Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Moving from reCAPTCHA to hCaptcha

blog.cloudflare.com

Post reply on HN
Print view View original

141–150 of 200 posts

Re: Moving from reCAPTCHA to hCaptcha

#141

Post by thewebcount »

blakesterz wrote: post #3

> "Earlier this year, Google informed us that they were going to begin charging for reCAPTCHA. That is entirely within their right. Cloudflare, given our volume, no doubt imposed significant costs on the reCAPTCHA service, even for Google." Even in the article they say... "Google provided reCAPTCHA for free in exchange for data from the service being used to train its visual identification systems." ... I thought thi…

> Google provided reCAPTCHA for free in exchange for data from the service being used to train its visual identification systems.

Has this been true lately? Every time I see it, it gives me the same images from a set of 3. 90% of the time it's classifying street lights, and it's the same street lights every time. About 7% of the time, it's pictures with cars in them, and again, it's the same pictures most times (but in a different order, I think). The remaining times it's fire hydrants or store fronts, often in a language I can't read, so I don't know if it's a store or not. (And again - mostly the same images each time.)

Re: Moving from reCAPTCHA to hCaptcha

#142

Post by floatingatoll »

dheera wrote: post #120
RadiantUnicorn wrote: post #75

Earlier quoted context omitted.

I don't think I've ever been "hellbanned", but I've certainly spent more than 5 minutes on trying to get a captcha to work. After a while I usually need to ask friends in the US to help me, because it asks me a non-localized question. My favourite question was: Select all fire hydrants. I selected only the classic red one's you see in movies. Fail. I selected the one's that were yellow too. Fail. I sent a picture of…

It is pretty straightforward to train a neural network to solve these -- e.g. fire hydrants, traffic lights, cars. I would have thought ReCAPTCHA would take into account human factors (e.g. speed of clicking) as higher priority to the accuracy of the selection.

Regularity of clicking is considered a sign of robot behavior, which is especially frustrating if you learned to perform repetitive image identification mouse tasks in a computer with rhythmic regularity (think Turk, for example).

Re: Moving from reCAPTCHA to hCaptcha

#143

Post by jfengel »

Kalium wrote: post #115
_jal wrote: post #73

Earlier quoted context omitted.

Captchas are fundamentally anti-human. I'm not saying there isn't a problem to be solved, I'm saying Captchas are a behavior enforcement mechanism overseen by robots and are anti-human. I write the site owner short note when they go bad explaining why they just lost a customer and go somewhere else. Life is too short to put up with shitty tech.

What, in your opinion, is the pro-human way to address the problem to be solved? I'm always curious to hear what other approaches might be worth considering. CAPTCHAs tend to tick the boxes of performing well enough for website-controllers and being low-effort for them to deploy.

Blockchain, perhaps?

A lot of CAPTCHAs protect things that are very cheap, but where they don't want it to be free. One solution would be to charge money, but people concerned about privacy won't want to give away conventional payment information.

So, perhaps a nominal payment in some reasonably anonymous cryptocurrency? Or even just participating in some proof-of-work problem that would cost a few cents worth of electricity?

That wouldn't stop really serious botnets or people with stolen credit cards, but those are also both illegal and should be shut down for other reasons.

Re: Moving from reCAPTCHA to hCaptcha

#144

Post by noncoml »

cdubzzz wrote: post #131
noncoml wrote: post #38

IMHO CPATCHA is a lazy way to protect your service as you shift the burden to your users. Maybe if you are big and essential for some users, you can afford that. But if not, be aware that users will turn their back on you if you add obstacles between them and your service. Edit: meant to say “be aware that some users will turn their back to you”

> IMHO CPATCHA is a lazy way to protect your service as you shift the burden to your users. What is the non-lazy solution to having a basic website contact form that _doesn't_ receive hundreds of spam submission per day?

"receive hundreds of spam submission per day"

But this is exactly the point I am trying to make. That's the service provider's problem and not the user's. CAPTCHA shifts the problem to the user.

CAPTCHA is a 00's idea, when we had the multiple page registrations(with errors showing only after you submit the page), the insane password requirements, etc.. It doesn't belong to modern stack in my opinion.

"What is the non-lazy solution?" That's how disruption is born.

Re: Moving from reCAPTCHA to hCaptcha

#145

Post by cdubzzz »

noncoml wrote: post #144
cdubzzz wrote: post #131

Earlier quoted context omitted.

> IMHO CPATCHA is a lazy way to protect your service as you shift the burden to your users. What is the non-lazy solution to having a basic website contact form that _doesn't_ receive hundreds of spam submission per day?

"receive hundreds of spam submission per day" But this is exactly the point I am trying to make. That's the service provider's problem and not the user's. CAPTCHA shifts the problem to the user. CAPTCHA is a 00's idea, when we had the multiple page registrations(with errors showing only after you submit the page), the insane password requirements, etc.. It doesn't belong to modern stack in my opinion. "What is the no…

> "What is the non-lazy solution?" That's how disruption is born.

So there is no non-lazy solution.

I get your point about shifting the problem, but that's kind of the only option for the vast majority of website operators (particularly small ones).

I have zero love for CAPTCHA myself, I have put time and effort in to other, server-side solutions but none perform even remotely as well.

Re: Moving from reCAPTCHA to hCaptcha

#146

Post by Kalium »

thewebcount wrote: post #140
Kalium wrote: post #95

Earlier quoted context omitted.

In my opinion and experience, ReCAPTCHA isn't really, really obnoxious most of the time. I suspect that most of the time it trips up bots who have no emotional experiences whatsoever. Most of my personal encounters with it involve solving no puzzles whatsoever. With that in mind, I expect humans and their completely real reactions might not be the default case. Of course, this is speculative, as I do not have any kin…

> In my opinion and experience, ReCAPTCHA isn't really, really obnoxious most of the time. Do you use any sort of privacy protection while browsing? I do a few simple things like browse in private mode by default, and ReCAPTCHA just cannot deal with it. It instantly brands my connections as a bot. It is obnoxious. Using private mode shouldn't ban you from the web. There's no reason that most web sites need to save da…

That's an excellent question! I can, and do, routinely use privacy protections when browsing.

I have not found them to ban me from the web. I'm sorry that has happened to you.

Re: Moving from reCAPTCHA to hCaptcha

#147

Post by thewebcount »

cdubzzz wrote: post #131
noncoml wrote: post #38

IMHO CPATCHA is a lazy way to protect your service as you shift the burden to your users. Maybe if you are big and essential for some users, you can afford that. But if not, be aware that users will turn their back on you if you add obstacles between them and your service. Edit: meant to say “be aware that some users will turn their back to you”

> IMHO CPATCHA is a lazy way to protect your service as you shift the burden to your users. What is the non-lazy solution to having a basic website contact form that _doesn't_ receive hundreds of spam submission per day?

Honest question - if you set it up so the user gets an email with a link they have to click before their message is actually sent to your queue, would that help?

I'm thinking it would probably reduce the number of users who successfully contacted you legitimately, but CAPTCHAs also do that. Do spammers actually have the email accounts they claim to and respond to confirmation emails?

Re: Moving from reCAPTCHA to hCaptcha

#148

Post by cdubzzz »

thewebcount wrote: post #147
cdubzzz wrote: post #131

Earlier quoted context omitted.

> IMHO CPATCHA is a lazy way to protect your service as you shift the burden to your users. What is the non-lazy solution to having a basic website contact form that _doesn't_ receive hundreds of spam submission per day?

Honest question - if you set it up so the user gets an email with a link they have to click before their message is actually sent to your queue, would that help? I'm thinking it would probably reduce the number of users who successfully contacted you legitimately, but CAPTCHAs also do that. Do spammers actually have the email accounts they claim to and respond to confirmation emails?

It would definitely help, I highly doubt spammers would use that sort of mechanism.

The solution gets around potential vendor lock-in and privacy issues with a service like Google's, but it still fundamentally shifts the problem from the service to the user (the original commentor's gripe).

Re: Moving from reCAPTCHA to hCaptcha

#149

Post by aaron695 »

meowface wrote: post #117
wongarsu wrote: post #107

Earlier quoted context omitted.

According to the article Cloudfront is paying, but is paying "a fraction of what reCAPTCHA would have [cost]". Recaptcha is $1/1000 challenges, so apparently hcaptcha is some small fraction of that. Cloudfront might get a discount for running some of the infrastructure on their own servers, on the other hand that might also be an integration hassle that actually costs them money.

> Recaptcha is $1/1000 challenges This seems unwise, because many captcha farms charge less than this. A quick Google search shows one service offering $0.50/1000 challenges. If it's 2x cheaper for an attacker to solve a captcha than it is for a provider to display it, it sounds like the attackers win.

This only works if you are Soviet Russia vs the USA and your plan is to ruin the other by draining their money and you have equal pools of cash.

Spammers don't want to hurt the company they attack if they can help it, they need them!

I don't understand why ReCAPTCHA cost so much though. A human solving them is cheaper than a computer/human hybrid creating them?

Re: Moving from reCAPTCHA to hCaptcha

#150

Post by aaron695 »

So no one can turn free human labour into enough money to pay hosting fees?

And given spammers a lot of the time are messing with Google, it's also in Google's interest to do this for free!

What are they thinking? Is this one department make $100 internally while killing $1000 in another internal department?

Post reply on HN