hCaptcha now runs on fifteen percent of the internet • Hacker News Board

Re: hCaptcha now runs on fifteen percent of the internet

#91

Post by jsnell » Wed, Nov 25, 2020, 8:21 PM UTC

aleph1 wrote: post #89

jsnell wrote: post #76

Earlier quoted context omitted.

There's a good reason for what you're identifying as misuse. If you show a captcha after a failed password, you need to show a one after a correct password as well. Otherwise you leak information. You can have other solutions, e.g. in a login flow that splits the username and password entry, it's advantageous to put the captcha between those two steps. But even in those solutions the display of the captcha must be in…

That's not what's happening: > An incorrect login says so without presenting a captcha.

Thanks, I misread. Then that indeed makes no sense!

Re: hCaptcha now runs on fifteen percent of the internet

#92

Post by mindslight » Wed, Nov 25, 2020, 8:22 PM UTC

hombre_fatal wrote: post #68

mindslight wrote: post #36

Earlier quoted context omitted.

Forget adding more draconian identity requirements. 95% of CAPTCHA use is simply unnecessary and could be straightforwardly removed or replaced with rate limiting login attempts per IP. Never mind sites that use it to prevent scraping. If serving static pages is that much of a burden that you want to discourage automated means of retrieving information that you're trying to publish, then work on your website performa…

> could be straightforwardly removed or replaced with rate limiting login attempts per IP This is very outdated intuition. Fresh IP addresses cost peanuts. For example, your solution still allows an attacker to run a 50k item /login combolist against one of your users with $5 of botnet time, each IP address trying a single uname/pass combo. Here you pay $18/GB to multiplex your abuse (cred stuffing being classic non-…

50k attempts is tiny, like a 3 character password or a single account run through /usr/share/dict/words.

If you're worried about password with between other sites that have leaked, then the real answer is to generate something like a username for each user that they won't be able to share between sites. In fact with the prevalence of password managers, generating users' passwords for them might just be the better approach these days. And just fall back to email auth every time if they don't want to store it.

Duct taping your broken system by throwing up an annoyance for every user who doesn't want to be tracked is not the way.

Re: hCaptcha now runs on fifteen percent of the internet

#93

Post by hombre_fatal » Wed, Nov 25, 2020, 8:23 PM UTC

tuckerconnelly wrote: post #51

As someone who scrapes, captcha's are pretty silly. One of the sites we scrape implemented hCaptcha, and it was a breeze to get around. There are a few things that make my life more difficult, but captchas aren't one of them, and nothing can stop scraping altogether.

Meh, there's always going to be a longtail of targeted abuse so it's not much to boast over. Xrumer software in 2001 could even let you sit at your computer and fill out those common PHP-lib captchas (like on EZBoard) while Xrumer spammed internet forums and blogs. You could even hire a cubicle farm of humans to manually abuse a web service.

Captchas filter out the 90% bulk of automated abuse.

Btw, web scraping is on the nearly harmless side of abuse.

Re: hCaptcha now runs on fifteen percent of the internet

#94

Post by aftbit » Wed, Nov 25, 2020, 8:24 PM UTC

jsnell wrote: post #76

Zak wrote: post #48

I dislike the widespread use of captcha regardless of provider. I realize anything connected to the internet will be subject to automated abuse, and it's impossible to run some types of services without taking some steps to defend against it, but it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time. The exact details will vary based on the type of service, of c…

There's a good reason for what you're identifying as misuse. If you show a captcha after a failed password, you need to show a one after a correct password as well. Otherwise you leak information. You can have other solutions, e.g. in a login flow that splits the username and password entry, it's advantageous to put the captcha between those two steps. But even in those solutions the display of the captcha must be in…

There's a lot of arguments against captchas, but I do not agree with this one. You will always leak whether or not a password is correct based on how your app behaves - a correct password will grant entry to the application. If you only ask for a captcha when a user account exists but fail to ask if they use a made up username, that's an information leak.

Re: hCaptcha now runs on fifteen percent of the internet

#95

Post by kevincox » Wed, Nov 25, 2020, 8:24 PM UTC

koreanguy wrote: post #85

Captcha is a terrible 90s technology, it should have been completely destroyed in year 2000. it's really annoying.

If it should have been destroyed what is the reason you think it hasn't been? People aren't adding captchas to websites for fun, it is clearly solving a problem for them. So what do you propose instead?

Re: hCaptcha now runs on fifteen percent of the internet

#96

Post by svacko » Wed, Nov 25, 2020, 8:24 PM UTC

I see the product is offered in 2 plans, though the only paid plan is enterprise without publicly disclosed pricing. Anyone has info whether it's affordable also for small and bootstrapped businesses or it's primarily focusing on larger enterprises?

Re: hCaptcha now runs on fifteen percent of the internet

#97

Post by fab1an » Wed, Nov 25, 2020, 8:25 PM UTC

drngdds wrote: post #62

Is hCaptcha less of a pain for users who block tracking (with Brave, Privacy Badger, uBlock Origin, etc) than reCaptcha is? I'm not sure I've ever solved an hCaptcha, but I find reCaptchas to routinely be incredibly time-consuming, and I suspect it's because I block their trackers.

Google reCaptcha likely discriminates against non Chrome users, hCaptcha does not. Also, we support and co-develop https://www.hcaptcha.com/privacy-pass !

Re: hCaptcha now runs on fifteen percent of the internet

#98

Post by aftbit » Wed, Nov 25, 2020, 8:25 PM UTC

fab1an wrote: post #61

judge2020 wrote: post #57

Earlier quoted context omitted.

> We use it in invisible mode and it does a great job at finding bots while getting out of users' way. Interesting didn't realize this was a thing hcaptcha did[0]. It's basically recaptcha in terms of tracking which sites you visit then, no? 0: https://docs.hcaptcha.com/invisible

I think parent means hCaptcha enterprise in passive mode, where hCaptcha is detecting bots in the background using ML: botstop.com

Surely this ML must be presented a wide set of data on the user and their browser to make this determination? So just like recaptcha, they determine if they should admit you based on passively snooped data rather than active challenges.

Re: hCaptcha now runs on fifteen percent of the internet

#99

Post by mindslight » Wed, Nov 25, 2020, 8:26 PM UTC

shakna wrote: post #80

gaieges wrote: post #42

Earlier quoted context omitted.

> Google's reCaptcha code seemed to be very keen on knowing my 'cadence' or the way I used my mouse and how quickly (or how slow) I completed the captcha. It also looked at things like timezone, screen resolution, battery charge level etc So they could determine if it was 'you' who was using the captcha, soon after, in a separate session (even on a different device!) I'd bet a good amount that they store that along w…

> which is basically why after a single reCAPTCHA solve, you wont see them prompt you again for ages - they know who you are. If only. If the same site has reCaptcha across more than one page, within mere minutes of having to slog through multiple screens of one, I can guarantee I'll be doing it again. And I'm never sure if Google has served me either a very long sequence of reCaptchas, or whether they've decided I'm…

I'm guessing that the comment you're responding to uses Chrome/ium, and that you don't.

Re: hCaptcha now runs on fifteen percent of the internet

#100

Post by aftbit » Wed, Nov 25, 2020, 8:27 PM UTC

eatbots wrote: post #37

QUFB wrote: post #13

Earlier quoted context omitted.

I'm not a lawyer, but can you explain how their privacy policy is privacy-conscious now and going forward, and how centralization of network transit with Cloudflare isn't a bad thing? https://www.hcaptcha.com/privacy

hCaptcha is more focused on technical solutions to privacy that minimize required trust. A privacy policy is one thing, but a mathematical guarantee is quite another. We are working through the IETF and directly with browser makers to support provably private options like Privacy Pass, and are currently the only CAPTCHA service to support this. Similarly, on the enterprise side we offer various technical options to l…

How does support for Privacy Pass interact with services that pay humans pennies per thousands of captcha solves? Wouldn't it be easy to buy a ton of these blinded tokens then have an extension that provides them on demand to the captcha service?