Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

hCaptcha now runs on fifteen percent of the internet

hcaptcha.com

Post reply on HN
Print view View original

211–220 of 380 posts

Re: hCaptcha now runs on fifteen percent of the internet

#211

Post by technofiend »

protoduction wrote: post #154
slx26 wrote: post #126

Earlier quoted context omitted.

> it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time As much as I agree with your dislike of captchas, I don't think this is true at scale (unless universal online identities existed, which could and should include anonymous identifiers by design). When you need to accept information from anonymous users (comments, votes, forms, registrations), there's no way…

I built an alternative[0] that takes a proof of work approach. As a site owner you set the difficulty that makes sense for you: so perhaps you would want 20 seconds of computation before you can submit. The nice thing is that this can happen entirely in the background while the user fills in the form. Also with multiple requests from the same IP in a short timespan, the difficulty increases. There are downsides to to…

First one to make this mine an altcoin for proof-of-work wins.

But seriously I like the idea, although it seems trivial for someone to attack a protected site by exhausting its subscription level? Are there any protections against that?

Re: hCaptcha now runs on fifteen percent of the internet

#212

Post by lambdaloop »

protoduction wrote: post #154
slx26 wrote: post #126

Earlier quoted context omitted.

> it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time As much as I agree with your dislike of captchas, I don't think this is true at scale (unless universal online identities existed, which could and should include anonymous identifiers by design). When you need to accept information from anonymous users (comments, votes, forms, registrations), there's no way…

I built an alternative[0] that takes a proof of work approach. As a site owner you set the difficulty that makes sense for you: so perhaps you would want 20 seconds of computation before you can submit. The nice thing is that this can happen entirely in the background while the user fills in the form. Also with multiple requests from the same IP in a short timespan, the difficulty increases. There are downsides to to…

Wow, this is an awesome idea. I can imagine this could be extended to solve tasks to mine cryptocurrency. If you get attacked by a botnet, you would actually make a profit!

Re: hCaptcha now runs on fifteen percent of the internet

#213

Post by DarthGhandi »

protoduction wrote: post #185
withinboredom wrote: post #171

Earlier quoted context omitted.

How do handle low-end devices? Do you reduce the difficulty for them and can this be abused by pretending to be a low-end device that really isn't?

Everybody gets the same difficulty initially which you determine as a site admin, so one should base this on their audience (e.g. Gitlab would have a different device profile from a government website). The solving can be a few times slower on a low end device which you should keep in mind. To aid with this when setting the difficulty for your website it shows you an estimate for various device types. This is indeed…

> Why bother with a proof of work scheme when you can just rate-limit directly?

Tad amusing after all this time people still don't understand why proof-of-work schemes exist.

Rate limiting has zero cost to an adversary. PoW has physical costs. It's in the name :)

Re: hCaptcha now runs on fifteen percent of the internet

#214

Post by seisvelas »

_tbjr wrote: post #22
seisvelas wrote: post #10

Earlier quoted context omitted.

On the other hand, many Tor users disable Javascript. Out of curiosity, does anyone know a good CAPTCHA that doesn't use JS?

BotStop by hCaptcha (enterprise). AFAIK there's also a Google reCaptcha frontend that doesn't require JS. Neither companies offer those solutions because of privacy or security benefits, but to support old IE versions of course.

> BotStop by hCaptcha

Cool, I didn't know about this! Too bad there doesn't seem to be a strong open source option, but I'll check this out.

Re: hCaptcha now runs on fifteen percent of the internet

#215

Post by chromanoid »

banana_giraffe wrote: post #187
gopty wrote: post #180

Earlier quoted context omitted.

Please, what is the service? I want to pay someone to solve Captchas for me.

https://anti-captcha.com/ is one such service. There are others, but this one that has browser plugins for visually impaired people in addition to APIs. I've used the service in the past, though it's far enough in the past all I can say is it worked once upon a time, no clue if it's still reliable.

WTF Did you see the super man like guy shooting at the sweatshop workers? This looks pretty bad...

https://imgur.com/a/CvYyBQH

Re: hCaptcha now runs on fifteen percent of the internet

#216

Post by peterhunt »

protoduction wrote: post #154
slx26 wrote: post #126

Earlier quoted context omitted.

> it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time As much as I agree with your dislike of captchas, I don't think this is true at scale (unless universal online identities existed, which could and should include anonymous identifiers by design). When you need to accept information from anonymous users (comments, votes, forms, registrations), there's no way…

I built an alternative[0] that takes a proof of work approach. As a site owner you set the difficulty that makes sense for you: so perhaps you would want 20 seconds of computation before you can submit. The nice thing is that this can happen entirely in the background while the user fills in the form. Also with multiple requests from the same IP in a short timespan, the difficulty increases. There are downsides to to…

proof of work really doesn't work well in practice. spammers have huge farms of compute, often on residential ips, and legit users are accessing the service from a device that is often power-constrained (like a phone). you end up either hugely penalizing legitimate users, or having to employ many of the standard antispam techniques (IP/ISP reputation, captcha, rate limiting etc) on top, so the proof of work adds a lot less incremental value.

Re: hCaptcha now runs on fifteen percent of the internet

#217

Post by asutekku »

protoduction wrote: post #154
slx26 wrote: post #126

Earlier quoted context omitted.

> it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time As much as I agree with your dislike of captchas, I don't think this is true at scale (unless universal online identities existed, which could and should include anonymous identifiers by design). When you need to accept information from anonymous users (comments, votes, forms, registrations), there's no way…

I built an alternative[0] that takes a proof of work approach. As a site owner you set the difficulty that makes sense for you: so perhaps you would want 20 seconds of computation before you can submit. The nice thing is that this can happen entirely in the background while the user fills in the form. Also with multiple requests from the same IP in a short timespan, the difficulty increases. There are downsides to to…

So your solution is to technically waste electricity to replace captcha? It's for sure an interesting concept, the first point and low-end devices requiring 20+ seconds to pass are not a very good points to sell your service.

Re: hCaptcha now runs on fifteen percent of the internet

#218

Post by protoduction »

mNovak wrote: post #207
protoduction wrote: post #154

Earlier quoted context omitted.

I built an alternative[0] that takes a proof of work approach. As a site owner you set the difficulty that makes sense for you: so perhaps you would want 20 seconds of computation before you can submit. The nice thing is that this can happen entirely in the background while the user fills in the form. Also with multiple requests from the same IP in a short timespan, the difficulty increases. There are downsides to to…

Curious why it wouldn't start 'verifying' immediately on load? The fact that it runs in the background is really key--I'd hate to fill out an entire form, click the button at the end, and still have to wait around to submit.

You can change this behavior of the widget (data-start="auto" instead of default data-start="focus"), or you can start it programmatically.

The reason you wouldn't always want to start it in the background is if the user may not intend to submit the form (perhaps it's a form that is in your footer of every page and only a small percentage of users intend on sending it). Starting it on focus of the form is a good default.

Re: hCaptcha now runs on fifteen percent of the internet

#219

Post by hedora »

dheera wrote: post #102
dsabanin wrote: post #43

Earlier quoted context omitted.

Recently Google's captcha asked me to mark all the traffic meters on the photos, and amongst the choices was a photo of a mailbox. It didn't let me through until I marked it as a meter as well. Good luck to whatever self driving car they are training using this data.

Maybe would be kind of fun if we, the users, could form a coalition to deliberately mislabel photos on captures on a mass scale. It just seems there lacks a way to make it happen beyond the hacker community.

I do this. I just click random boxes and it usually lets me through. It’s more clicks, but not necessarily more time.

Re: hCaptcha now runs on fifteen percent of the internet

#220

Post by londons_explore »

ve55 wrote: post #158
aftbit wrote: post #98

Earlier quoted context omitted.

Surely this ML must be presented a wide set of data on the user and their browser to make this determination? So just like recaptcha, they determine if they should admit you based on passively snooped data rather than active challenges.

My knowledge of this is that hCaptcha uses anonymized user data to ensure that the user doesn't look like a bot. What ReCAPTCHA did differently is not only not anonymizing data, but specifically trying to find out which person was presented with their captcha by matching cookies and profiles to Google accounts (which the majority of users would have and be logged into for many reasons). When you combine this with Goo…

hCaptcha's ML is 90% "Is the user agent the newest version of Chrome? -> Not a bot, Otherwise -> Bot"
Post reply on HN