Is there any place where you can just solve captchas from hCaptcha? I was curious what kind of questions/labels it displays.
https://www.hcaptcha.com/ has a "Try it out" section on the homepage you can repeatedly solve for examples.
hCaptcha now runs on fifteen percent of the internet
271–280 of 380 posts
Re: hCaptcha now runs on fifteen percent of the internet
#272Never heard of them before but went to their main site and got served the Romanian version which is so bad I think it could be used as commedy. Also loved how their front page image shows a barrier with their logo stopping some robots but the robots are facing the backside of their logo/stop sign!
Like, hire me for more!
I'm curious how can they train ML models while preserving privacy. Where does the corpus come from?
Re: hCaptcha now runs on fifteen percent of the internet
#273It’s good to hear that alternatives to any Google tech are gaining market share. For me, all captchas are a stain on the web - in most cases, shifting (and multiplying) the wasted human hours from the company collecting data (eg the owner of the contact form) to the user (the person completing the contact form). The company is saved from filtering through contact form responses from bots (spam and injection attempts)…
> For me, all captchas are a stain on the web - in most cases, shifting (and multiplying) the wasted human hours from the company collecting data (eg the owner of the contact form) to the user (the person completing the contact form). I run a contact form for a small business. Explaining to them why their tiny website has tens of thousands of spammy requests filled with porn keywords is not easy. Of course webmasters…
I did this too. Providing contact forms for lots of websites.
In my opinion, back end filters are the solution to the problem you’re describing. Not making the genuine users jump through hoops.
Re: hCaptcha now runs on fifteen percent of the internet
#274Earlier quoted context omitted.
> it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time As much as I agree with your dislike of captchas, I don't think this is true at scale (unless universal online identities existed, which could and should include anonymous identifiers by design). When you need to accept information from anonymous users (comments, votes, forms, registrations), there's no way…
I built an alternative[0] that takes a proof of work approach. As a site owner you set the difficulty that makes sense for you: so perhaps you would want 20 seconds of computation before you can submit. The nice thing is that this can happen entirely in the background while the user fills in the form. Also with multiple requests from the same IP in a short timespan, the difficulty increases. There are downsides to to…
This looks very interesting and clean. Well done!
Re: hCaptcha now runs on fifteen percent of the internet
#275I really hate all these captcha codes Why can’t they do something like a reverse SSL where we have to authenticate ourselves as humans? For example if I have an Apple account on my Apple devices, why can’t they figure out a way to authenticate me as a human from that information? This doesn’t work for all scenarios (eg throwaway accounts), but it could work for the majority?
Forget adding more draconian identity requirements. 95% of CAPTCHA use is simply unnecessary and could be straightforwardly removed or replaced with rate limiting login attempts per IP. Never mind sites that use it to prevent scraping. If serving static pages is that much of a burden that you want to discourage automated means of retrieving information that you're trying to publish, then work on your website performa…
Exactly. The vast majority of captcha usage is completely unnecessary. Just remove it. As you say I've even seen captchas for static content, which is pure nonsense.
I run several long-lived (decades) sites with mostly static content but also some dynamic pages and a commenting mechanism. Here's what I do to prevent abuse: nothing. It's fine.
If you run a massively popular site or something politically controversial then you'll be targeted for abuse. If you're specifically targeted, I don't know how much captchas will help.
For the rest of the 99.9% of sites, just stop it. You don't need it.
Re: hCaptcha now runs on fifteen percent of the internet
#276I should have a right to not disclose whether I am a human or not. Captchas invade privacy and essentially you become an unpaid content classifier.
Re: hCaptcha now runs on fifteen percent of the internet
#277Earlier quoted context omitted.
proof of work really doesn't work well in practice. spammers have huge farms of compute, often on residential ips, and legit users are accessing the service from a device that is often power-constrained (like a phone). you end up either hugely penalizing legitimate users, or having to employ many of the standard antispam techniques (IP/ISP reputation, captcha, rate limiting etc) on top, so the proof of work adds a lo…
It's not perfect, and you are right about the downsides. These resources that spammers have can be applied as easily to re/hcaptcha (either through ML or clickfarms). No CAPTCHA will actually lock out targeted attacks. The difficulty increase per IP can be seen as a form of soft rate limiting, it's shared between all websites (which is where it's different from ordinary rate limiting). In the future we may use IP rep…
I get re-captcha'ed all the time from the same IP. And if I don't use Chrome, the captcha count is like 4x-5x higher just for using Firefox.
Re: hCaptcha now runs on fifteen percent of the internet
#278Earlier quoted context omitted.
I built an alternative[0] that takes a proof of work approach. As a site owner you set the difficulty that makes sense for you: so perhaps you would want 20 seconds of computation before you can submit. The nice thing is that this can happen entirely in the background while the user fills in the form. Also with multiple requests from the same IP in a short timespan, the difficulty increases. There are downsides to to…
proof of work really doesn't work well in practice. spammers have huge farms of compute, often on residential ips, and legit users are accessing the service from a device that is often power-constrained (like a phone). you end up either hugely penalizing legitimate users, or having to employ many of the standard antispam techniques (IP/ISP reputation, captcha, rate limiting etc) on top, so the proof of work adds a lo…
bangladeshi click farms[0] are cheaper to use to bypass captcha than renting residential proxies to solve PoW. Also image captcha cannot scale automatally in difficulty (as an incident response) but PoW can (see how bitcoin adjusts with the miners)
Re: hCaptcha now runs on fifteen percent of the internet
#279I dislike the widespread use of captcha regardless of provider. I realize anything connected to the internet will be subject to automated abuse, and it's impossible to run some types of services without taking some steps to defend against it, but it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time. The exact details will vary based on the type of service, of c…
It's exactly how email spam filters evolved.
They used to be completely local and even some DIY solutions, evolved to signature updates, but eventually the attacks grew so advanced that only online services could be updated and aggressive enough, which is of course how gmail took over the internet with near perfect spam filter (when was the last time you checked a gmail spam folder).
The last generation of local spam filters were pretty good though. Anyone remember Eudora and Spamnix?
Re: hCaptcha now runs on fifteen percent of the internet
#280I dislike the widespread use of captcha regardless of provider. I realize anything connected to the internet will be subject to automated abuse, and it's impossible to run some types of services without taking some steps to defend against it, but it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time. The exact details will vary based on the type of service, of c…
>One particularly egregious misuse of captcha in a service I use presents one after I enter a correct username and password Is it eBay by any chance? That recently started randomly showing reCaptchas to me when I'm already logged in and have been using the site for some time. When this happens, it descends into a never-ending cycle of more login screens and then more reCaptchas. But thankfully eBay have taken note of…
I'm about as anti-Google as it comes, but I didn't even mind the first incarnation of reCaptcha as a concept. You prove that you're human, and you also help transcribe books so that they're more accessible/searchable! Sure, it's in Google's interest in that it improves Google Books, but it at least seems like a symbiotic exchange (to, e.g. humanity in general.)
Contrast that with today's form of reCaptcha where you identify stop signs/crosswalks/et c. for Google's benefit, but at the same time you're also improving...oh, wait, Google again. It almost seems like forced labor, in a sense.