Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Do we need Google captcha?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 81 posts

Re: Ask HN: Do we need Google captcha?

#61

Post by NetToolKit »

alucardo wrote: post #58
NetToolKit wrote: post #3

To the extent that you'd consider non-Google alternatives, there are multiple different CAPTCHA services, and we at NetToolKit recently launched our own version called Shibboleth: https://www.nettoolkit.com/shibboleth/about You can try out demos at https://www.nettoolkit.com/shibboleth/demo While not open-source, the service is very affordable ($10 for 100,000 CAPTCHAs), and clients get to review user submissions to…

You should add arrow key mapping, so we can beat the captcha with the keyboard. Using the mouse is tiedous.

Yes, thanks for that feedback. We actually do have support for arrow keys, but you have to first click the path to focus on it (made similar comment at: https://news.ycombinator.com/item?id=21327738)

Re: Ask HN: Do we need Google captcha?

#62

Post by NetToolKit »

extra88 wrote: post #26
NetToolKit wrote: post #3

To the extent that you'd consider non-Google alternatives, there are multiple different CAPTCHA services, and we at NetToolKit recently launched our own version called Shibboleth: https://www.nettoolkit.com/shibboleth/about You can try out demos at https://www.nettoolkit.com/shibboleth/demo While not open-source, the service is very affordable ($10 for 100,000 CAPTCHAs), and clients get to review user submissions to…

I understand why you'd call it that but won't it be confused for Shibboleth, the single sign-on log-in system? https://en.wikipedia.org/wiki/Shibboleth_(Shibboleth_Consort...

Maybe. I'm hoping that single sign-on and CAPTCHA are sufficiently different that people won't get confused. Also, the dev team behind this didn't want a generic name, and there are enough products/services out there that name collisions are pretty easy to encounter, unless wholly making up a name (which might then require more explanation).

Re: Ask HN: Do we need Google captcha?

#63

Post by dang »

Scarbutt wrote: post #38
maxwellito wrote: post #25

From a user point of view on Firefox, Google captcha is a an absolute hell. Every single time I have to pass few batches of captchas. I'm not on a private window and I'm logged in to Google. So I started to blacklist websites that use Google captcha. and forced myself to change reading habits.

I have been prompt by google captcha many times here by the HN login.

We turn that on when HN is under certain kinds of attack: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

If you're experiencing it over a long period of time, it might be good to email hn@ycombinator.com. I don't think that should be happening.

Re: Ask HN: Do we need Google captcha?

#64

Post by chrismorgan »

globile wrote: post #22

Honest question. What’s wrong with Google Recaptcha V3? No need to select 25 traffic lights. Gives you a score from 0 to 1 so you can decide whether you let them in easily or not.

reCAPTCHA v3 will actively block many genuine users with no recourse, in a way that is incompatible with various accessibility and disability legislation. In the US I believe it’d be illegal for any businesses to gate functionality on reCAPTCHA v3 failure alone, and in AU it would be for a government site but I’m not certain for businesses.

reCAPTCHA v2 kinda had this problem, but Google could scrape by because it wasn’t obvious that some users were being flat-out blocked, though it does seem to be the case.

In reCAPTCHA v3, Google get around that problem by putting the burden of supporting some alternative for such denied users onto you, rather than on them—so they recommend things like falling back to sending an SMS code to validate such users. (Given how they position the product, this is basically just a disclaimer of liability—“we told you to do something extra! (though not very hard)”. I have no idea how legally effective that approach is, but that’s what they’re going for.)

That’s how we do at Fastmail for signup (which is a substantial fraud target): we use reCAPTCHA v3 if we can (and only on the signup page, I may add), but if it won’t load or if it flunks the user, then we fall back to requiring SMS verification, so that real people should still be able to sign up.

So that’s the major problem with reCAPTCHA v3: you can’t, or at least shouldn’t, use it by itself.

Re: Ask HN: Do we need Google captcha?

#65

Post by alexnewman »

Kaveren wrote: post #11
luizfzs wrote: post #2

It's worse than that. It fingerprints the browser, the OS, and a ton of other stuff. I'd love to see a solution that's privacy-friendly.

not possible because anything based off computation only wards off denial of service attacks, not bots which usually have too much profit. the absolute best you could do is track on the site itself without google, but you still need to track user's data. anything else you can think of can be beaten pretty easily or is going to really hurt your user experience to the point of severe loss of revenue any CAPTCHA custom…

The way you should think about captcha is how much does it raise the cost to bot. You can always just pay people to click to bypass

Re: Ask HN: Do we need Google captcha?

#66

Post by johnisgood »

inetknght wrote: post #37
eyegor wrote: post #19

Earlier quoted context omitted.

That's what they show if you're not on chrome, especially if you're blocking scripts or on a VPN.

In my experience it doesn't work at all if you're blocking scripts.

It does not work under Chromium either with cookies disabled either.

Re: Ask HN: Do we need Google captcha?

#67

Post by Master_Odin »

jmstfv wrote: post #54
fractalf wrote: post #46

Earlier quoted context omitted.

THIS is what I'm talking about :) Great work! Seems to me this is very centered on Rails apps. Would it be possible to do somethink like this for "everyone"? I have nothing agains Rails, but as a js/php/python develper myself, I wouldn't know where to begin with this..

The easiest way to start would be introducing an invisible form field [0] and on submission, checking if it is not empty. Give this form field a random name so that it wouldn't be populated by password managers. You can take it one step further and check how fast the form was submitted. If it is below the predefined threshold, it is probably a bot. [0] To hide the form field, you can use one of these snippets, interc…

It should be stated that you should either use the first approach (display none) or give a 0 height/width, so that screen readers don't pick up these fake fields and ruin accessibility on your form.

Re: Ask HN: Do we need Google captcha?

#68

Post by brokensegue »

NetToolKit wrote: post #39
brokensegue wrote: post #24

Earlier quoted context omitted.

This maze captcha looks trivial to defeat

I understand why it might seem that way. I personally don't think it would be trivial to wire up a working solution (including generating the correct solution strings); if you do, I certainly would welcome you to post your solution.

I estimate maybe 3 hours of effort. Will you pay me for my time upon completion ($100/hr)? If so I'll do it

Re: Ask HN: Do we need Google captcha?

#69

Post by throwaway_bad »

Master_Odin wrote: post #67
jmstfv wrote: post #54

Earlier quoted context omitted.

The easiest way to start would be introducing an invisible form field [0] and on submission, checking if it is not empty. Give this form field a random name so that it wouldn't be populated by password managers. You can take it one step further and check how fast the form was submitted. If it is below the predefined threshold, it is probably a bot. [0] To hide the form field, you can use one of these snippets, interc…

It should be stated that you should either use the first approach (display none) or give a 0 height/width, so that screen readers don't pick up these fake fields and ruin accessibility on your form.

Unfortunately anything screen readers can recognize as invisible, a more sophisticated bot can too.

Re: Ask HN: Do we need Google captcha?

#70

Post by brokensegue »

NetToolKit wrote: post #39
brokensegue wrote: post #24

Earlier quoted context omitted.

This maze captcha looks trivial to defeat

I understand why it might seem that way. I personally don't think it would be trivial to wire up a working solution (including generating the correct solution strings); if you do, I certainly would welcome you to post your solution.

if 3 hours is too much I'll crack the naval command captcha for 1 hour of work.
Post reply on HN