Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

hCaptcha now runs on fifteen percent of the internet

hcaptcha.com

Post reply on HN
Print view View original

291–300 of 380 posts

Re: hCaptcha now runs on fifteen percent of the internet

#291

Post by eatbots »

YetAnotherNick wrote: post #268
einpoklum wrote: post #259

Earlier quoted context omitted.

Wait, that's the hCaptcha policy? Can you link to it on their website?

Updated it in end. By the way I am not in anyways related to hcaptcha. Just sharing it because they don't seem to be the saint that everyone else is believing them here.

Please read the second line at the very top of that page:

"Not Applicable to Third Party Websites. Please note that this Privacy Policy does not apply to any website, offering, product or service of any third party, even if it links to our Site or incorporates the Service – please refer to the applicable privacy policies before deciding to provide any information to third parties."

End user data is governed by the Data Processing Agreement, linked here: https://www.hcaptcha.com/terms

Re: hCaptcha now runs on fifteen percent of the internet

#292

Post by gregmac »

I see there's several "captcha solving services" (Google the term, I don't want to link any) that charge in the $1's per 1000 solves. This makes me wonder how effective captchas really are. Do they just raise the bar high enough so only spammers actually making money attack the more lucrative sites?

Can anyone talk about their experience running a (large) service with a spam problem where adding a captcha helped? How about still battling bots/spam/abuse despite having a captcha?

Supposedly these services have humans solving these. I remember hearing about a bypass in use where the attacker would pass-through captchas and present them to users on their own pirate/torrent/porn/etc sites, and then when the user solved it, they'd get at the content and the spammer would do whatever they were doing on the original site. I wonder if that technique is still in use, or if there are people specifically sitting there solving captchas all day being paid fractional pennies per solve?

Re: hCaptcha now runs on fifteen percent of the internet

#293

Post by wraptile »

gregmac wrote: post #292

I see there's several "captcha solving services" (Google the term, I don't want to link any) that charge in the $1's per 1000 solves. This makes me wonder how effective captchas really are. Do they just raise the bar high enough so only spammers actually making money attack the more lucrative sites? Can anyone talk about their experience running a (large) service with a spam problem where adding a captcha helped? How…

Captchas are not effective at preventing attacks at all. There are many human and AI powered services as well as secret exploits that attackers can use. Captchas only stop spam, amateur scripts and web-scrapers.

It's a real shame that because of this "safety feature" the web is losing is programability. You can't even curl many pages these days let alone write some programs that connect to the web. This whole bloated scene of browser emulation had to be spawned and now instead of serving 1kb htmls to few friendly bots several megabytes of junk traffic and countless processing cycles are wasted on some menial tasks like retrieving sport match results from the internet.

The problem with these captcha services are _free_ which means people just throw them anywhere. Imagine a world where land mines are free for everyone at the tip of their fingers - you could hardly go outside! Well you can hardly go online now.

Re: hCaptcha now runs on fifteen percent of the internet

#294

Post by lovegoblin »

smittywerben wrote: post #226
slx26 wrote: post #126

Earlier quoted context omitted.

> it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time As much as I agree with your dislike of captchas, I don't think this is true at scale (unless universal online identities existed, which could and should include anonymous identifiers by design). When you need to accept information from anonymous users (comments, votes, forms, registrations), there's no way…

CAPTCHA does not scale. CAPTCHA spams real people with requests and wastes my VALUABLE time, and still labels disabled people as subhuman. It's offensive. It's ineffective. It's outdated. It's reaching a point where encapsulating a VPN with anti-captcha is something I'd pay for.

> CAPTCHA is the worst option, except for all the others that have been tried.

Re: hCaptcha now runs on fifteen percent of the internet

#295

Post by lovegoblin »

matheusmoreira wrote: post #264
Zak wrote: post #48

I dislike the widespread use of captcha regardless of provider. I realize anything connected to the internet will be subject to automated abuse, and it's impossible to run some types of services without taking some steps to defend against it, but it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time. The exact details will vary based on the type of service, of c…

Why can't they just allow automated user agents? I should be able to scrape websites if I want to. Why do user agents have to be browsers?

Being scraped isn't free, if it's at a large enough scale.

Plus, it's not just benign read-only scrapers. Have you looked at the spam folder of your email recently? That's what every comment section and user bio and god knows what else would look like if you just blindly allow all automated traffic.

Re: hCaptcha now runs on fifteen percent of the internet

#296

Post by riversflow »

dodobirdlord wrote: post #285
hedora wrote: post #206

Earlier quoted context omitted.

ReCaptcha seems to use your logged-in status (and, I’d guess, account reputation), along with an ip reputation score when deciding whether to serve a captcha or not. A GPDR request naming an IP address should allow them to provide those scores. If not, it’s easily demonstrable that they are storing and using information that they’re not including in a GPDR response, and they deserve their multi-billion dollar fine. A…

Logged in status and account reputation are obviously useful input, but reCAPTCHA objectively works without requiring login. IP reputation also obviously makes sense to take into account, but the fact that Google collects all of this fingerprinting information demonstrates that’s again only a part of what factors in. The same profile can show up from behind a different IP. Not sure what you’re getting at about GDPR a…

>GDPR says that an IP address is PII if it can be associated with an individual, but that. . . doesn’t mean that stored information that is keyed by an IP address is personal data, even if the IP address can be associated back to a particular individual.

Okay, I’m usually pretty good at understanding law, but this doesn’t make sense to me. This seems like a very shallow, arbitrary definition of subject data. So GDPR didn’t grant ownership of one’s PII? What did it grant ownership of? I’m very confused by this.

Re: hCaptcha now runs on fifteen percent of the internet

#297

Post by riversflow »

dsabanin wrote: post #43
dheera wrote: post #29

Earlier quoted context omitted.

reCaptcha has also gotten increasingly annoying lately. I forgot my password to one site and tried about 2 or 3 different passwords and in-between each it asked me to do about 7 or 8 of those labelling exercises. I finally just gave up and left the site. Not only that, but the labelling exercises weren't clear. It wanted me to label a "公交車" which means more like a public city bus and there were also school buses whic…

Recently Google's captcha asked me to mark all the traffic meters on the photos, and amongst the choices was a photo of a mailbox. It didn't let me through until I marked it as a meter as well. Good luck to whatever self driving car they are training using this data.

Well that might be my handiwork! About half the time I have to do an reCaptcha i mislabel one of the photos. Because I’m not being paid, I’m being held hostage to an automated system and I will rebel.

Re: hCaptcha now runs on fifteen percent of the internet

#298

Post by hansvm »

protoduction wrote: post #154
slx26 wrote: post #126

Earlier quoted context omitted.

> it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time As much as I agree with your dislike of captchas, I don't think this is true at scale (unless universal online identities existed, which could and should include anonymous identifiers by design). When you need to accept information from anonymous users (comments, votes, forms, registrations), there's no way…

I built an alternative[0] that takes a proof of work approach. As a site owner you set the difficulty that makes sense for you: so perhaps you would want 20 seconds of computation before you can submit. The nice thing is that this can happen entirely in the background while the user fills in the form. Also with multiple requests from the same IP in a short timespan, the difficulty increases. There are downsides to to…

Ignoring the other criticisms because they generally seem valid, to everyone saying that proof of work doesn't matter because bots can just use more machines, that depends a lot on the economics of any specific automation project. I scrape a little data here and there, and a reliable proof of work system costing ~20s on a commodity core would make some of my personal projects cost tens of thousands of dollars monthly. Maybe that's worth it to someone (e.g. if they have an army of hacked machines without anything better to do), but I think it'd keep a lot of the riffraff out.

Re: hCaptcha now runs on fifteen percent of the internet

#299

Post by newscracker »

I like that this isn’t Google and isn’t tracking people. I tried this on its own homepage. I didn’t find it a whole lot easier (I was asked to choose photos with boats in them), but it was a little more easier than the blurry photos on reCAPTCHA.

What I didn’t like: when I looked for pricing information, I saw that there’s a free tier and there’s a “Contact Sales” tier (for enterprise). There is no intermediate level if you want finer control and just want to know how much that could cost. If anyone from hCaptcha is reading this, I’d strongly recommend adding one or two more tiers or expanding the feature set of the current free tier, at least for some level of granular control.

Post reply on HN