hCaptcha now runs on fifteen percent of the internet • Hacker News Board

Re: hCaptcha now runs on fifteen percent of the internet

#181

Post by quantumofalpha » Wed, Nov 25, 2020, 9:32 PM UTC

skellera wrote: post #110

shakna wrote: post #80

Earlier quoted context omitted.

> which is basically why after a single reCAPTCHA solve, you wont see them prompt you again for ages - they know who you are. If only. If the same site has reCaptcha across more than one page, within mere minutes of having to slog through multiple screens of one, I can guarantee I'll be doing it again. And I'm never sure if Google has served me either a very long sequence of reCaptchas, or whether they've decided I'm…

Being on a VPN, have blockers on, or not logged into google are a few things that will increase the captchas you’ll see.

And that's how you know that your VPN and adblockers work :)

Re: hCaptcha now runs on fifteen percent of the internet

#182

Post by dathinab » Wed, Nov 25, 2020, 9:32 PM UTC

Honestly captcha seem pointles to me.

Literally every time I'm in a situation where I'm required to use a captcha to access a site it is impossible to successfully solve the captcha in any sane amount of time.

This happens both with google and cloudflare.

Tbh. if they don't trust my connection can't they just tell me so instead of pretending to provide a "I'm not a robot" test which is practically (close to) unsolvable???

(Note that this post only refers to captchars guarden the access of an site if they somehow don't trust your connection, not "I'm not a robot captures" on forms or similar).

Re: hCaptcha now runs on fifteen percent of the internet

#183

Post by superkuh » Wed, Nov 25, 2020, 9:36 PM UTC

15% of the web. And probably only of the commercial web.

Re: hCaptcha now runs on fifteen percent of the internet

#184

Post by Normille » Wed, Nov 25, 2020, 9:37 PM UTC

Kalium wrote: post #84

Zak wrote: post #48

I dislike the widespread use of captcha regardless of provider. I realize anything connected to the internet will be subject to automated abuse, and it's impossible to run some types of services without taking some steps to defend against it, but it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time. The exact details will vary based on the type of service, of c…

For a lot of people, they want to run a service and not have to spend a significant amount of time and energy investing in anti-abuse. In general anti-abuse work is not nearly as useful as product work, a day off, or a variety of other things. I agree, there should be better ways to do anti-abuse. Yet I find myself coming up empty when I try to find better options for the common scenario where people would really rat…

Better way? I'd be hard pushed to come up with a worse way.

The number of things that are "wrong" with reCatcha etc, have been mentioned on here ad nauseam. In fact, I'll quote myself from another debate on the subject, a while back:

  >1: It's never made clear exactly what you're supposed to click on. For example. If I'm told to click on "traffic lights" does that mean just the lights?... or the poles as well?... and what about a square that only has a tiny bit in it? Does that count too, or is it only squares which are mostly filled by the object in question?

  >2: They make no concession to non-US English speakers. I've been asked to identify things before, where I had to guess what the word means because the same thing is called something completely different in UK English.

  >The only thing that approaches the level of rage that reCaptchas instil in me are those captchas where you've got to transcribe what's in a photo of some letters & numbers and where they NEVER fecking tell you whether it's case sensitive or not, or where they use identical characters for zero and letter O, one and letter I, etc.

Re: hCaptcha now runs on fifteen percent of the internet

#185

Post by protoduction » Wed, Nov 25, 2020, 9:38 PM UTC

withinboredom wrote: post #171

protoduction wrote: post #154

Earlier quoted context omitted.

I built an alternative[0] that takes a proof of work approach. As a site owner you set the difficulty that makes sense for you: so perhaps you would want 20 seconds of computation before you can submit. The nice thing is that this can happen entirely in the background while the user fills in the form. Also with multiple requests from the same IP in a short timespan, the difficulty increases. There are downsides to to…

How do handle low-end devices? Do you reduce the difficulty for them and can this be abused by pretending to be a low-end device that really isn't?

Everybody gets the same difficulty initially which you determine as a site admin, so one should base this on their audience (e.g. Gitlab would have a different device profile from a government website).

The solving can be a few times slower on a low end device which you should keep in mind. To aid with this when setting the difficulty for your website it shows you an estimate for various device types. This is indeed a downside of PoW approaches.

There is one factor that helps: you can start solving as soon as the form loads, so as the user enters their details/comment it can start solving - I have a hunch that people on mobile devices are inherently slower at entering their data which should help a bit..

Anyway - if you set the difficulty quite high and the solving takes 30 seconds, it takes the user 15 seconds to enter the form - the user would still have to wait 15 seconds. That's not very different from the time to solve image captchas (it's actually lower and doesn't come with a 2MB payload download which isn't great on phones either, and they can keep their privacy + sanity). You could give the user something to do that makes sense for your website (ask them for feedback?).

Re: hCaptcha now runs on fifteen percent of the internet

#186

Post by driverdan » Wed, Nov 25, 2020, 9:39 PM UTC

alexnewman wrote: post #83

tuckerconnelly wrote: post #51

As someone who scrapes, captcha's are pretty silly. One of the sites we scrape implemented hCaptcha, and it was a breeze to get around. There are a few things that make my life more difficult, but captchas aren't one of them, and nothing can stop scraping altogether.

How'd you do it?

I'm not OP but there are cheap solving services that will fill them in for you. The cost is trivial and they have decent APIs for automatic integration into scrapers.

Re: hCaptcha now runs on fifteen percent of the internet

#187

Post by banana_giraffe » Wed, Nov 25, 2020, 9:40 PM UTC

gopty wrote: post #180

BMSmnqXAE4yfe1 wrote: post #153

Earlier quoted context omitted.

One such solution would be a small payment, something like 1 cent for access. That's not too much, because I am already paying 3 cents to a service solving captchas for me.

Please, what is the service? I want to pay someone to solve Captchas for me.

https://anti-captcha.com/ is one such service. There are others, but this one that has browser plugins for visually impaired people in addition to APIs.

I've used the service in the past, though it's far enough in the past all I can say is it worked once upon a time, no clue if it's still reliable.

Re: hCaptcha now runs on fifteen percent of the internet

#188

Post by abc-xyz » Wed, Nov 25, 2020, 9:43 PM UTC

catovh wrote: post #55

Not keen on hcaptcha because I'm almost always need to solve 2 sets of the puzzle vs 1 with recaptcha. Theres a thin line between privacy and convenience, most of the time I've felt hcaptcha to be on the least convenience side.

Only 2? I usually need 5+.. not that recaptcha was any better.

I sincerely hope they, along with all other companies providing captcha services, go bankrupt.

Re: hCaptcha now runs on fifteen percent of the internet

#189

Post by dylz » Wed, Nov 25, 2020, 9:52 PM UTC

wintermutestwin wrote: post #52

blindm wrote: post #11

I think it's great. So many sites sit behind Cloudflare now and Cloudflare now uses hCaptcha, which is a big win. And the hCaptchas themselves are easy to complete. No more wondering if you actually clicked on 'all' the traffic lights anymore, yay! I inspected the source code of Google's reCaptcha offering and was disgusted at how many bits of information they were collecting. They also seem to be fingerprinting user…

I've had hCaptcha recheck me repeatedly and fail to work at all on VPN. I much prefer ebay's simple slide the puzzle piece method.

The slide is just as, if not more invasive as recaptcha in terms of privacy, cross-site tracking and fingerprinting.

Re: hCaptcha now runs on fifteen percent of the internet

#190

Post by dodobirdlord » Wed, Nov 25, 2020, 9:53 PM UTC

topynate wrote: post #72

gaieges wrote: post #42

Earlier quoted context omitted.

> Google's reCaptcha code seemed to be very keen on knowing my 'cadence' or the way I used my mouse and how quickly (or how slow) I completed the captcha. It also looked at things like timezone, screen resolution, battery charge level etc So they could determine if it was 'you' who was using the captcha, soon after, in a separate session (even on a different device!) I'd bet a good amount that they store that along w…

Just looked on Takeout and there don't seem to be any reCAPTCHA data there. I wonder what a GDPR request would produce.

reCAPTCHA only needs to make a determination that the user is some human, not that they are any particular human. And reCAPTCHA is usable without being logged into Google’s identity system. The profiles it builds are clearly not associated with Google’s primary identity database, and its trivial if you don’t need to preserve identity to one-way hash every piece of data that GDPR considers user-identifying at the entry point to the system and store only the hash. The EU isn’t shy about handing out billion-dollar fines to Google, so while Google can match a user to a stored profile there’s no reason to suspect that Google has a way to reverse that mapping.