Live data from Hacker News

Moving from reCAPTCHA to hCaptcha

blog.cloudflare.com

131–140 of 200 posts

Re: Moving from reCAPTCHA to hCaptcha

#131
post #38

IMHO CPATCHA is a lazy way to protect your service as you shift the burden to your users. Maybe if you are big and essential for some users, you can afford that. But if not, be aware that users will turn their back on you if you add obstacles between them and your service. Edit: meant to say “be aware that some users will turn their back to you”

> IMHO CPATCHA is a lazy way to protect your service as you shift the burden to your users.

What is the non-lazy solution to having a basic website contact form that _doesn't_ receive hundreds of spam submission per day?

Re: Moving from reCAPTCHA to hCaptcha

#132
post #85

Earlier quoted context omitted.

I don't think I've ever been "hellbanned", but I've certainly spent more than 5 minutes on trying to get a captcha to work. After a while I usually need to ask friends in the US to help me, because it asks me a non-localized question. My favourite question was: Select all fire hydrants. I selected only the classic red one's you see in movies. Fail. I selected the one's that were yellow too. Fail. I sent a picture of…

I see a million dollar lawsuit for discrimination >:-}

Now imagine if that ReCAPTCHA was served on an equal opportunity lender's website or on a job application form.

Re: Moving from reCAPTCHA to hCaptcha

#133
post #130
post #120

Earlier quoted context omitted.

It is pretty straightforward to train a neural network to solve these -- e.g. fire hydrants, traffic lights, cars. I would have thought ReCAPTCHA would take into account human factors (e.g. speed of clicking) as higher priority to the accuracy of the selection.

AFAIK it takes into account mouse movement and the speed of clicks.

In my experience, relatively easily defeated by `await Promise.delay(randomDelay())`

Re: Moving from reCAPTCHA to hCaptcha

#134
post #30
post #20

Earlier quoted context omitted.

By now, I almost immediately close a page with a reCAPTCHA, because the stream of buses, traffic lights, and cycles never seems to end when you're using Firefox. And then it says "too many requests from this computer" and refuses to continue.

I'm amazed Mozilla hasn't sued Google for discriminating against their browser - I also use Firefox and suffer endlessly using privacy tools. I can prove there are no more busses and I'm 100% right, but I can predict 100% of the time it'll say "please try again". The pattern seems to be 2/3 'right' guesses. on sites like eBay, the captcha is broke on firefox. I complete it, and it says "you need to resubmit this form…

I have managed to successfully solve the audio CAPTCHA before (even though the pictures are impossible to solve), although now they must have disabled it because it doesn't work.

Re: Moving from reCAPTCHA to hCaptcha

#135

Well. That's probably fantastic news; using ReCAPTCHA (and thereby making users subject to Google's tender mercies) was honestly my main reason to dislike cloudflare from a user's perspective. ReCAPTCHA is utterly foul; it follows you everywhere it can, exists to undermine privacy, punishes non-Chrome users, and throws you in an infinite loop when it decides that you're not a human.

I don't blame reCAPTCHA for existing, I blame Cloudfare for using. It made using Tor literally impossible. Hopefully this will be better.

Didn't Privacy Pass help here?

Re: Moving from reCAPTCHA to hCaptcha

#136
post #115
post #73

Earlier quoted context omitted.

Captchas are fundamentally anti-human. I'm not saying there isn't a problem to be solved, I'm saying Captchas are a behavior enforcement mechanism overseen by robots and are anti-human. I write the site owner short note when they go bad explaining why they just lost a customer and go somewhere else. Life is too short to put up with shitty tech.

What, in your opinion, is the pro-human way to address the problem to be solved? I'm always curious to hear what other approaches might be worth considering. CAPTCHAs tend to tick the boxes of performing well enough for website-controllers and being low-effort for them to deploy.

Less gaslighting.

There's a lot of ground between "error messages precise enough to effectively give botters a to-do list" and "faking failures 100 times in a row." What was the marginal utility of the 99th fakeout? Are there really enough otherwise effective bots that get persistently tripped up by this particular fakeout to justify sending the poor kid crying to his room?

Almost certainly not. What really happened is that someone removed (or never added) user communication in order to maximize their score against botters and gave little thought to mitigating their false positives. Minimizing them, yes, mitigating them, no. "Humans are smart, they'll figure it out," they rationalized to themselves, and called it a day. They never bothered to calculate (or even guess) when the marginal utility of the fakeout dropped far enough to allow them to have mercy on the poor humans still caught in their web.

Re: Moving from reCAPTCHA to hCaptcha

#137
post #130

Earlier quoted context omitted.

AFAIK it takes into account mouse movement and the speed of clicks.

In my experience, relatively easily defeated by `await Promise.delay(randomDelay())`

Sounds like a cat and mouse game.

Mouse: They could then try to analyze human delay randomness -- it's probably not uniform.

Cat: And then someone will come up with a replacement to randomDelay that mimics the above pattern.

Mouse: And then they will look for changes in the distribution itself from person to person

etc.

Re: Moving from reCAPTCHA to hCaptcha

#138

Earlier quoted context omitted.

According to the article Cloudfront is paying, but is paying "a fraction of what reCAPTCHA would have [cost]". Recaptcha is $1/1000 challenges, so apparently hcaptcha is some small fraction of that. Cloudfront might get a discount for running some of the infrastructure on their own servers, on the other hand that might also be an integration hassle that actually costs them money.

> Recaptcha is $1/1000 challenges This seems unwise, because many captcha farms charge less than this. A quick Google search shows one service offering $0.50/1000 challenges. If it's 2x cheaper for an attacker to solve a captcha than it is for a provider to display it, it sounds like the attackers win.

Good point! The economy of scale is one of the ways to fight against spam bots

Re: Moving from reCAPTCHA to hCaptcha

#139

Earlier quoted context omitted.

That, and ReCAPTCHA had hellbans. If you blocked cookies or were otherwise problematic, it would sometimes lock you out of all ReCAPTCHA-gated resources not by giving you a message describing what was happening, why, and how to fix it, but rather by simply pretending that your every attempt to solve the captcha failed. Obviously this is extremely frustrating, by design, but it gets even more so with compounding facto…

I don't think I've ever been "hellbanned", but I've certainly spent more than 5 minutes on trying to get a captcha to work. After a while I usually need to ask friends in the US to help me, because it asks me a non-localized question. My favourite question was: Select all fire hydrants. I selected only the classic red one's you see in movies. Fail. I selected the one's that were yellow too. Fail. I sent a picture of…

Yeah, I should break down my methodology for arriving at the "hellban" conclusion.

If I get a bunch of failures in a row, I'll first try the refresh button built into the captcha, and then re-solve a number of times. Then I'll try re-loading the page and re-solving, then I'll try in a different browser with cleared state and re-solving, then I'll try a different device and re-solving, and finally I'll try a different connection, device, and cleared browser state and re-solving.

I'll consider something a hellban if I get persistent failures across several different challenge types but switching to a clean connection+device+state results in immediate success with the captcha.

Look, I get it, they can't be too explicit with the errors or they tip their hand to the botters and effectively give them a "to-do" list. Still, the gaslighting is persistent enough that there's just no way it's marginally beneficial all the way through. At some point, everyone figures it out: bots, techies, and normies. My guess is that they figure it out in this order, from quickest to slowest: smart bots, techies, normies, dumb bots. I'm not calling normies dumb here, they just don't have much background knowledge about the inner workings of captchas, so it takes longer. By that point, they're so far past the typical number of captcha attempts that only the very dumbest of bots, those without heuristics to detect this sort of thing, are going to be fooled along with them. Surely having the captcha tip its hand at this point -- which only gives an advantage to the dumbest of bots, because the smart bots figured it out long ago -- is the right thing to do.

Re:CAPTCHA has no mercy on the normies, and I really think they could do a lot better.

Re: Moving from reCAPTCHA to hCaptcha

#140
post #95

Earlier quoted context omitted.

> the vast majority of which will not be empathically awful Yeah, most of the time it's "just" really, really obnoxious, not to mention coercive in a way that aligns with Google's interests. Thanks, Google. > How, in your opinion, should Google have handled the matter in a way that does not give spammers or other abusive users ways to get around the measure? "Our anti-spam systems believe that you might be a robot. Y…

In my opinion and experience, ReCAPTCHA isn't really, really obnoxious most of the time. I suspect that most of the time it trips up bots who have no emotional experiences whatsoever. Most of my personal encounters with it involve solving no puzzles whatsoever. With that in mind, I expect humans and their completely real reactions might not be the default case. Of course, this is speculative, as I do not have any kin…

> In my opinion and experience, ReCAPTCHA isn't really, really obnoxious most of the time.

Do you use any sort of privacy protection while browsing? I do a few simple things like browse in private mode by default, and ReCAPTCHA just cannot deal with it. It instantly brands my connections as a bot. It is obnoxious. Using private mode shouldn't ban you from the web. There's no reason that most web sites need to save data on my computer to identify me later.

Post reply on HN