Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

hCaptcha now runs on fifteen percent of the internet

hcaptcha.com

Post reply on HN
Print view View original

231–240 of 380 posts

Re: hCaptcha now runs on fifteen percent of the internet

#231

Post by olliej »

protoduction wrote: post #224
asutekku wrote: post #217

Earlier quoted context omitted.

So your solution is to technically waste electricity to replace captcha? It's for sure an interesting concept, the first point and low-end devices requiring 20+ seconds to pass are not a very good points to sell your service.

You're right that there is an electricity cost to solving this type of captcha - the same as there is an electricity cost to loading 2MB of JS+images and clicking the pictures with the fire hydrants (and the infrastructure behind that). It's hard to estimate how they compare (and what value you assign to the human labor performed and privacy loss). 20 seconds would be a fairly high difficulty. It's up to the site own…

20s doesn’t matter when it’s someone else’s hardware (eg spammers using malware installed on victim machines).

It’s also nonsense to compare the computational cost of N seconds of sustained, maxed out useless computation to the milliseconds of compute time needed to decode an image, or the minimal power usage of waiting on network data.

Re: hCaptcha now runs on fifteen percent of the internet

#232

Post by protoduction »

peterhunt wrote: post #216
protoduction wrote: post #154

Earlier quoted context omitted.

I built an alternative[0] that takes a proof of work approach. As a site owner you set the difficulty that makes sense for you: so perhaps you would want 20 seconds of computation before you can submit. The nice thing is that this can happen entirely in the background while the user fills in the form. Also with multiple requests from the same IP in a short timespan, the difficulty increases. There are downsides to to…

proof of work really doesn't work well in practice. spammers have huge farms of compute, often on residential ips, and legit users are accessing the service from a device that is often power-constrained (like a phone). you end up either hugely penalizing legitimate users, or having to employ many of the standard antispam techniques (IP/ISP reputation, captcha, rate limiting etc) on top, so the proof of work adds a lo…

It's not perfect, and you are right about the downsides. These resources that spammers have can be applied as easily to re/hcaptcha (either through ML or clickfarms). No CAPTCHA will actually lock out targeted attacks.

The difficulty increase per IP can be seen as a form of soft rate limiting, it's shared between all websites (which is where it's different from ordinary rate limiting). In the future we may use IP reputation lists to guide the initial difficulty too - but we haven't implemented that yet.

I think that no perfect captcha can exist, which is inherent to the problem. Proof of work makes different fradeoffs, and perhaps it is cheaper to attack still - I think it's a much more friendly solution for users though (accessibility, privacy, simplicity, fairness, UX).

Maybe in the future the solution would be something like this: a long PoW-based captcha that runs in the background as well as a vision task for the user, whichever gets solved first.

Re: hCaptcha now runs on fifteen percent of the internet

#234

Post by WillPostForFood »

eatbots wrote: post #160
judge2020 wrote: post #57

Earlier quoted context omitted.

> We use it in invisible mode and it does a great job at finding bots while getting out of users' way. Interesting didn't realize this was a thing hcaptcha did[0]. It's basically recaptcha in terms of tracking which sites you visit then, no? 0: https://docs.hcaptcha.com/invisible

Compared to reCAPTCHA v3, our approach does not depend on tracking your visit history. (disclosure: work there.)

Would you pass this feedback on? Having completely opaque pricing is a big red flag. I assume it is very expensive, or else you couldn't afford to route inquiries through a sales rep. If you aren't hiding a high price, you should publish it. Also, and this is a strong personal preference, I never ever want to talk to or hear from a sales rep.

Re: hCaptcha now runs on fifteen percent of the internet

#235

Post by mobjack »

BMSmnqXAE4yfe1 wrote: post #178
hombre_fatal wrote: post #68

Earlier quoted context omitted.

> could be straightforwardly removed or replaced with rate limiting login attempts per IP This is very outdated intuition. Fresh IP addresses cost peanuts. For example, your solution still allows an attacker to run a 50k item /login combolist against one of your users with $5 of botnet time, each IP address trying a single uname/pass combo. Here you pay $18/GB to multiplex your abuse (cred stuffing being classic non-…

This scenario is not realistic, as you can just lengthen time between subsequent login attempts per username.

Attackers only need one attempt per username.

They will use a leaked list of millions of username and passwords, then use a botnet to try them all on another website.

Re: hCaptcha now runs on fifteen percent of the internet

#237

Post by lights0123 »

protoduction wrote: post #154
slx26 wrote: post #126

Earlier quoted context omitted.

> it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time As much as I agree with your dislike of captchas, I don't think this is true at scale (unless universal online identities existed, which could and should include anonymous identifiers by design). When you need to accept information from anonymous users (comments, votes, forms, registrations), there's no way…

I built an alternative[0] that takes a proof of work approach. As a site owner you set the difficulty that makes sense for you: so perhaps you would want 20 seconds of computation before you can submit. The nice thing is that this can happen entirely in the background while the user fills in the form. Also with multiple requests from the same IP in a short timespan, the difficulty increases. There are downsides to to…

And Cloudflare already does that—that's what the "Checking your browser before accessing xyz—Please allow up to 5 seconds" message means. It's clearly not enough for them though, because they then go to also require CAPTCHAs.

Re: hCaptcha now runs on fifteen percent of the internet

#238

Post by drusepth »

ve55 wrote: post #4

Worth noting that this title is primarily due to Cloudflare having switched to them from ReCAPTCHA, and Cloudflare is... well, relatively popular, to say the least. I'm curious what kind of data may exist on the experience of switching for larger providers; do the users like it? how much more/less time do they spend solving? do they care, let alone even notice that it's not Google's ReCAPTCHA? Regardless, as ReCAPTCH…

>do the users like it?

This is completely anecdotal (and seems antithetical to the typical HN response to hCaptcha vs ReCAPTCHA), but I feel like I end up spending at least twice as much time trying to solve hCaptchas successfully because they have a lot less consistency in the objects you're searching for. I always have to zoom in to the modal and carefully search through each image, which invariably breaks whatever flow I'm in (moreso than other captchas).

For example, here's a screenshot from the hCaptcha website's "try it out" section [1] -- I barely recognized either boat in image #1 because it was so small. I missed image #3 because I didn't realize it was a huge cruise-esque boat (so big you can't even see any water) and I spent a good amount of time deliberating on #4 because, well, it looks like a car + windshield but... on the water? If it's a boat, I can't really tell, but I marked it as one solely because of the water in the background. Not sure if it was right or not.

It also seems to occasionally provide "find all the X" challenges without there actually being any X, which feels super cognitively weird ("am I just not seeing it?!").

I'd say ReCAPTCHA's main problem is deciding whether mostly-consistent objects being partially in-frame is enough to "count", whereas hCaptcha's main problem is actually recognizing the widely-varying objects in the frame. I think the former is a little more frustrating when you get something wrong, but the latter is mentally "harder" and takes more time on average, for me at least.

[1] https://i.imgur.com/uyqvs5u.png from https://www.hcaptcha.com/

Re: hCaptcha now runs on fifteen percent of the internet

#239

Post by gingerlime »

svacko wrote: post #225
gingerlime wrote: post #146

Earlier quoted context omitted.

Last time I enquired they quoted starting $999/mo for 10m verifications...

Thank you. That's not a small sum, though they probably have some internal tiers per number of requests so for lower traffic scenarios the monthly price might be more affordable.

I asked and they said that’s the minimum, and they had no plans to introduce smaller self-serve tiers.

Re: hCaptcha now runs on fifteen percent of the internet

#240

Post by White_Wolf »

tbh it no ammount of captcha will help a popular platform. If you go black hat for around $150 in private proxies + poster bot + spinner + (insert capcha service here because I dont' want to advertise them) you can pretty much spam anything for a while.

That being said it does make it harder to spam if you don't have a budget to start with.

Post reply on HN