thanks for making something that has capacity to break google recaptcha v3.
hCaptcha now runs on fifteen percent of the internet
71–80 of 380 posts
Re: hCaptcha now runs on fifteen percent of the internet
#72I think it's great. So many sites sit behind Cloudflare now and Cloudflare now uses hCaptcha, which is a big win. And the hCaptchas themselves are easy to complete. No more wondering if you actually clicked on 'all' the traffic lights anymore, yay! I inspected the source code of Google's reCaptcha offering and was disgusted at how many bits of information they were collecting. They also seem to be fingerprinting user…
> Google's reCaptcha code seemed to be very keen on knowing my 'cadence' or the way I used my mouse and how quickly (or how slow) I completed the captcha. It also looked at things like timezone, screen resolution, battery charge level etc So they could determine if it was 'you' who was using the captcha, soon after, in a separate session (even on a different device!) I'd bet a good amount that they store that along w…
Just looked on Takeout and there don't seem to be any reCAPTCHA data there. I wonder what a GDPR request would produce.
Re: hCaptcha now runs on fifteen percent of the internet
#73This sounds kinda nitpicky but I think it's an important distinction. We're talking about the web, not the internet, right? Or is hcaptcha also used for iOS apps, Android apps, etc.?
That distinction is already blurred beyond recognition. There's nothing that makes a phone app more or less "web" than a SPA, for example.
The distinction between iOS apps built in Swift and distributed on App Store (for example) and a website built in JS/HTML/CSS and distributed via the web's decentralized architecture is pretty clear IMO. Case in point I don't see hCaptcha/reCAPTCHA on iOS apps as frequently as I do on websites. The way I was taught in my elementary networking class was: the web is an application of the internet. The internet as a concept is much broader than the web.
Re: hCaptcha now runs on fifteen percent of the internet
#74How is hCaptcha for page performance? Google Recaptcha ruins your page speed rankings as it ideally has to load chunk of JavaScript on all pages on page load to continually monitor user behaviour. You could e.g. only load it when someone starts filling out a form but this kind of integration isn't standard.
You only put hCaptcha / BotStop where you actually need the protection, and it certainly doesn't follow your users around unnecessarily
Re: hCaptcha now runs on fifteen percent of the internet
#75Curious what people think about hCaptcha?
I don't like it because Buster doesn't work on it. Also since only cloudflare uses it, and I dislike cloudflare, I have this irrational hatred of it.
>because Buster doesn't work on it
Assuming you mean Debian Buster: Then get a newer Firefox version from backports. This is more related to Firefox ESR than Buster.
Edit: Nevermind... After reading other replies, I think eznzt referred to https://github.com/dessant/buster
Re: hCaptcha now runs on fifteen percent of the internet
#76I dislike the widespread use of captcha regardless of provider. I realize anything connected to the internet will be subject to automated abuse, and it's impossible to run some types of services without taking some steps to defend against it, but it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time. The exact details will vary based on the type of service, of c…
There's a good reason for what you're identifying as misuse.
If you show a captcha after a failed password, you need to show a one after a correct password as well. Otherwise you leak information. You can have other solutions, e.g. in a login flow that splits the username and password entry, it's advantageous to put the captcha between those two steps. But even in those solutions the display of the captcha must be independent of password correctness.
Re: hCaptcha now runs on fifteen percent of the internet
#77Earlier quoted context omitted.
> Google's reCaptcha code seemed to be very keen on knowing my 'cadence' or the way I used my mouse and how quickly (or how slow) I completed the captcha. It also looked at things like timezone, screen resolution, battery charge level etc So they could determine if it was 'you' who was using the captcha, soon after, in a separate session (even on a different device!) I'd bet a good amount that they store that along w…
Just looked on Takeout and there don't seem to be any reCAPTCHA data there. I wonder what a GDPR request would produce.
That is an investigative blog post I would like to read too.
Re: hCaptcha now runs on fifteen percent of the internet
#78Earlier quoted context omitted.
reCaptcha has also gotten increasingly annoying lately. I forgot my password to one site and tried about 2 or 3 different passwords and in-between each it asked me to do about 7 or 8 of those labelling exercises. I finally just gave up and left the site. Not only that, but the labelling exercises weren't clear. It wanted me to label a "公交車" which means more like a public city bus and there were also school buses whic…
Recently Google's captcha asked me to mark all the traffic meters on the photos, and amongst the choices was a photo of a mailbox. It didn't let me through until I marked it as a meter as well. Good luck to whatever self driving car they are training using this data.
I would venture that the repeated attempts from multiple users to not mark the mailbox will help with that.
Re: hCaptcha now runs on fifteen percent of the internet
#79Almost all of the users that Cloudflare shows captchas to are Tor users. Is there any reason why this couldn’t be done without Javascript?
Re: hCaptcha now runs on fifteen percent of the internet
#80I think it's great. So many sites sit behind Cloudflare now and Cloudflare now uses hCaptcha, which is a big win. And the hCaptchas themselves are easy to complete. No more wondering if you actually clicked on 'all' the traffic lights anymore, yay! I inspected the source code of Google's reCaptcha offering and was disgusted at how many bits of information they were collecting. They also seem to be fingerprinting user…
> Google's reCaptcha code seemed to be very keen on knowing my 'cadence' or the way I used my mouse and how quickly (or how slow) I completed the captcha. It also looked at things like timezone, screen resolution, battery charge level etc So they could determine if it was 'you' who was using the captcha, soon after, in a separate session (even on a different device!) I'd bet a good amount that they store that along w…
> which is basically why after a single reCAPTCHA solve, you wont see them prompt you again for ages - they know who you are.
If only. If the same site has reCaptcha across more than one page, within mere minutes of having to slog through multiple screens of one, I can guarantee I'll be doing it again.
And I'm never sure if Google has served me either a very long sequence of reCaptchas, or whether they've decided I'm not a person and are serving me an infinite reCaptcha.