hCaptcha now runs on fifteen percent of the internet • Hacker News Board

Re: hCaptcha now runs on fifteen percent of the internet

#171

Post by withinboredom » Wed, Nov 25, 2020, 9:27 PM UTC

protoduction wrote: post #154

slx26 wrote: post #126

Earlier quoted context omitted.

> it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time As much as I agree with your dislike of captchas, I don't think this is true at scale (unless universal online identities existed, which could and should include anonymous identifiers by design). When you need to accept information from anonymous users (comments, votes, forms, registrations), there's no way…

I built an alternative[0] that takes a proof of work approach. As a site owner you set the difficulty that makes sense for you: so perhaps you would want 20 seconds of computation before you can submit. The nice thing is that this can happen entirely in the background while the user fills in the form. Also with multiple requests from the same IP in a short timespan, the difficulty increases. There are downsides to to…

How do handle low-end devices? Do you reduce the difficulty for them and can this be abused by pretending to be a low-end device that really isn't?

Re: hCaptcha now runs on fifteen percent of the internet

#172

Post by pests » Wed, Nov 25, 2020, 9:28 PM UTC

topynate wrote: post #72

gaieges wrote: post #42

Earlier quoted context omitted.

> Google's reCaptcha code seemed to be very keen on knowing my 'cadence' or the way I used my mouse and how quickly (or how slow) I completed the captcha. It also looked at things like timezone, screen resolution, battery charge level etc So they could determine if it was 'you' who was using the captcha, soon after, in a separate session (even on a different device!) I'd bet a good amount that they store that along w…

Just looked on Takeout and there don't seem to be any reCAPTCHA data there. I wonder what a GDPR request would produce.

Someone on here has tried to get all their data from both Facebook and Google. I wish I could find the blog post. The tech companies are claiming their Takeout/equivalent is sufficient under the GDRP and anything extra we ask for is not being provided due to it being "non user understandable" or in a "machine format". IIRC.

Re: hCaptcha now runs on fifteen percent of the internet

#173

Post by Animats » Wed, Nov 25, 2020, 9:29 PM UTC

Anyone have an example of hCaptcha usage?

Re: hCaptcha now runs on fifteen percent of the internet

#174

Post by lowlevellimbo » Wed, Nov 25, 2020, 9:30 PM UTC

BMSmnqXAE4yfe1 wrote: post #166

blindm wrote: post #11

I think it's great. So many sites sit behind Cloudflare now and Cloudflare now uses hCaptcha, which is a big win. And the hCaptchas themselves are easy to complete. No more wondering if you actually clicked on 'all' the traffic lights anymore, yay! I inspected the source code of Google's reCaptcha offering and was disgusted at how many bits of information they were collecting. They also seem to be fingerprinting user…

And you are also contributing, without pay, to G$$gle AI and their plans of world domination.

Using hCaptcha is also contributing to some ML model for different companies serving unknown (to us) purposes.

Re: hCaptcha now runs on fifteen percent of the internet

#175

Post by Normille » Wed, Nov 25, 2020, 9:30 PM UTC

noja wrote: post #150

Zak wrote: post #48

I dislike the widespread use of captcha regardless of provider. I realize anything connected to the internet will be subject to automated abuse, and it's impossible to run some types of services without taking some steps to defend against it, but it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time. The exact details will vary based on the type of service, of c…

I find that when I solve a Captcha too quickly, I get another one. And another one. And another one. So instead, I wait a short time, click a few wrong boxes, then enter the correct Captcha. Maybe this is part of it, but I don't like it.

If the Buster plugin can't solve the reCaptcha for me [It does fail from time to time] then I just don't bother visiting that website. Or if it's a site I need to use, then I'll try again later and see if I either get let in without being asked to jump through hoops, or get a reCaptcha Buster can solve.

I simply refuse to waste my time and drive up my blood pressure by doing unpaid training work for Google's AI, in order to visit some crappy website. I really wish more people would start boycotting any site which uses reCaptcha [or its derivatives], so we could get rid of this blight on the internet.

I've spotted this new hCaptcha junk show up recently on a couple of sites I used to frequent. I don't visit those sites any more. So well done webmasters. Apparently annoying the shit out of visitors to your site tends to drive them away. Who'da thunk it?!

Re: hCaptcha now runs on fifteen percent of the internet

#176

Post by eatbots » Wed, Nov 25, 2020, 9:30 PM UTC

disgrunt wrote: post #81

eatbots wrote: post #59

Earlier quoted context omitted.

We actually spend quite a lot of time on this, and regularly work with blind users to test and improve these flows. Most vision-impaired users have no issue in our testing, and it is a much more accessible option than audio challenges, which discriminate against those with auditory processing impairments. (disclosure: work there.)

Your cookie approach requires: > If you are using the very latest version of Safari on either the recently released OS X 10.15 or iOS 13.4, Apple has just changed the behavior of Safari related to third-party cookies, blocking all of them by default. We are implementing a solution, but in the meantime please visit Safari Preferences, Privacy section, and uncheck "Website tracking: Prevent cross-site tracking" to enab…

Using any kind of privacy/adblock extension that supports domain-level whitelisting (e.g. uBlock Origin) works fine, and this is what we suggest in the accessibility FAQ. Apple didn't build fine-grained controls into their browser before making this recent change, unfortunately.

That said, we're working with the browser makers on native support for our next gen privacy-preserving approach to this via Privacy Pass.

Re: hCaptcha now runs on fifteen percent of the internet

#177

Post by withinboredom » Wed, Nov 25, 2020, 9:30 PM UTC

I'd really love these captcha services to allow me to download an extension that allows me to bypass their captchas. This extension could verify my identity and/or device, or just keep an eye on my behavior to validate that I'm human.

Re: hCaptcha now runs on fifteen percent of the internet

#178

Post by BMSmnqXAE4yfe1 » Wed, Nov 25, 2020, 9:31 PM UTC

hombre_fatal wrote: post #68

mindslight wrote: post #36

Earlier quoted context omitted.

Forget adding more draconian identity requirements. 95% of CAPTCHA use is simply unnecessary and could be straightforwardly removed or replaced with rate limiting login attempts per IP. Never mind sites that use it to prevent scraping. If serving static pages is that much of a burden that you want to discourage automated means of retrieving information that you're trying to publish, then work on your website performa…

> could be straightforwardly removed or replaced with rate limiting login attempts per IP This is very outdated intuition. Fresh IP addresses cost peanuts. For example, your solution still allows an attacker to run a 50k item /login combolist against one of your users with $5 of botnet time, each IP address trying a single uname/pass combo. Here you pay $18/GB to multiplex your abuse (cred stuffing being classic non-…

This scenario is not realistic, as you can just lengthen time between subsequent login attempts per username.

Re: hCaptcha now runs on fifteen percent of the internet

#179

Post by heavyset_go » Wed, Nov 25, 2020, 9:31 PM UTC

GekkePrutser wrote: post #131

heavyset_go wrote: post #119

Earlier quoted context omitted.

Don't worry, the next iteration of CAPTCHAs will rely heavily on browser feature detection, ensuring that you're not using an unauthorized version of Chrome that can be automated. Only authorized and trusted browsers will pass the tests.

Which will mean even more restrictions on the types of browsers we can use, and gathering more information. Not OK either.

This was my point. Google is already doing this[1] for account access, and they will prevent competitors' browsers from logging in.

[1] https://news.ycombinator.com/item?id=25172755

Re: hCaptcha now runs on fifteen percent of the internet

#180

Post by gopty » Wed, Nov 25, 2020, 9:31 PM UTC

BMSmnqXAE4yfe1 wrote: post #153

slx26 wrote: post #126

Earlier quoted context omitted.

> it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time As much as I agree with your dislike of captchas, I don't think this is true at scale (unless universal online identities existed, which could and should include anonymous identifiers by design). When you need to accept information from anonymous users (comments, votes, forms, registrations), there's no way…

One such solution would be a small payment, something like 1 cent for access. That's not too much, because I am already paying 3 cents to a service solving captchas for me.

Please, what is the service? I want to pay someone to solve Captchas for me.