Live data from Hacker News

Moving from reCAPTCHA to hCaptcha

blog.cloudflare.com

51–60 of 200 posts

Re: Moving from reCAPTCHA to hCaptcha

#51

From the article: "We evaluated a number of CAPTCHA vendors as well as building a system ourselves." and "We worked with hCAPTCHA in two ways. First, we are in the process of leveraging our Workers platform to bear much of the technical load of the CAPTCHAs and, in doing so, reduce their costs. And, second, we proposed that rather than them paying us we pay them. This ensured they had the resources to scale their ser…

I suspect that might happen eventually.

Re: Moving from reCAPTCHA to hCaptcha

#52

From the article: "We evaluated a number of CAPTCHA vendors as well as building a system ourselves." and "We worked with hCAPTCHA in two ways. First, we are in the process of leveraging our Workers platform to bear much of the technical load of the CAPTCHAs and, in doing so, reduce their costs. And, second, we proposed that rather than them paying us we pay them. This ensured they had the resources to scale their ser…

At the end they mention that there long term goal is to eliminate captchas fully if possible.

Re: Moving from reCAPTCHA to hCaptcha

#53
post #26

Earlier quoted context omitted.

You're forgetting the main benefit for google, which is getting humans to train all their vision models for free. At one point they were just forcing X% of clicks to fill out a captcha regardless of origin or identity just to get more data. I for one am getting quite tired of trillion dollar corporations getting things for free out of me. Hard pass.

> You're forgetting the main benefit for google, which is getting humans to train all their vision models for free. Is this still true? I keep seeing the same type of images for years and there might be 7 or 8 different categories but that's it. To me reCaptcha looks like a service well in its maintenance phase. If it was actually in use for training purposes you might expect images to match a wider range of tasks.

I've lost track of how many times I've had to read house numbers from Google Street View...

Re: Moving from reCAPTCHA to hCaptcha

#54
post #22

> "Earlier this year, Google informed us that they were going to begin charging for reCAPTCHA. That is entirely within their right. Cloudflare, given our volume, no doubt imposed significant costs on the reCAPTCHA service, even for Google." Even in the article they say... "Google provided reCAPTCHA for free in exchange for data from the service being used to train its visual identification systems." ... I thought thi…

In the article they also say: > Again, this is entirely rational for Google. If the value of the image classification training did not exceed those costs, it makes perfect sense for Google to ask for payment for the service they provide. This might be exacerbated in the case of Cloudfare. Imagine a system where 99% of the visitors being challenged are human. The data gathered from such visitors is quiet, quality data…

I guess this is very true. Our quite elaborate Cloudflare Firewall setup combining bot management scores with GeoIP and network information to decide on the action has solve rates below 0.5% on most rules.

The only case where we see up to 3% solved is on rules targeting networks which contain mostly free (as in beer) VPN providers (the new pest of the internet). Those networks sent a lot of malicious and automated traffic with the mixed in 3% of real users.

To put this into numbers of the past 24h: ~ 76 Million requests served ~ 1 Million of those were captchas ~ 0.5 Million were outright blocked Captchas solved: 1233

Re: Moving from reCAPTCHA to hCaptcha

#55
Apart from the surveillance aspect, one thing that bothered the hell out of me with Cloudflare using ReCAPTCHA was that it yielded a much larger part of the web than necessary effectively blocked in China, since the CAPTCHAs would get triggered, and not load, from Chinese IPs.

I had a customer where we had to migrate away from Cloudflare for this reason - this was about 5 years ago and the issue has been there to this day. Glad to hear they've finally done something about it. Even if it took Google starting to charge money for ReCAPCHA to trigger it.

Re: Moving from reCAPTCHA to hCaptcha

#56

> "Earlier this year, Google informed us that they were going to begin charging for reCAPTCHA. That is entirely within their right. Cloudflare, given our volume, no doubt imposed significant costs on the reCAPTCHA service, even for Google." Even in the article they say... "Google provided reCAPTCHA for free in exchange for data from the service being used to train its visual identification systems." ... I thought thi…

It's probably a question of size. Same as with Google Analytics. Google can afford to offer it free of charge for smaller websites but charges for larger ones. Cloudflare was probably one of the heaviest users with a very high percentage of bots (as they're good in pre-filtering).

Re: Moving from reCAPTCHA to hCaptcha

#57
Well. That's probably fantastic news; using ReCAPTCHA (and thereby making users subject to Google's tender mercies) was honestly my main reason to dislike cloudflare from a user's perspective. ReCAPTCHA is utterly foul; it follows you everywhere it can, exists to undermine privacy, punishes non-Chrome users, and throws you in an infinite loop when it decides that you're not a human.

Re: Moving from reCAPTCHA to hCaptcha

#58
post #38

IMHO CPATCHA is a lazy way to protect your service as you shift the burden to your users. Maybe if you are big and essential for some users, you can afford that. But if not, be aware that users will turn their back on you if you add obstacles between them and your service. Edit: meant to say “be aware that some users will turn their back to you”

Yes it's trade off as usual. The main benefit I see is on networks where you've a mix of good and bad traffic and you would still like to offer the service to the few good users. I see this a lot on networks hosting a lot of free VPN providers. The other option we choose before was outright blocking. That is even more harmful for the few good users.

Re: Moving from reCAPTCHA to hCaptcha

#59
post #17

Earlier quoted context omitted.

Seeing that reCAPTCHA v3 doesn't use endless streams of images any more, I would guess that Google no longer benefits much from having users tag storefronts, traffic lights, buses or fire hydrants. Maybe their image recognition algorithm is past that stage.

It does as a fallback. But you’re missing the main point of v3, which is that it shifts the legal onus of blocking from Google to the integrating site. No longer can Google be sued for accessibility violations, if it’s the site that’s stopping the user from entering purely on a suggestion from Google.

Just because you do some technically workarounds doesn't mean you get a legal free pass.

I don't think this aspect did matter much because it was always the sites decision to use reCAPTCHA and that didn't change.

I also don't think Google gets much profit out of the image tagging part anymore, they already have a huge database of tagged images.

Re: Moving from reCAPTCHA to hCaptcha

#60

Earlier quoted context omitted.

> You're forgetting the main benefit for google, which is getting humans to train all their vision models for free. Is this still true? I keep seeing the same type of images for years and there might be 7 or 8 different categories but that's it. To me reCaptcha looks like a service well in its maintenance phase. If it was actually in use for training purposes you might expect images to match a wider range of tasks.

I've lost track of how many times I've had to read house numbers from Google Street View...

I haven't gotten one of those in years. These days it's just picking out buses, cars, traffic signals, and sometimes motorcycles. Maybe once in a while it'll ask for storefronts.
Post reply on HN