Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

hCaptcha now runs on fifteen percent of the internet

hcaptcha.com

Post reply on HN
Print view View original

191–200 of 380 posts

Re: hCaptcha now runs on fifteen percent of the internet

#191

Post by protoduction »

protoduction wrote: post #168
lowlevellimbo wrote: post #162

Earlier quoted context omitted.

> FriendlyCaptcha will prevent 99.9% of spam For someone who has little expertise in this specific field, how are you calculating this?

Admittedly it's not calculated so it may be a stretch, it's based on the assumption that the vast majority of spam out there just looks for forms to submit without smarts (which is also why honeypots can be pretty effective, especially if you have a small website that nobody will take the effort to work around it.) I've seen people report that they have reduced spam to near nothing already with just a honeypot, but o…

Judging by the downvotes (despite answering the question truthfully), I see it's not a good way to present ourselves, and frankly we don't have to make that claim. It's hard to estimate the real percentage, our customers are happy but measuring what is no longer there is tricky in the real world.

I will change the wording on the website and remove the percentage.

Re: hCaptcha now runs on fifteen percent of the internet

#192

Post by dastx »

protoduction wrote: post #154
slx26 wrote: post #126

Earlier quoted context omitted.

> it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time As much as I agree with your dislike of captchas, I don't think this is true at scale (unless universal online identities existed, which could and should include anonymous identifiers by design). When you need to accept information from anonymous users (comments, votes, forms, registrations), there's no way…

I built an alternative[0] that takes a proof of work approach. As a site owner you set the difficulty that makes sense for you: so perhaps you would want 20 seconds of computation before you can submit. The nice thing is that this can happen entirely in the background while the user fills in the form. Also with multiple requests from the same IP in a short timespan, the difficulty increases. There are downsides to to…

It doesn't work for me, comes back with the error: Verification failed: Background worker error undefined

I'm using latest Firefox on GNU/Linux. Admittedly I've got a lot stuff blocking all sorts of things, and I'm not really sure what's kicking to block background workers, but I'm glad it's blocked. Anyway, after disabled literally all blocking tools that I have, it still refuses to load.

Re: hCaptcha now runs on fifteen percent of the internet

#193

Post by hedora »

banana_giraffe wrote: post #187
gopty wrote: post #180

Earlier quoted context omitted.

Please, what is the service? I want to pay someone to solve Captchas for me.

https://anti-captcha.com/ is one such service. There are others, but this one that has browser plugins for visually impaired people in addition to APIs. I've used the service in the past, though it's far enough in the past all I can say is it worked once upon a time, no clue if it's still reliable.

Interestingly, it takes them under 20 seconds to solve a recaptcha and 70 for hCaptcha.

I wonder if they’ve partially automated recaptcha, or if hCaptcha is just a bigger pain in the neck. (I usually can’t solve a reCaptcha in 15 seconds...)

Re: hCaptcha now runs on fifteen percent of the internet

#194

Post by t0astbread »

BMSmnqXAE4yfe1 wrote: post #153
slx26 wrote: post #126

Earlier quoted context omitted.

> it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time As much as I agree with your dislike of captchas, I don't think this is true at scale (unless universal online identities existed, which could and should include anonymous identifiers by design). When you need to accept information from anonymous users (comments, votes, forms, registrations), there's no way…

One such solution would be a small payment, something like 1 cent for access. That's not too much, because I am already paying 3 cents to a service solving captchas for me.

Maybe but how would you transfer 1 cent in a way that's fast enough not to impair UX and cheap (where the transfer doesn't cost more than the validation fee)? Additionally (as with all online payments) there are privacy concerns.

Re: hCaptcha now runs on fifteen percent of the internet

#195

Post by elaus »

judge2020 wrote: post #15
ve55 wrote: post #4

Worth noting that this title is primarily due to Cloudflare having switched to them from ReCAPTCHA, and Cloudflare is... well, relatively popular, to say the least. I'm curious what kind of data may exist on the experience of switching for larger providers; do the users like it? how much more/less time do they spend solving? do they care, let alone even notice that it's not Google's ReCAPTCHA? Regardless, as ReCAPTCH…

For site operators, they don’t like the change since users are more likely to complain to the website than directly to CF. The following community post has 20k views and >100 replies asking Cloudflare to move back to recaptcha in some form. https://community.cloudflare.com/t/stop-using-hcaptcha/15896...

To be fair it doesn't seem to be _that_ bad on this thread: There's the very vocal OP as well as a "discussion" between various users that ranges from "please switch back to ReCaptcha" to "please keep hCaptcha".

For a change that affects "15% of the internet" this seems like very little negative feedback in a period of 8 months.

Re: hCaptcha now runs on fifteen percent of the internet

#196

Post by hedora »

Normille wrote: post #184
Kalium wrote: post #84

Earlier quoted context omitted.

For a lot of people, they want to run a service and not have to spend a significant amount of time and energy investing in anti-abuse. In general anti-abuse work is not nearly as useful as product work, a day off, or a variety of other things. I agree, there should be better ways to do anti-abuse. Yet I find myself coming up empty when I try to find better options for the common scenario where people would really rat…

Better way? I'd be hard pushed to come up with a worse way. The number of things that are "wrong" with reCatcha etc, have been mentioned on here ad nauseam . In fact, I'll quote myself from another debate on the subject, a while back: >1: It's never made clear exactly what you're supposed to click on. For example. If I'm told to click on "traffic lights" does that mean just the lights?... or the poles as well?... and…

Also, the outcome of the captcha is only loosely correlated to whether you answer correctly.

Re: hCaptcha now runs on fifteen percent of the internet

#197

Post by renewiltord »

jsnell wrote: post #155
renewiltord wrote: post #135

Earlier quoted context omitted.

Usually when you Captcha on a failed attempt, you captcha every request from that IP (or other session identifier) for a period of time. Try Google Accounts for instance. They behave this way. You don't captcha the success path because you don't need it. You captcha the pre-login flow once you have a failed attempt. It's a trip switch that is a prelude to the flow.

But this entire thread is about a case where the captcha happens after password entry! The point is that it is an entirely legit design, and kind of is the way you have to go when the username and password are entered together. As long as the captcha is shown regardless of the password validity, both the security properties and the amount of user annoyance due to having to solve unnecessary captchas is the same as if…

Sorry, because of how common the method I described is and how absurd the idea of showing a captcha only to give you a login failed message is, I "corrected" it before responding.

Re: hCaptcha now runs on fifteen percent of the internet

#198

Post by protoduction »

dastx wrote: post #192
protoduction wrote: post #154

Earlier quoted context omitted.

I built an alternative[0] that takes a proof of work approach. As a site owner you set the difficulty that makes sense for you: so perhaps you would want 20 seconds of computation before you can submit. The nice thing is that this can happen entirely in the background while the user fills in the form. Also with multiple requests from the same IP in a short timespan, the difficulty increases. There are downsides to to…

It doesn't work for me, comes back with the error: Verification failed: Background worker error undefined I'm using latest Firefox on GNU/Linux. Admittedly I've got a lot stuff blocking all sorts of things, and I'm not really sure what's kicking to block background workers, but I'm glad it's blocked. Anyway, after disabled literally all blocking tools that I have, it still refuses to load.

That's not good, could you maybe provide more details in the Github repo [0]? The widget is open source, hopefully we can figure out what is blocking it here.

We test the captcha in browsers up to 8 years old and on many devices, do you perhaps have background workers disabled entirely? Here is a link to the widget on its own [1], does that have the same behavior? How about a minimal worker example [2]?

[0]: https://github.com/FriendlyCaptcha/friendly-challenge [1]: https://unpkg.com/friendly-challenge@0.6.1/index.html [2]: https://jsfiddle.net/christopheviau/90syrp0q/

Re: hCaptcha now runs on fifteen percent of the internet

#199

Post by tehjoker »

protoduction wrote: post #191
protoduction wrote: post #168

Earlier quoted context omitted.

Admittedly it's not calculated so it may be a stretch, it's based on the assumption that the vast majority of spam out there just looks for forms to submit without smarts (which is also why honeypots can be pretty effective, especially if you have a small website that nobody will take the effort to work around it.) I've seen people report that they have reduced spam to near nothing already with just a honeypot, but o…

Judging by the downvotes (despite answering the question truthfully), I see it's not a good way to present ourselves, and frankly we don't have to make that claim. It's hard to estimate the real percentage, our customers are happy but measuring what is no longer there is tricky in the real world. I will change the wording on the website and remove the percentage.

People take quantitative claims seriously. I wouldn't make them without being able to defend them in an intellectually rigorous way.

Re: hCaptcha now runs on fifteen percent of the internet

#200

Post by mdaniel »

withinboredom wrote: post #177

I'd really love these captcha services to allow me to download an extension that allows me to bypass their captchas. This extension could verify my identity and/or device, or just keep an eye on my behavior to validate that I'm human.

Are you aware of their accessibility cookie? https://www.hcaptcha.com/accessibility

It's not exactly what you were asking for, but it can make their disease less painful

Post reply on HN