131–140 of 380 posts
Captcha is a terrible 90s technology, it should have been completely destroyed in year 2000. it's really annoying.
Don't worry, the next iteration of CAPTCHAs will rely heavily on browser feature detection, ensuring that you're not using an unauthorized version of Chrome that can be automated. Only authorized and trusted browsers will pass the tests.
Earlier quoted context omitted.
The distinction between iOS apps built in Swift and distributed on App Store (for example) and a website built in JS/HTML/CSS and distributed via the web's decentralized architecture is pretty clear IMO. Case in point I don't see hCaptcha/reCAPTCHA on iOS apps as frequently as I do on websites. The way I was taught in my elementary networking class was: the web is an application of the internet. The internet as a con…
"The web's decentralized architecture" isn't a thing. There are clients and servers and communication protocols, that's it. There are plenty of web apps distributed from custom stores. And the web doesn't mandate using JS/HTML/CSS. A client (whether browser, CLI, phone app, bot or anything else) making resource requests identified by a URL to an HTTP server is as "web" as it gets. The reason you see fewer capchas on…
> The Internet carries a vast range of information resources and services, such as the inter-linked hypertext documents and applications of the World Wide Web (WWW), electronic mail, telephony, and file sharing.
Edit: but to be fair I totally brought this semantics debate upon myself by raising the question of the difference between the web and the internet. Not sure why I took on a whiny tone about that, haha
Earlier quoted context omitted.
Dislike it, to say the least. Since it doesn't seems to remember that I'm a human (reCpatcha did), now I have to constantly solve captchas on CF sites.
With hCaptcha (enterprise ver) this is entirely under the control of the customer. We're not "remembering" in the same way, but have good enough instantaneous scoring to correctly guess whether or not a challenge is required most of the time. Some customers may disable that option to meet their requirements. Not much we can do about that :)
Captcha is a terrible 90s technology, it should have been completely destroyed in year 2000. it's really annoying.
If it should have been destroyed what is the reason you think it hasn't been? People aren't adding captchas to websites for fun, it is clearly solving a problem for them. So what do you propose instead?
Or introduce a law where they have to pay us for using up our 'brain time'.
Earlier quoted context omitted.
> If you show a captcha after a failed password, you need to show a one after a correct password as well. Otherwise you leak information. Presumably, if the person has entered the right username and password they're going to get access to the service at which point they'll know they entered the right one. What information exactly is leaked here?
The reason you'd want a captcha on a login page is to protect against brute-forcing of some sort. For example credential stuffing or a dictionary attack. The information the attacker is looking for is the validity of the password. If you want to use a captcha to protect against this, the outcome must be the same whether the password is valid or not. Because if you only show the captcha for failed logins, the attacker…
You don't captcha the success path because you don't need it. You captcha the pre-login flow once you have a failed attempt. It's a trip switch that is a prelude to the flow.
I dislike the widespread use of captcha regardless of provider. I realize anything connected to the internet will be subject to automated abuse, and it's impossible to run some types of services without taking some steps to defend against it, but it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time. The exact details will vary based on the type of service, of c…
With our hCaptcha Enterprise product ( https://www.botstop.com ), showing a CAPTCHA actually only happens in rare cases (relatively speaking..) - vast majority of bots are caught and stopped in the background (using ML), and most users will never see one.
Earlier quoted context omitted.
I've had hCaptcha recheck me repeatedly and fail to work at all on VPN. I much prefer ebay's simple slide the puzzle piece method.
That's annoying. Have you tried using their accessibility feature? https://www.hcaptcha.com/accessibility
Earlier quoted context omitted.
Forget adding more draconian identity requirements. 95% of CAPTCHA use is simply unnecessary and could be straightforwardly removed or replaced with rate limiting login attempts per IP. Never mind sites that use it to prevent scraping. If serving static pages is that much of a burden that you want to discourage automated means of retrieving information that you're trying to publish, then work on your website performa…
> could be straightforwardly removed or replaced with rate limiting login attempts per IP This is very outdated intuition. Fresh IP addresses cost peanuts. For example, your solution still allows an attacker to run a 50k item /login combolist against one of your users with $5 of botnet time, each IP address trying a single uname/pass combo. Here you pay $18/GB to multiplex your abuse (cred stuffing being classic non-…
I think it's great. So many sites sit behind Cloudflare now and Cloudflare now uses hCaptcha, which is a big win. And the hCaptchas themselves are easy to complete. No more wondering if you actually clicked on 'all' the traffic lights anymore, yay! I inspected the source code of Google's reCaptcha offering and was disgusted at how many bits of information they were collecting. They also seem to be fingerprinting user…
I don't understand why anyone likes hCaptcha. With reCaptcha, I rarely got more than the checkbox. Now I get a series of puzzles every time I want to look at a web page. When that happens, I'm just closing out, and going to a better website.
Because many of us get the same puzzles over and over with reCaptcha, and often get sent into the infinite puzzles zone despite being both a human and answering correctly. The assumptions built in to reCaptcha just aren't good. There are people that don't accept cookies for anything, but who aren't bots. There are real humans using text-only browsers. There are people who's mouse and keyboard events fall far outside…
Naturally if I was logged into my google account I wouldn't have much of an issue, because I would be feeding the surveillance machine.