 100,000 CAPTCHAs), and clients get to review user submissions to…
I understand why you'd call it that but won't it be confused for Shibboleth, the single sign-on log-in system?
https://en.wikipedia.org/wiki/Shibboleth_(Shibboleth_Consort...
Re: Ask HN: Do we need Google captcha?
#27Honest question. What’s wrong with Google Recaptcha V3? No need to select 25 traffic lights. Gives you a score from 0 to 1 so you can decide whether you let them in easily or not.
If Google doesn't like a client (e.g. Firefox users) they can just set their score to 0 and break half the internet.
Re: Ask HN: Do we need Google captcha?
#28Over the past 2 years or so I've become incredibly skilled at identifying crosswalks, fire hydrants, traffic lights, and bicycles. I don't necessarily mind contributing to googles car-driving AI, but the services that I've put this captcha infront of have seen a dramatic increase in spam. I unfortunately don't know what the solution to this problem is but I would gladly contribute to whatever someone smarter than me…
>identifying crosswalks, fire hydrants, traffic lights, and bicycles.
I don't necessarily mind contributing to googles car-driving AI
Wow. I just realized that's exactly what they must be doing with the data!
Re: Ask HN: Do we need Google captcha?
#29Earlier quoted context omitted.
not possible because anything based off computation only wards off denial of service attacks, not bots which usually have too much profit. the absolute best you could do is track on the site itself without google, but you still need to track user's data. anything else you can think of can be beaten pretty easily or is going to really hurt your user experience to the point of severe loss of revenue any CAPTCHA custom…
> any CAPTCHA custom to a site will be broken very easily if your business takes off. For me, this is an interesting and open question. I've taken the view that as long as it's easier to come up with new types of challenges than it is to create an automated means to solve those challenges, CAPTCHAs offer some protection. If you're ok with requiring JavaScript, mouse input, and images (e.g. you don't require your site…
The problem is coming up with challenges that are not trivial to automate and not annoyingly hard for users.
Botters aren't just making passive income, they can fix their bot every day as long as it's making them money. Many sites try "random" questions which are really easy to pattern match with a little regex.
The amount of effort that goes into botting generally scales linearly with userbase size (not always). But once you're talking about a botter with a profit motive when your site has hundreds of thousands or millions of MAU, I think trying to come up with challenges to beat botters would be prohibitively time consuming.
Re: Ask HN: Do we need Google captcha?
#30Two weeks ago my website [0] got hit by a botnet attack. These bots were submitting 2 POST requests to /login, followed by 2 POST requests to /signup, and since there were no checks in place, they were getting in quite easily. All their requests originated from residential IP addresses (probably hacked IoT devices) so IP blocking seemed impossible. I knew I needed to do something, but didn't want to send my users' da…
Very interesting idea (the invisible captcha approach)! Since you are a contributer, can you tell us how efficient this strategy is? I mean, do you still experience advanced bots being able to still act as humans?