Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

hCaptcha now runs on fifteen percent of the internet

hcaptcha.com

Post reply on HN
Print view View original

81–90 of 380 posts

Re: hCaptcha now runs on fifteen percent of the internet

#81

Post by disgrunt »

eatbots wrote: post #59
disgrunt wrote: post #39

Earlier quoted context omitted.

Your CAPTCHA accessibility leaves much to be desired. You require screen reader users to register an account to create a magic cookie that itself requires Safari users to disable security protections in their browser in order to use -- and then it doesn't actually work. Please do better. You're blocking off a non-trivial amount of the Internet to blind users. You will eventually be sued for this.

We actually spend quite a lot of time on this, and regularly work with blind users to test and improve these flows. Most vision-impaired users have no issue in our testing, and it is a much more accessible option than audio challenges, which discriminate against those with auditory processing impairments. (disclosure: work there.)

Your cookie approach requires:

> If you are using the very latest version of Safari on either the recently released OS X 10.15 or iOS 13.4, Apple has just changed the behavior of Safari related to third-party cookies, blocking all of them by default. We are implementing a solution, but in the meantime please visit Safari Preferences, Privacy section, and uncheck "Website tracking: Prevent cross-site tracking" to enable the accessibility cookie to function as expected. [0]

[0]: https://www.hcaptcha.com/accessibility

So while you're patting yourself on the back for not "being like Google", your accessibility workaround exposes blind users to third party trackers like Google.

Re: hCaptcha now runs on fifteen percent of the internet

#82

Post by fab1an »

trianglem wrote: post #66
xapata wrote: post #53

hCaptcha makes money by having humans label things to teach machines. This suggests that at some point, the machines will be nearly as good as the humans at labeling. At this point, until the humans are tasked with a different training exercise, a bot will be effectively indistinguishable from a human via hCaptcha. If there's value in it, it sounds like a spammer could train an hCaptcha-defeating bot via hCaptcha.

Wait they actually use the labeling for something other than admittance? Well that takes care of my concern about this tech then, gotta go back and change some of my other comments...

Google uses reCAPTCHA labels exclusively for themselves, and is extracting hundreds of free person years of labor from internet users every single day via this. hCaptcha lets anyone access this type of service, provided they follow certain ethical AI guidelines

Re: hCaptcha now runs on fifteen percent of the internet

#83

Post by alexnewman »

tuckerconnelly wrote: post #51

As someone who scrapes, captcha's are pretty silly. One of the sites we scrape implemented hCaptcha, and it was a breeze to get around. There are a few things that make my life more difficult, but captchas aren't one of them, and nothing can stop scraping altogether.

How'd you do it?

Re: hCaptcha now runs on fifteen percent of the internet

#84

Post by Kalium »

Zak wrote: post #48

I dislike the widespread use of captcha regardless of provider. I realize anything connected to the internet will be subject to automated abuse, and it's impossible to run some types of services without taking some steps to defend against it, but it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time. The exact details will vary based on the type of service, of c…

For a lot of people, they want to run a service and not have to spend a significant amount of time and energy investing in anti-abuse. In general anti-abuse work is not nearly as useful as product work, a day off, or a variety of other things.

I agree, there should be better ways to do anti-abuse. Yet I find myself coming up empty when I try to find better options for the common scenario where people would really rather invest deeply in their service than in anti-abuse.

I would love to hear some ideas about how to solve this nasty general problem while also respecting user time and privacy. Unfortunately, I've found that entirely too often the vague sense that there must be a better way fails to translate into substantive better way.

Re: hCaptcha now runs on fifteen percent of the internet

#87

Post by chrismorgan »

rootusrootus wrote: post #69

I'm really starting to hate all the captchas with a burning passion. Partly because the corporation I work for seems to have gotten our NAT addresses onto a blacklist so I get captcha'd constantly , and partly because my close up vision is getting noticeably weaker (pushing 50, that's why) and without hunting down my reading glasses it can be difficult to make out the smaller details necessary to solve the puzzle. Es…

Similar deal where I am at present in India: the small ISP uses carrier-grade NAT, so there’s malware and related activity occurring every day from at least one of the who-knows-how-many people behind this one IP address. Last time I was here in 2016 it was actually a lot worse than it is now (then, any Cloudflare site would trigger it, so I’d be hitting dozens of challenges per day), but I still get the occasional hCaptcha here (e.g. the Audacity wiki), and they’re awful. I normally take two or three attempts (quite apart from the regular times when you finish the challenge and press submit, and it just does nothing), guessing things like whether they want to count this particular dark smudge as a motorcycle or not, or whether this fragment of a motorcycle should count or not.

I wish people would just face up to the reality that challenge-based CAPTHCA techniques have failed, and stop using them.

Re: hCaptcha now runs on fifteen percent of the internet

#88

Post by paxys »

kaycebasques wrote: post #73
paxys wrote: post #31

Earlier quoted context omitted.

That distinction is already blurred beyond recognition. There's nothing that makes a phone app more or less "web" than a SPA, for example.

The distinction between iOS apps built in Swift and distributed on App Store (for example) and a website built in JS/HTML/CSS and distributed via the web's decentralized architecture is pretty clear IMO. Case in point I don't see hCaptcha/reCAPTCHA on iOS apps as frequently as I do on websites. The way I was taught in my elementary networking class was: the web is an application of the internet. The internet as a con…

"The web's decentralized architecture" isn't a thing. There are clients and servers and communication protocols, that's it. There are plenty of web apps distributed from custom stores. And the web doesn't mandate using JS/HTML/CSS.

A client (whether browser, CLI, phone app, bot or anything else) making resource requests identified by a URL to an HTTP server is as "web" as it gets.

The reason you see fewer capchas on iOS and Android is that it is a lot harder to automate them for spam, that's all.

Re: hCaptcha now runs on fifteen percent of the internet

#89

Post by aleph1 »

jsnell wrote: post #76
Zak wrote: post #48

I dislike the widespread use of captcha regardless of provider. I realize anything connected to the internet will be subject to automated abuse, and it's impossible to run some types of services without taking some steps to defend against it, but it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time. The exact details will vary based on the type of service, of c…

There's a good reason for what you're identifying as misuse. If you show a captcha after a failed password, you need to show a one after a correct password as well. Otherwise you leak information. You can have other solutions, e.g. in a login flow that splits the username and password entry, it's advantageous to put the captcha between those two steps. But even in those solutions the display of the captcha must be in…

That's not what's happening:

> An incorrect login says so without presenting a captcha.

Re: hCaptcha now runs on fifteen percent of the internet

#90

Post by jsnell »

fab1an wrote: post #82
trianglem wrote: post #66

Earlier quoted context omitted.

Wait they actually use the labeling for something other than admittance? Well that takes care of my concern about this tech then, gotta go back and change some of my other comments...

Google uses reCAPTCHA labels exclusively for themselves, and is extracting hundreds of free person years of labor from internet users every single day via this. hCaptcha lets anyone access this type of service, provided they follow certain ethical AI guidelines

How long has the content of the recaptcha puzzles been entirely unchanged, despite being shown to billions of users? Like five years? It should be painfully obvious that there is no actual labeling going on at this point, they have all the training data they'll ever need for traffic lights...

And by a corollary, since they haven't started labeling different kind of data, it's clear that either they no longer need any kind of labels at all, or this is actually not a cost-effective way of doing it.

Post reply on HN