Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

hCaptcha now runs on fifteen percent of the internet

hcaptcha.com

Post reply on HN
Print view View original

361–370 of 380 posts

Re: hCaptcha now runs on fifteen percent of the internet

#361

Post by withinboredom »

10000truths wrote: post #205
protoduction wrote: post #185

Earlier quoted context omitted.

Everybody gets the same difficulty initially which you determine as a site admin, so one should base this on their audience (e.g. Gitlab would have a different device profile from a government website). The solving can be a few times slower on a low end device which you should keep in mind. To aid with this when setting the difficulty for your website it shows you an estimate for various device types. This is indeed…

Why bother with a proof of work scheme when you can just rate-limit directly? It accomplishes the same thing, while eating way fewer CPU cycles, doesn’t require JavaScript, and guarantees uniform cost between all client types.

So, if your app takes off on a college campus, you’d block them?

Re: hCaptcha now runs on fifteen percent of the internet

#362

Post by matheusmoreira »

octoberfranklin wrote: post #332
entangledqubit wrote: post #265

Earlier quoted context omitted.

This doesn't mix well with the ad-based compensation model. Sadly, there still doesn't seem to be much in the way of micropayment infrastructure.

> there still doesn't seem to be much in the way of micropayment infrastructure. Anti Money Laundering regulation killed it: KYC doesn't scale down to micropayment levels. If you want to fix the web, you have to roll back the AML/KYC insanity. Until that happens, the web will stay broken, because paying with attention (ads) is magically exempt from the AML/KYC insanity, whereas paying with money or anything money-equ…

> the AML/KYC insanity

Just finished reading about this and I completely agree. I can't imagine having a company and being literally obligated by law to violate everything I personally believe in about privacy and freedom just to help the government be even more efficient at marginalizing people.

Re: hCaptcha now runs on fifteen percent of the internet

#363

Post by bluGill »

account42 wrote: post #345
bluGill wrote: post #203

Earlier quoted context omitted.

I sent a email to my representative, which got my automatically added to her newsletter. But the unsubscribe link doesn't work without solving one...

Where? That would not be legal in many countries and I suggest you try reporting it.

As in US house of representives. Cheri Busto to be exact in case someone works with her.

Re: hCaptcha now runs on fifteen percent of the internet

#364

Post by withinboredom »

protoduction wrote: post #185
withinboredom wrote: post #171

Earlier quoted context omitted.

How do handle low-end devices? Do you reduce the difficulty for them and can this be abused by pretending to be a low-end device that really isn't?

Everybody gets the same difficulty initially which you determine as a site admin, so one should base this on their audience (e.g. Gitlab would have a different device profile from a government website). The solving can be a few times slower on a low end device which you should keep in mind. To aid with this when setting the difficulty for your website it shows you an estimate for various device types. This is indeed…

Do you collect metrics on how many people end up waiting for the PoW and share that with the admins?

In all, this sounds really promising though. I’d venture that most spammers already have higher end machines than end-users to solve existing captchas.

I’d probably approach this with a different strategy. I’d send an encrypted time stamp as the nonce. On the client, I’d first do a few easy PoW tasks and estimate the PoW difficulty for the given machine that would take at least X seconds to do. Then, send the PoW, the encrypted time stamp, and difficulty to the backend. If it’s been shorter than X (with a margin of error), or the PoW is wrong, it’s not valid.

In this scheme, it doesn’t matter how powerful the device is, a core is going to do some work for X seconds or at least be throttled by time.

Re: hCaptcha now runs on fifteen percent of the internet

#366

Post by capableweb »

protoduction wrote: post #154
slx26 wrote: post #126

Earlier quoted context omitted.

> it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time As much as I agree with your dislike of captchas, I don't think this is true at scale (unless universal online identities existed, which could and should include anonymous identifiers by design). When you need to accept information from anonymous users (comments, votes, forms, registrations), there's no way…

I built an alternative[0] that takes a proof of work approach. As a site owner you set the difficulty that makes sense for you: so perhaps you would want 20 seconds of computation before you can submit. The nice thing is that this can happen entirely in the background while the user fills in the form. Also with multiple requests from the same IP in a short timespan, the difficulty increases. There are downsides to to…

I just tried loading the demo of Friendly Captcha in 8 browser windows, and click the verify button, refresh the window and on repeat for about 3 minutes. Not once did it tell me that I'm a robot so seems your alternative fails the most basic of captcha functionality, limiting people/machines to spam functionality that the website owner wants to be limited.

Maybe not everyone but a lot of people use captcha services to prevent automation from being used to extract/insert data. I know as a developer that there is always a chance of bypassing this, even with Google's reCaptcha, but your service seems to make this trivial, so many won't even go beyond your demo.

Re: hCaptcha now runs on fifteen percent of the internet

#367

Post by dustinmoris »

aurbano wrote: post #351
shuringai wrote: post #278

Earlier quoted context omitted.

bangladeshi click farms[0] are cheaper to use to bypass captcha than renting residential proxies to solve PoW. Also image captcha cannot scale automatally in difficulty (as an incident response) but PoW can (see how bitcoin adjusts with the miners) [0] https://2captcha.com/

Just did the math from the numbers on their site and on average a "worker" doing captchas for them gets paid 0.2$/hour. Adjusting based on average monthly salary in Bangladesh (157$) [1] and the US (4056$) [2] that would be similar to an American making 5.2$/hour which is surprisingly close to the current minimum wage in the US (7.25$/hour) [3] So I guess this must be a fairly decent way to earn money if you're young…

5.2 is not close to 7.25. That's like 30% less than the minimum wage. Minimum wage itself is a massive struggle but 30% less is just plain offensive and dehumanising.

> So I guess this must be a fairly decent way to earn money if you're young/poor in Bangladesh...

Solving dumb captchas is never a fair or decent way to earn money, not when you are poor and definitely not when you are young. Creating living conditions for other human beings where they can be easily exploited and used for mindless degrading work such as solving dumb captchas is one of the most grotesque things of the 21st century.

Re: hCaptcha now runs on fifteen percent of the internet

#368

Post by theon144 »

capableweb wrote: post #366
protoduction wrote: post #154

Earlier quoted context omitted.

I built an alternative[0] that takes a proof of work approach. As a site owner you set the difficulty that makes sense for you: so perhaps you would want 20 seconds of computation before you can submit. The nice thing is that this can happen entirely in the background while the user fills in the form. Also with multiple requests from the same IP in a short timespan, the difficulty increases. There are downsides to to…

I just tried loading the demo of Friendly Captcha in 8 browser windows, and click the verify button, refresh the window and on repeat for about 3 minutes. Not once did it tell me that I'm a robot so seems your alternative fails the most basic of captcha functionality, limiting people/machines to spam functionality that the website owner wants to be limited. Maybe not everyone but a lot of people use captcha services…

>Not once did it tell me that I'm a robot

Right, unfortunately you've completely misunderstood the point of Friendly Captcha, a question which is answered right there on its main page.

>>How does FriendlyCaptcha tell apart bots from humans?

>>It doesn't, FriendlyCaptcha adds a small cost and complexity for spammers that becomes large at scale.

Re: hCaptcha now runs on fifteen percent of the internet

#369

Post by capableweb »

theon144 wrote: post #368
capableweb wrote: post #366

Earlier quoted context omitted.

I just tried loading the demo of Friendly Captcha in 8 browser windows, and click the verify button, refresh the window and on repeat for about 3 minutes. Not once did it tell me that I'm a robot so seems your alternative fails the most basic of captcha functionality, limiting people/machines to spam functionality that the website owner wants to be limited. Maybe not everyone but a lot of people use captcha services…

>Not once did it tell me that I'm a robot Right, unfortunately you've completely misunderstood the point of Friendly Captcha, a question which is answered right there on its main page. >>How does FriendlyCaptcha tell apart bots from humans? >>It doesn't, FriendlyCaptcha adds a small cost and complexity for spammers that becomes large at scale.

Right, I guess it's time for you to upgrade the UI of your tool then, as when it's inactive it says "Anti-Robot Verification" and once the challenge is done it says "I'm not a robot", while in reality, none of those things are true, as you said yourself.

You might also want to rebrand to use a different word than "Captcha" as you're not actually telling robots and humans apart, you're simply adding PoW to an action, nevermind if they are robots or humans.

So instead of blaming users for misunderstanding your message, maybe try working on making your messaging a bit clearer so for the people who know what captcha is, don't get confused by your own definition of it.

Re: hCaptcha now runs on fifteen percent of the internet

#370

Post by zingplex »

lovegoblin wrote: post #294
smittywerben wrote: post #226

Earlier quoted context omitted.

CAPTCHA does not scale. CAPTCHA spams real people with requests and wastes my VALUABLE time, and still labels disabled people as subhuman. It's offensive. It's ineffective. It's outdated. It's reaching a point where encapsulating a VPN with anti-captcha is something I'd pay for.

> CAPTCHA is the worst option, except for all the others that have been tried.

I would happily pay 15¢ or so per site to bypass captchas if it were done in a way that would preserve my privacy. Has something like this ever been offered?
Post reply on HN