Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Moving from reCAPTCHA to hCaptcha

blog.cloudflare.com

Post reply on HN
Print view View original

161–170 of 200 posts

Re: Moving from reCAPTCHA to hCaptcha

#161

Post by drusepth »

MertsA wrote: post #156
dheera wrote: post #137

Earlier quoted context omitted.

Sounds like a cat and mouse game. Mouse: They could then try to analyze human delay randomness -- it's probably not uniform. Cat: And then someone will come up with a replacement to randomDelay that mimics the above pattern. Mouse: And then they will look for changes in the distribution itself from person to person etc.

I know back in the day for RuneScape bots using SCAR there were macros to move the mouse from one position to another on the screen with randomized acceleration, randomized curvature, overshoot, clicking in some bounding box, etc. all using a normal distribution in an effort to thwart detection. Imagine being the poor developer tasked with trying to recover some signal out of that.

Just alt-tabbed in from writing runescape bots to HN and wanted to say that's still the case (for the client I use). The code is pretty complicated now but still functions much like you say. Mouse position is tracked, then any input which repositions the mouse accelerates at a "reasonable rate" and with a randomized curvature to get "close enough" before it self-corrects and gets a pixel-perfect click.

A few years ago the client stopped sending mouse data back to Jagex altogether. Luckily, I don't think there's many poor developers tasked with trying to recover any signal out of that anymore. :)

Re: Moving from reCAPTCHA to hCaptcha

#162

Post by bscphil »

jakear wrote: post #76
fludlight wrote: post #32

Earlier quoted context omitted.

Google pays Mozilla to be the default search engine in firefox. This is Mozilla's main source of revenue, so I doubt they will sue.

I wonder why they don’t negotiate with Msft to use Bing or even DDG instead. Seems... incredibly odd... to put oneself in a position where a third party is directly antagonizing your users, reducing your user satisfaction and likely dramatically increasing churn, but you can’t do anything about it because that same party is your main source of funding. (Disclaimer, I work at msft. Nowhere near this though).

If I recall correctly, the last time I checked Google's support for Mozilla was in the hundreds of millions per year. I would be shocked if DDG could afford even 10% of that, even as an investment they expected to recoup through additional advertising revenue.

Re: Moving from reCAPTCHA to hCaptcha

#163

Post by gsich »

zachware wrote: post #21

One of the more insidious elements of ReCAPTCHA is its propensity to challenge users who have robust cookie blocking in place. So as we encourage people to be more privacy-aware, the web gets harder and harder to use. We've seen ReCAPTCHA pop all over ecommerce, all over benign websites with little to no need to challenge use almost completely because of the increase in privacy-aware users. ReCAPTCHA essentially flie…

I use buster to solve recaptcha.

Re: Moving from reCAPTCHA to hCaptcha

#164

Post by icebraining »

karatestomp wrote: post #123
quotemstr wrote: post #87

Earlier quoted context omitted.

You've made an assertion, not an argument. What does "anti-human" even mean? You're angry, sure, but you haven't expressed what exactly it is that you're angry about. Nor have you proposed a realistic alternative way to distinguish bots from humans. This kind of histrionic, sweeping hot take is not productive.

Considering captchas operate by pushing the work of avoiding bots on your site (your problem) onto all the human users of your site , I think on the basis of that alone "anti-human" is warranted. Or "anti-social", if you prefer, which might better capture the fundamental problem with that aspect of it. That they proceed to perform textbook gaslighting on some of those people makes it even worse ("no, you didn't selec…

Are movie theaters anti-human because they push the work of avoiding freeloaders (their problem) onto all human users of the theater by making them carry and show tickets?

Re: Moving from reCAPTCHA to hCaptcha

#165

Post by drusepth »

cdubzzz wrote: post #131
noncoml wrote: post #38

IMHO CPATCHA is a lazy way to protect your service as you shift the burden to your users. Maybe if you are big and essential for some users, you can afford that. But if not, be aware that users will turn their back on you if you add obstacles between them and your service. Edit: meant to say “be aware that some users will turn their back to you”

> IMHO CPATCHA is a lazy way to protect your service as you shift the burden to your users. What is the non-lazy solution to having a basic website contact form that _doesn't_ receive hundreds of spam submission per day?

Like most kinds of gated security, many solutions are borne out of inspecting the payload instead of who's sending it.

Captchas prevent bots from submitting spam, but they don't prevent humans from submitting spam. In 99% of cases, your problem is the spam, not who is submitting it. The non-lazy solution is to look at the content itself and directly determine whether it's spam, instead of relying on a related heuristic (e.g. who submitted it) to make an informed guess.

Re: Moving from reCAPTCHA to hCaptcha

#166

Post by Keverw »

jccalhoun wrote: post #62

I've ran into hCaptcha a couple times recently and found it vague and I had to try to guess what they meant. Both times it asked me to identify the truck. Well, what do you mean by "truck?" are you counting a semi as a truck? I ended up having to do it twice because I don't consider a semi a "truck" but they did.

Interesting, I know some people consider a Truck a semi but your pick up truck isn't really a truck according to others. So confusing with all the different definitions.

Re: Moving from reCAPTCHA to hCaptcha

#167

Post by drusepth »

ship_it wrote: post #24
jasonhansel wrote: post #10

Has anyone else seen reCAPTCHA getting way more difficult of late? It often takes me a full minute to find all of the tiny traffic lights hidden away in a set of low-quality images.

Just use Buster[1] [1] https://chrome.google.com/webstore/detail/buster-captcha-sol...

Worth noting that it's possible to get a hellban if you get too many wrong guesses using extensions like Buster.

Re: Moving from reCAPTCHA to hCaptcha

#168

Post by andrenotgiant »

zachware wrote: post #21

One of the more insidious elements of ReCAPTCHA is its propensity to challenge users who have robust cookie blocking in place. So as we encourage people to be more privacy-aware, the web gets harder and harder to use. We've seen ReCAPTCHA pop all over ecommerce, all over benign websites with little to no need to challenge use almost completely because of the increase in privacy-aware users. ReCAPTCHA essentially flie…

> One of the more insidious elements of ReCAPTCHA is its propensity to challenge users who have robust cookie blocking in place... ...So good on Cloudflare.

Just to be clear: Cloudflare is only changing the _provider_ of CAPTCHA's. They are not changing the _criteria_ for showing CAPTCHA's.

So users who have robust cookie blocking in place will continue to be penalized.

Re: Moving from reCAPTCHA to hCaptcha

#169

Post by gentleman11 »

jjoonathan wrote: post #67
zachware wrote: post #21

One of the more insidious elements of ReCAPTCHA is its propensity to challenge users who have robust cookie blocking in place. So as we encourage people to be more privacy-aware, the web gets harder and harder to use. We've seen ReCAPTCHA pop all over ecommerce, all over benign websites with little to no need to challenge use almost completely because of the increase in privacy-aware users. ReCAPTCHA essentially flie…

That, and ReCAPTCHA had hellbans. If you blocked cookies or were otherwise problematic, it would sometimes lock you out of all ReCAPTCHA-gated resources not by giving you a message describing what was happening, why, and how to fix it, but rather by simply pretending that your every attempt to solve the captcha failed. Obviously this is extremely frustrating, by design, but it gets even more so with compounding facto…

I must have been hell banned in the past. It used to take 30 mins to log into humble bundle because of the endless stoplights and sidewalks, I buy a lot fewer bundles now since I’m still a little bitter.

Now I just deliberately give bad answers and get to “pass” the challenges... not sure why

Post reply on HN