Has anyone estimated the cost of lost users or visitors thanks to this crap?
Sure it may prevent robots from visiting but it also loses business. Personally I just close the tab if I see that crap and go elsewhere.
hCaptcha now runs on fifteen percent of the internet
281–290 of 380 posts
Re: hCaptcha now runs on fifteen percent of the internet
#282Is this mainly thanks to getting Cloudflare as a customer?
Congrats, albeit I have to say I had less problems with recaptcha captchas. I experienced a couple of cases of hcaptcha just not working correctly and being unable to access something despite the captcha success, which never happened with recaptcha (in my experience).
Re: hCaptcha now runs on fifteen percent of the internet
#283I dislike the widespread use of captcha regardless of provider. I realize anything connected to the internet will be subject to automated abuse, and it's impossible to run some types of services without taking some steps to defend against it, but it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time. The exact details will vary based on the type of service, of c…
And don't spammers just click farm captchas out to Facebook users filling out "what Hogwarts House are you?" quizzes, anyway?
That's a little amusing just to imagine: 'Which Hogwarts house are you? Identify these traffic signals and we'll sort you into the proper house!'
Re: hCaptcha now runs on fifteen percent of the internet
#284Curious what people think about hCaptcha?
It is more annoying than reCAPTCHA if you don't aggressively block tracking. because I rarely need to solve it manually in reCAPTCHA, while it is not the case with hCaptcha.
Re: hCaptcha now runs on fifteen percent of the internet
#285Earlier quoted context omitted.
reCAPTCHA only needs to make a determination that the user is some human, not that they are any particular human. And reCAPTCHA is usable without being logged into Google’s identity system. The profiles it builds are clearly not associated with Google’s primary identity database, and its trivial if you don’t need to preserve identity to one-way hash every piece of data that GDPR considers user-identifying at the entr…
ReCaptcha seems to use your logged-in status (and, I’d guess, account reputation), along with an ip reputation score when deciding whether to serve a captcha or not. A GPDR request naming an IP address should allow them to provide those scores. If not, it’s easily demonstrable that they are storing and using information that they’re not including in a GPDR response, and they deserve their multi-billion dollar fine. A…
Logged in status and account reputation are obviously useful input, but reCAPTCHA objectively works without requiring login. IP reputation also obviously makes sense to take into account, but the fact that Google collects all of this fingerprinting information demonstrates that’s again only a part of what factors in. The same profile can show up from behind a different IP.
Not sure what you’re getting at about GDPR and IP reputation. GDPR says that an IP address is PII if it can be associated with an individual, but that doesn’t mean an IP address is a “subject” for the purpose of filing an Article 15 Data Subject Access Request. And it doesn’t mean that stored information that is keyed by an IP address is personal data, even if the IP address can be associated back to a particular individual.
I also find it strange that you’re talking about reCAPTCHA being “anti-trust candy” in the comments of an announcement about how a different captcha service now handles 15% of the entire internet.
Re: hCaptcha now runs on fifteen percent of the internet
#286I dislike the widespread use of captcha regardless of provider. I realize anything connected to the internet will be subject to automated abuse, and it's impossible to run some types of services without taking some steps to defend against it, but it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time. The exact details will vary based on the type of service, of c…
Why can't they just allow automated user agents? I should be able to scrape websites if I want to. Why do user agents have to be browsers?
Exactly, or be able to just use a text-mode browser.
Or wget to save a set of pages for later.
I understand protecting commenting with captcha, or contact forms. But captcha on regular read-only access to public web pages in the style of Cloudflare is a bit ridiculous.
One thing contact forms should have is a static indication there's a captcha in use. I've filled all too many forms that just sent my written text to void, because I block some domains.
Re: hCaptcha now runs on fifteen percent of the internet
#287Earlier quoted context omitted.
> If you show a captcha after a failed password, you need to show a one after a correct password as well. Otherwise you leak information. Presumably, if the person has entered the right username and password they're going to get access to the service at which point they'll know they entered the right one. What information exactly is leaked here?
The reason you'd want a captcha on a login page is to protect against brute-forcing of some sort. For example credential stuffing or a dictionary attack. The information the attacker is looking for is the validity of the password. If you want to use a captcha to protect against this, the outcome must be the same whether the password is valid or not. Because if you only show the captcha for failed logins, the attacker…
You use rate limiting to stop brute force attacks, not a captcha
Re: hCaptcha now runs on fifteen percent of the internet
#288I dislike the widespread use of captcha regardless of provider. I realize anything connected to the internet will be subject to automated abuse, and it's impossible to run some types of services without taking some steps to defend against it, but it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time. The exact details will vary based on the type of service, of c…
It's exactly how email spam filters evolved. They used to be completely local and even some DIY solutions, evolved to signature updates, but eventually the attacks grew so advanced that only online services could be updated and aggressive enough, which is of course how gmail took over the internet with near perfect spam filter (when was the last time you checked a gmail spam folder). The last generation of local spam…
Local spam filtering still works quite fine. It just needs a lot of data most users probably don't have when starting out.
I just use bogofilter, and it worked almost perfectly from the start, just because I saved years upon years of SPAM and HAM. 10's of thousands of messages each.
It got slightly worse over years, because I incrementally only train it on new SPAM but not on new HAM, because of laziness.
People probably have HAM archives, but don't usually save their SPAM, to be able to start using Bayesian spam filters right away with great results.
Personally I find it much better than whatever Google uses. I don't even bother with SMTP level domain/IP blacklists, or reverse IP/domain checks anymore. All mail is just passed right to the mailbox and is then pre-filtered by a bogofilter to SPAM folder that I check once weekly, and barely find any HAM there. I receive about 500k mails a year.
Re: hCaptcha now runs on fifteen percent of the internet
#289Earlier quoted context omitted.
Why can't they just allow automated user agents? I should be able to scrape websites if I want to. Why do user agents have to be browsers?
This doesn't mix well with the ad-based compensation model. Sadly, there still doesn't seem to be much in the way of micropayment infrastructure.
That's a feature if you ask me. The whole point of scraping websites is to get the data I want while discarding noise like interface chrome and advertising directly to the garbage.
If they'd like me to pay for access, they should return HTTP 402 Payment Required instead of letting me download the page for free. Perhaps they could also rate limit the network connection to prevent denial of service. Why straight up block automated user agents though? That sucks.
Re: hCaptcha now runs on fifteen percent of the internet
#290Earlier quoted context omitted.
Just looked on Takeout and there don't seem to be any reCAPTCHA data there. I wonder what a GDPR request would produce.
Someone on here has tried to get all their data from both Facebook and Google. I wish I could find the blog post. The tech companies are claiming their Takeout/equivalent is sufficient under the GDRP and anything extra we ask for is not being provided due to it being "non user understandable" or in a "machine format". IIRC.
That's still their data though, no?