Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

hCaptcha now runs on fifteen percent of the internet

hcaptcha.com

Post reply on HN
Print view View original

201–210 of 380 posts

Re: hCaptcha now runs on fifteen percent of the internet

#201

Post by smittywerben »

lowlevellimbo wrote: post #162
protoduction wrote: post #154

Earlier quoted context omitted.

I built an alternative[0] that takes a proof of work approach. As a site owner you set the difficulty that makes sense for you: so perhaps you would want 20 seconds of computation before you can submit. The nice thing is that this can happen entirely in the background while the user fills in the form. Also with multiple requests from the same IP in a short timespan, the difficulty increases. There are downsides to to…

> FriendlyCaptcha will prevent 99.9% of spam For someone who has little expertise in this specific field, how are you calculating this?

As a counter-point, the uncaptcha[0] research project used Google's free Speech-to-Text service to solve reCAPTCHA at a reported 85% success rate.

I'm convinced CAPTCHA are no better than fake/dummy security cameras.

[0] https://github.com/ecthros/uncaptcha

Re: hCaptcha now runs on fifteen percent of the internet

#203

Post by bluGill »

Normille wrote: post #175
noja wrote: post #150

Earlier quoted context omitted.

I find that when I solve a Captcha too quickly, I get another one. And another one. And another one. So instead, I wait a short time, click a few wrong boxes, then enter the correct Captcha. Maybe this is part of it, but I don't like it.

If the Buster plugin can't solve the reCaptcha for me [It does fail from time to time] then I just don't bother visiting that website. Or if it's a site I need to use, then I'll try again later and see if I either get let in without being asked to jump through hoops, or get a reCaptcha Buster can solve. I simply refuse to waste my time and drive up my blood pressure by doing unpaid training work for Google's AI, in o…

I sent a email to my representative, which got my automatically added to her newsletter. But the unsubscribe link doesn't work without solving one...

Re: hCaptcha now runs on fifteen percent of the internet

#204

Post by t0astbread »

abhinav22 wrote: post #17

I really hate all these captcha codes Why can’t they do something like a reverse SSL where we have to authenticate ourselves as humans? For example if I have an Apple account on my Apple devices, why can’t they figure out a way to authenticate me as a human from that information? This doesn’t work for all scenarios (eg throwaway accounts), but it could work for the majority?

Maybe there's a good solution somewhere there but the problem - as far as I can see - with this is that you either have a central party that knows who signed up for what or you have every account tied to a permanent super-identity. Both of which aren't great.

Re: hCaptcha now runs on fifteen percent of the internet

#205

Post by 10000truths »

protoduction wrote: post #185
withinboredom wrote: post #171

Earlier quoted context omitted.

How do handle low-end devices? Do you reduce the difficulty for them and can this be abused by pretending to be a low-end device that really isn't?

Everybody gets the same difficulty initially which you determine as a site admin, so one should base this on their audience (e.g. Gitlab would have a different device profile from a government website). The solving can be a few times slower on a low end device which you should keep in mind. To aid with this when setting the difficulty for your website it shows you an estimate for various device types. This is indeed…

Why bother with a proof of work scheme when you can just rate-limit directly? It accomplishes the same thing, while eating way fewer CPU cycles, doesn’t require JavaScript, and guarantees uniform cost between all client types.

Re: hCaptcha now runs on fifteen percent of the internet

#206

Post by hedora »

dodobirdlord wrote: post #190
topynate wrote: post #72

Earlier quoted context omitted.

Just looked on Takeout and there don't seem to be any reCAPTCHA data there. I wonder what a GDPR request would produce.

reCAPTCHA only needs to make a determination that the user is some human, not that they are any particular human. And reCAPTCHA is usable without being logged into Google’s identity system. The profiles it builds are clearly not associated with Google’s primary identity database, and its trivial if you don’t need to preserve identity to one-way hash every piece of data that GDPR considers user-identifying at the entr…

ReCaptcha seems to use your logged-in status (and, I’d guess, account reputation), along with an ip reputation score when deciding whether to serve a captcha or not.

A GPDR request naming an IP address should allow them to provide those scores.

If not, it’s easily demonstrable that they are storing and using information that they’re not including in a GPDR response, and they deserve their multi-billion dollar fine.

Also, ReCaptcha’s behavior is obviously anticompetitive, and also using Google’s dominant positions in some markets to establish dominance in unrelated markets.

This is anti-trust lawyer candy.

Re: hCaptcha now runs on fifteen percent of the internet

#207

Post by mNovak »

protoduction wrote: post #154
slx26 wrote: post #126

Earlier quoted context omitted.

> it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time As much as I agree with your dislike of captchas, I don't think this is true at scale (unless universal online identities existed, which could and should include anonymous identifiers by design). When you need to accept information from anonymous users (comments, votes, forms, registrations), there's no way…

I built an alternative[0] that takes a proof of work approach. As a site owner you set the difficulty that makes sense for you: so perhaps you would want 20 seconds of computation before you can submit. The nice thing is that this can happen entirely in the background while the user fills in the form. Also with multiple requests from the same IP in a short timespan, the difficulty increases. There are downsides to to…

Curious why it wouldn't start 'verifying' immediately on load? The fact that it runs in the background is really key--I'd hate to fill out an entire form, click the button at the end, and still have to wait around to submit.

Re: hCaptcha now runs on fifteen percent of the internet

#208

Post by djfdat »

protoduction wrote: post #185
withinboredom wrote: post #171

Earlier quoted context omitted.

How do handle low-end devices? Do you reduce the difficulty for them and can this be abused by pretending to be a low-end device that really isn't?

Everybody gets the same difficulty initially which you determine as a site admin, so one should base this on their audience (e.g. Gitlab would have a different device profile from a government website). The solving can be a few times slower on a low end device which you should keep in mind. To aid with this when setting the difficulty for your website it shows you an estimate for various device types. This is indeed…

> I have a hunch that people on mobile devices are inherently slower at entering their data.

In general, I use form autocomplete to fill this quickly. And on the contrary, my mobile signups are faster than desktop because the lastpass firefox extension on desktop takes longer to detect the form before the autocomplete can begin than my phone does.

Re: hCaptcha now runs on fifteen percent of the internet

#209

Post by Aunche »

GekkePrutser wrote: post #138
hombre_fatal wrote: post #68

Earlier quoted context omitted.

> could be straightforwardly removed or replaced with rate limiting login attempts per IP This is very outdated intuition. Fresh IP addresses cost peanuts. For example, your solution still allows an attacker to run a 50k item /login combolist against one of your users with $5 of botnet time, each IP address trying a single uname/pass combo. Here you pay $18/GB to multiplex your abuse (cred stuffing being classic non-…

I would start with blocking those 72 million addresses for starters :)

Many of these ip addresses would also be shared by servers of legitimate businesses and VPNs.

Re: hCaptcha now runs on fifteen percent of the internet

#210

Post by hedora »

raspyberr wrote: post #139
blindm wrote: post #11

I think it's great. So many sites sit behind Cloudflare now and Cloudflare now uses hCaptcha, which is a big win. And the hCaptchas themselves are easy to complete. No more wondering if you actually clicked on 'all' the traffic lights anymore, yay! I inspected the source code of Google's reCaptcha offering and was disgusted at how many bits of information they were collecting. They also seem to be fingerprinting user…

Lots of websites sit behind a single company which has now changed to use its own captach is a good thing?

Creating a monoculture makes it easier to implement systems that automatically bypass the captchas, so it’s good for end users, especially people that are visually impaired, or otherwise unable to solve captchas.
Post reply on HN