Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

hCaptcha now runs on fifteen percent of the internet

hcaptcha.com

Post reply on HN
Print view View original

351–360 of 380 posts

Re: hCaptcha now runs on fifteen percent of the internet

#351

Post by aurbano »

shuringai wrote: post #278
peterhunt wrote: post #216

Earlier quoted context omitted.

proof of work really doesn't work well in practice. spammers have huge farms of compute, often on residential ips, and legit users are accessing the service from a device that is often power-constrained (like a phone). you end up either hugely penalizing legitimate users, or having to employ many of the standard antispam techniques (IP/ISP reputation, captcha, rate limiting etc) on top, so the proof of work adds a lo…

bangladeshi click farms[0] are cheaper to use to bypass captcha than renting residential proxies to solve PoW. Also image captcha cannot scale automatally in difficulty (as an incident response) but PoW can (see how bitcoin adjusts with the miners) [0] https://2captcha.com/

Just did the math from the numbers on their site and on average a "worker" doing captchas for them gets paid 0.2$/hour.

Adjusting based on average monthly salary in Bangladesh (157$) [1] and the US (4056$) [2] that would be similar to an American making 5.2$/hour which is surprisingly close to the current minimum wage in the US (7.25$/hour) [3]

So I guess this must be a fairly decent way to earn money if you're young/poor in Bangladesh...

[1] https://tradingeconomics.com/bangladesh/wages#:~:text=Wages%.... [2] https://www.thestreet.com/personal-finance/average-income-in... [3] https://en.wikipedia.org/wiki/Minimum_wage_in_the_United_Sta...

Re: hCaptcha now runs on fifteen percent of the internet

#352

Post by sxt »

protoduction wrote: post #232
peterhunt wrote: post #216

Earlier quoted context omitted.

proof of work really doesn't work well in practice. spammers have huge farms of compute, often on residential ips, and legit users are accessing the service from a device that is often power-constrained (like a phone). you end up either hugely penalizing legitimate users, or having to employ many of the standard antispam techniques (IP/ISP reputation, captcha, rate limiting etc) on top, so the proof of work adds a lo…

It's not perfect, and you are right about the downsides. These resources that spammers have can be applied as easily to re/hcaptcha (either through ML or clickfarms). No CAPTCHA will actually lock out targeted attacks. The difficulty increase per IP can be seen as a form of soft rate limiting, it's shared between all websites (which is where it's different from ordinary rate limiting). In the future we may use IP rep…

This reminds me of a similar solution I saw on PH last year, I think it's a great alternative for smaller websites that are less likely to be targets for spams/bots

But say, there's a website and it's a likely target, you implement IP protection, fine, the user uses residential proxies. Now your best bet is to go off fingerprinting, but there are marketplaces which sell those too in bulk.

Maybe I'm wrong, but wouldn't the best approach be to stick to human interaction puzzles, which are hard and don't have a set way to solve by a machine(for now)?

Re: hCaptcha now runs on fifteen percent of the internet

#353

Post by dorgo »

3np wrote: post #336
slx26 wrote: post #126

Earlier quoted context omitted.

> it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time As much as I agree with your dislike of captchas, I don't think this is true at scale (unless universal online identities existed, which could and should include anonymous identifiers by design). When you need to accept information from anonymous users (comments, votes, forms, registrations), there's no way…

> unless universal online identities existed, which could and should include anonymous identifiers by design Yes but no. Anonymized identifiers can be deanonymized. They should utilize zero-knowledge proofs in such a way that they can prove "yes, I have an identity verified by entity X (and Y and Z) (based on passport/phone number/...)", without disclosing any of those details. It could, optionally, yield an identifi…

>"yes, I have an identity verified by entity X (and Y and Z) (based on passport/phone number/...)", without disclosing any of those details.

Actually, I would prefer: "Yey, this one-use temporary ID is tied to an identity which is known to behave on public websites." Or "... is tied to an identity which is known to be knowledgeable on topic X". Or whatever information is needed at the time.

Next time a new ID will be generated and the identity provider will vouch for it. No passport or phone number should be required.

Edit: fixed spelling.

Re: hCaptcha now runs on fifteen percent of the internet

#354

Post by sxt »

judge2020 wrote: post #15
ve55 wrote: post #4

Worth noting that this title is primarily due to Cloudflare having switched to them from ReCAPTCHA, and Cloudflare is... well, relatively popular, to say the least. I'm curious what kind of data may exist on the experience of switching for larger providers; do the users like it? how much more/less time do they spend solving? do they care, let alone even notice that it's not Google's ReCAPTCHA? Regardless, as ReCAPTCH…

For site operators, they don’t like the change since users are more likely to complain to the website than directly to CF. The following community post has 20k views and >100 replies asking Cloudflare to move back to recaptcha in some form. https://community.cloudflare.com/t/stop-using-hcaptcha/15896...

> hCaptcha is making cloudflare money by earning them Human Tokens on the Ethereum blockchain

> Most people do the convenience from Google CAPTCHA, although they sell some kind of info, but they won’t hurt you

I can't even...this is the Cloudflare forum wow.

I've personally had a few hiccups with hCaptcha quite some time back as I "wasn't sure what I was looking for" and consistently fail on VPNs. But in recent months these there's definitely been substantial improvement , and needless to say I hope to see hCaptcha be the majority provider

Re: hCaptcha now runs on fifteen percent of the internet

#355

Post by GekkePrutser »

Aunche wrote: post #209
GekkePrutser wrote: post #138

Earlier quoted context omitted.

I would start with blocking those 72 million addresses for starters :)

Many of these ip addresses would also be shared by servers of legitimate businesses and VPNs.

True, but blocking them stimulates them to stop renting them out to such services.

Re: hCaptcha now runs on fifteen percent of the internet

#356

Post by mnw21cam »

account42 wrote: post #345
bluGill wrote: post #203

Earlier quoted context omitted.

I sent a email to my representative, which got my automatically added to her newsletter. But the unsubscribe link doesn't work without solving one...

Where? That would not be legal in many countries and I suggest you try reporting it.

Let me guess... You can try reporting it to the authorities, but they need you to solve a CAPTCHA first.

Re: hCaptcha now runs on fifteen percent of the internet

#357

Post by ttsda »

freeqaz wrote: post #243
gaieges wrote: post #42

Earlier quoted context omitted.

> Google's reCaptcha code seemed to be very keen on knowing my 'cadence' or the way I used my mouse and how quickly (or how slow) I completed the captcha. It also looked at things like timezone, screen resolution, battery charge level etc So they could determine if it was 'you' who was using the captcha, soon after, in a separate session (even on a different device!) I'd bet a good amount that they store that along w…

Just turn on "Resist Fingerprinting" in Firefox and you'll find ReCAPTCHA _really_ annoying! I have to solve 3-5 "panes" of a ReCAPTCHA on _every_ page... It's very annoying that preserving privacy comes with this cost. I almost want to just add a "DeathByCaptcha" extension to handle these for me and pay a few cents for every page I visit, lol

It's way cheaper than that, you'll pay significantly less than a cent for each captcha.

Re: hCaptcha now runs on fifteen percent of the internet

#360

Post by slx26 »

3np wrote: post #336
slx26 wrote: post #126

Earlier quoted context omitted.

> it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time As much as I agree with your dislike of captchas, I don't think this is true at scale (unless universal online identities existed, which could and should include anonymous identifiers by design). When you need to accept information from anonymous users (comments, votes, forms, registrations), there's no way…

> unless universal online identities existed, which could and should include anonymous identifiers by design Yes but no. Anonymized identifiers can be deanonymized. They should utilize zero-knowledge proofs in such a way that they can prove "yes, I have an identity verified by entity X (and Y and Z) (based on passport/phone number/...)", without disclosing any of those details. It could, optionally, yield an identifi…

Maybe "anonymous identifiers" has some very technical and exact meaning that I didn't know, but when I said "anonymous identifiers" I did it very abstractly, no need to assume a specific underlying implementation from those two words.

I have actually discussed the concept in the past [0], and I exchanged some emails with the guy in that thread to talk more about technical details. We all seem to agree that design and political will are the problems, not technology.

What I was basically saying in the comments, in general terms, is that you might have one primary identifier, and then somehow you can get more identifiers that are tied to your main one, but that might have different expiration periods, might grant access to different levels of information about you, and might be limited to a certain number for each service you use. Of course, there are quite a few ways to implement such a system. And that's precisely why I'm more focused on the design, usability and characteristics than the underlying technical implementation; I think the best we can do if we ever want to see this happen is to spread the idea in terms that anyone can understand [1]. I mean, I'm interested in the technical details too, so I'm just complementing and contextualizing a bit here.

[0] https://news.ycombinator.com/item?id=22180120

[1] ...or discuss more the idea among those that are interested and setup a demo website to make it easier to spread the word, even if there's no actual implementation behind it and it's just a mock-up. I'm quite busy at the moment, but I'll definitely do something along those lines when I have some time.

Post reply on HN