Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Moving from reCAPTCHA to hCaptcha

blog.cloudflare.com

Post reply on HN
Print view View original

81–90 of 200 posts

Re: Moving from reCAPTCHA to hCaptcha

#81

Post by Kalium »

zachware wrote: post #21

One of the more insidious elements of ReCAPTCHA is its propensity to challenge users who have robust cookie blocking in place. So as we encourage people to be more privacy-aware, the web gets harder and harder to use. We've seen ReCAPTCHA pop all over ecommerce, all over benign websites with little to no need to challenge use almost completely because of the increase in privacy-aware users. ReCAPTCHA essentially flie…

One of the non-obvious consequences is that any system designed to use technical measures to distinguish between humans and computers will wind up very sensitive. There's an arms race, and us real users are caught in the middle.

There's a vast army of computers doing their best to pretend to be human. The whole point of any kind of CAPTCHA is to try to catch them out - and every measure gets worse over time. So companies like Google look at everything they can see that helps them distinguish typical humans from robots.

This has a nasty side-effect. A lot of measures intended to preserve privacy have the incidental effect of making the privacy-sensitive user look more like a computer and less like a human. Not saving cookies and not executing JS are classic bot moves. This plays directly into the sensitivity that has been engineered over time in order to catch more computers posing as humans.

I don't know any easy resolution to this tension. Maybe you do? I really hope so. The internet is overrun with abusive behavior and the amount of work that goes into keeping it at bay is staggering.

Re: Moving from reCAPTCHA to hCaptcha

#82

Post by IAmEveryone »

_nickwhite wrote: post #50

From the article: "We evaluated a number of CAPTCHA vendors as well as building a system ourselves." and "We worked with hCAPTCHA in two ways. First, we are in the process of leveraging our Workers platform to bear much of the technical load of the CAPTCHAs and, in doing so, reduce their costs. And, second, we proposed that rather than them paying us we pay them. This ensured they had the resources to scale their ser…

CF likes the CAPTCHA part of CAPTCHAS, but any vendor is probably far more invested in the "generating ML training data" scheme.

CF probably has zero interest in that part of the product: It doesn't fit with their existing products nor customers, and it's just too small relative to their other business to devote much attention to it.

At the same time, the business opportunity is probably too large for hCAPTCHA's founders to just forget about it, or for CF to compensate them on the hot-new-technology assumption when they're only looking for peace-of-mind-utility tech.

Re: Moving from reCAPTCHA to hCaptcha

#83

Post by Kalium »

elric wrote: post #14

It's a start. reCAPTCHA is a notorious pain in the arse for anyone whose browser isn't Chrome and for anyone who doesn't keep cookies. I'm not sure if hCaptcha will be better, but it's hard to imagine it being any worse.

The hCaptcha website states that whoever publishes it will get paid for the data labeling work users do.

Not to wax cynical, this seems like it might not encourage better behavior in every possible scenario.

Re: Moving from reCAPTCHA to hCaptcha

#84

Post by alexnewman »

Hey everyone. HCaptcha founder here. We are so happy to be on hackernews. I'm curious if anyone is having any problems? We are trying hard to respond carefully to customer requests but as you can guess we are very busy. Also we are hiring :)

Re: Moving from reCAPTCHA to hCaptcha

#85

Post by 101404 »

RadiantUnicorn wrote: post #75
jjoonathan wrote: post #67

Earlier quoted context omitted.

That, and ReCAPTCHA had hellbans. If you blocked cookies or were otherwise problematic, it would sometimes lock you out of all ReCAPTCHA-gated resources not by giving you a message describing what was happening, why, and how to fix it, but rather by simply pretending that your every attempt to solve the captcha failed. Obviously this is extremely frustrating, by design, but it gets even more so with compounding facto…

I don't think I've ever been "hellbanned", but I've certainly spent more than 5 minutes on trying to get a captcha to work. After a while I usually need to ask friends in the US to help me, because it asks me a non-localized question. My favourite question was: Select all fire hydrants. I selected only the classic red one's you see in movies. Fail. I selected the one's that were yellow too. Fail. I sent a picture of…

I see a million dollar lawsuit for discrimination >:-}

Re: Moving from reCAPTCHA to hCaptcha

#86

Post by [deleted] »

elric wrote: post #14

It's a start. reCAPTCHA is a notorious pain in the arse for anyone whose browser isn't Chrome and for anyone who doesn't keep cookies. I'm not sure if hCaptcha will be better, but it's hard to imagine it being any worse.

[deleted]

Re: Moving from reCAPTCHA to hCaptcha

#87

Post by quotemstr »

_jal wrote: post #73
jjoonathan wrote: post #67

Earlier quoted context omitted.

That, and ReCAPTCHA had hellbans. If you blocked cookies or were otherwise problematic, it would sometimes lock you out of all ReCAPTCHA-gated resources not by giving you a message describing what was happening, why, and how to fix it, but rather by simply pretending that your every attempt to solve the captcha failed. Obviously this is extremely frustrating, by design, but it gets even more so with compounding facto…

Captchas are fundamentally anti-human. I'm not saying there isn't a problem to be solved, I'm saying Captchas are a behavior enforcement mechanism overseen by robots and are anti-human. I write the site owner short note when they go bad explaining why they just lost a customer and go somewhere else. Life is too short to put up with shitty tech.

You've made an assertion, not an argument. What does "anti-human" even mean? You're angry, sure, but you haven't expressed what exactly it is that you're angry about. Nor have you proposed a realistic alternative way to distinguish bots from humans. This kind of histrionic, sweeping hot take is not productive.

Re: Moving from reCAPTCHA to hCaptcha

#88

Post by Nicksil »

0xff00ffee wrote: post #34
noad wrote: post #26

Earlier quoted context omitted.

You're forgetting the main benefit for google, which is getting humans to train all their vision models for free. At one point they were just forcing X% of clicks to fill out a captcha regardless of origin or identity just to get more data. I for one am getting quite tired of trillion dollar corporations getting things for free out of me. Hard pass.

Did you even RTFA and look at hCAPTCHA? hCAPTCHA couldn't be more grossly focused on neural-net training. Hell, one challenge asks you to draw a bounding box and another is a classification tagging.

There was no argument being made for HCAPTCHA in the post to which you replied. So, yeah, everything you mentioned is indeed gross, including Google's behavior.

Re: Moving from reCAPTCHA to hCaptcha

#89

Post by sgc »

Kalium wrote: post #83
elric wrote: post #14

It's a start. reCAPTCHA is a notorious pain in the arse for anyone whose browser isn't Chrome and for anyone who doesn't keep cookies. I'm not sure if hCaptcha will be better, but it's hard to imagine it being any worse.

The hCaptcha website states that whoever publishes it will get paid for the data labeling work users do. Not to wax cynical, this seems like it might not encourage better behavior in every possible scenario.

I doubt it's enough money to tank peoples' traffic over it.

Re: Moving from reCAPTCHA to hCaptcha

#90

Post by Kalium »

sgc wrote: post #89
Kalium wrote: post #83

Earlier quoted context omitted.

The hCaptcha website states that whoever publishes it will get paid for the data labeling work users do. Not to wax cynical, this seems like it might not encourage better behavior in every possible scenario.

I doubt it's enough money to tank peoples' traffic over it.

I'm quite sure you're correct. When stacked against however much Google was going to charge (I assume more than zero), Cloudflare's incentives seem pretty clear to me.
Post reply on HN