Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

hCaptcha now runs on fifteen percent of the internet

hcaptcha.com

Post reply on HN
Print view View original

151–160 of 380 posts

Re: hCaptcha now runs on fifteen percent of the internet

#151

Post by marcosdumay »

skellera wrote: post #110
shakna wrote: post #80

Earlier quoted context omitted.

> which is basically why after a single reCAPTCHA solve, you wont see them prompt you again for ages - they know who you are. If only. If the same site has reCaptcha across more than one page, within mere minutes of having to slog through multiple screens of one, I can guarantee I'll be doing it again. And I'm never sure if Google has served me either a very long sequence of reCaptchas, or whether they've decided I'm…

Being on a VPN, have blockers on, or not logged into google are a few things that will increase the captchas you’ll see.

Add "running Firefox" to that list.

Re: hCaptcha now runs on fifteen percent of the internet

#153

Post by BMSmnqXAE4yfe1 »

slx26 wrote: post #126
Zak wrote: post #48

I dislike the widespread use of captcha regardless of provider. I realize anything connected to the internet will be subject to automated abuse, and it's impossible to run some types of services without taking some steps to defend against it, but it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time. The exact details will vary based on the type of service, of c…

> it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time As much as I agree with your dislike of captchas, I don't think this is true at scale (unless universal online identities existed, which could and should include anonymous identifiers by design). When you need to accept information from anonymous users (comments, votes, forms, registrations), there's no way…

One such solution would be a small payment, something like 1 cent for access. That's not too much, because I am already paying 3 cents to a service solving captchas for me.

Re: hCaptcha now runs on fifteen percent of the internet

#154

Post by protoduction »

slx26 wrote: post #126
Zak wrote: post #48

I dislike the widespread use of captcha regardless of provider. I realize anything connected to the internet will be subject to automated abuse, and it's impossible to run some types of services without taking some steps to defend against it, but it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time. The exact details will vary based on the type of service, of c…

> it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time As much as I agree with your dislike of captchas, I don't think this is true at scale (unless universal online identities existed, which could and should include anonymous identifiers by design). When you need to accept information from anonymous users (comments, votes, forms, registrations), there's no way…

I built an alternative[0] that takes a proof of work approach. As a site owner you set the difficulty that makes sense for you: so perhaps you would want 20 seconds of computation before you can submit. The nice thing is that this can happen entirely in the background while the user fills in the form.

Also with multiple requests from the same IP in a short timespan, the difficulty increases.

There are downsides to to any captcha, but in my opinion make a much better tradeoff. Accessibility and privacy are respected, and there are no annoying tasks.

[0]: https://friendlycaptcha.com

Re: hCaptcha now runs on fifteen percent of the internet

#155

Post by jsnell »

renewiltord wrote: post #135
jsnell wrote: post #127

Earlier quoted context omitted.

The reason you'd want a captcha on a login page is to protect against brute-forcing of some sort. For example credential stuffing or a dictionary attack. The information the attacker is looking for is the validity of the password. If you want to use a captcha to protect against this, the outcome must be the same whether the password is valid or not. Because if you only show the captcha for failed logins, the attacker…

Usually when you Captcha on a failed attempt, you captcha every request from that IP (or other session identifier) for a period of time. Try Google Accounts for instance. They behave this way. You don't captcha the success path because you don't need it. You captcha the pre-login flow once you have a failed attempt. It's a trip switch that is a prelude to the flow.

But this entire thread is about a case where the captcha happens after password entry!

The point is that it is an entirely legit design, and kind of is the way you have to go when the username and password are entered together. As long as the captcha is shown regardless of the password validity, both the security properties and the amount of user annoyance due to having to solve unnecessary captchas is the same as if you had had to pass a captcha up front.

The example of Google Accounts is interesting, because they use split username and password entries. So there is indeed a natural point in the flow to show the captcha between the username and the password, which is what they do. But at least up to a year ago they were doing it after the password. So enter username + submit, enter password + submit, and if the login attempt was sufficiently dodgy get shown a captcha regardless of the validity of the password.

Re: hCaptcha now runs on fifteen percent of the internet

#156

Post by BMSmnqXAE4yfe1 »

fab1an wrote: post #113
Zak wrote: post #48

I dislike the widespread use of captcha regardless of provider. I realize anything connected to the internet will be subject to automated abuse, and it's impossible to run some types of services without taking some steps to defend against it, but it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time. The exact details will vary based on the type of service, of c…

With our hCaptcha Enterprise product ( https://www.botstop.com ), showing a CAPTCHA actually only happens in rare cases (relatively speaking..) - vast majority of bots are caught and stopped in the background (using ML), and most users will never see one.

I have a VPN so like ~50% of web sites present a captcha to me ... had to subscribe to a service solving captchas automatically.

Re: hCaptcha now runs on fifteen percent of the internet

#158

Post by ve55 »

aftbit wrote: post #98
fab1an wrote: post #61

Earlier quoted context omitted.

I think parent means hCaptcha enterprise in passive mode, where hCaptcha is detecting bots in the background using ML: botstop.com

Surely this ML must be presented a wide set of data on the user and their browser to make this determination? So just like recaptcha, they determine if they should admit you based on passively snooped data rather than active challenges.

My knowledge of this is that hCaptcha uses anonymized user data to ensure that the user doesn't look like a bot. What ReCAPTCHA did differently is not only not anonymizing data, but specifically trying to find out which person was presented with their captcha by matching cookies and profiles to Google accounts (which the majority of users would have and be logged into for many reasons). When you combine this with Google owning everything from Gmail to Youtube to Android to Chrome, it gets extremely pervasive.

Re: hCaptcha now runs on fifteen percent of the internet

#159

Post by BMSmnqXAE4yfe1 »

xur17 wrote: post #125
fab1an wrote: post #113

Earlier quoted context omitted.

With our hCaptcha Enterprise product ( https://www.botstop.com ), showing a CAPTCHA actually only happens in rare cases (relatively speaking..) - vast majority of bots are caught and stopped in the background (using ML), and most users will never see one.

I'm curious what how rare it is / what triggers it. In my experience, at least Google triggers hard mode if you use any sort of privacy preserving technology, etc ublock, brave, etc. It's very frustrating.

Gave up on google search because of this ... not a big loss.

Re: hCaptcha now runs on fifteen percent of the internet

#160

Post by eatbots »

judge2020 wrote: post #57
amasad wrote: post #40

We've moved to hCaptcha from reCAPTCHA after Google surprised us with their pricing (blog[1], hn discussion[2]), and couldn't be happier. We use it in invisible mode and it does a great job at finding bots while getting out of users' way. Also top-notch customer support. The CEO was personally in the slack channel helping us. Highly recommended. [1]: https://blog.repl.it/anon [2]: https://news.ycombinator.com/item?id…

> We use it in invisible mode and it does a great job at finding bots while getting out of users' way. Interesting didn't realize this was a thing hcaptcha did[0]. It's basically recaptcha in terms of tracking which sites you visit then, no? 0: https://docs.hcaptcha.com/invisible

Compared to reCAPTCHA v3, our approach does not depend on tracking your visit history. (disclosure: work there.)
Post reply on HN