Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I was banned from the hCaptcha accessibility account for not being blind (2023)

michaels.world

Post reply on HN
Print view View original

81–90 of 277 posts

Re: I was banned from the hCaptcha accessibility account for not being blind (2023)

#81

Post by klez »

toast0 wrote: post #75
Spivak wrote: post #52

Earlier quoted context omitted.

I hope the other lesson was the good email verification hygiene of making the user take an affirmative action and click a "verify email" button rather then send it unsolicited. You essentially had an open public unauthed form that would send an email to any address you typed in it. Surely that alone raises some eyebrows.

How do you authenticate a verify email button?

It took me a while to understand what GP was trying to say, but I suppose they're thinking of one of those sites where they let you create an account, will let you in and then nag you for a while about "verifying your email address" by clicking a link that will actually send you an email. An unsophisticated spambot won't probably care enough to click through that.

Re: I was banned from the hCaptcha accessibility account for not being blind (2023)

#82

Post by jchw »

Telemakhos wrote: post #73
jchw wrote: post #41

I hope we can end the CAPTCHA experiment soon. It didn't work. Phone verification isn't good either, but for as much as I hate phone verification at least it actually raises the cost of spamming somewhat. CAPTCHA does not. Almost all turnkey CAPTCHA services can be solved for pennies. Solving the problems of SPAM and malicious traffic will be challenging... I am worried it will come down to three possible things: - A…

This doesn’t feel so much like the end of the “open web” as it does a rehash of USENET and email spam issues. Social media killed USENET, and email managed its spam issues thanks to filtering.

Email kind of solved its SPAM issues, but it came at great costs. It's possible but quite hard to run your own e-mail server; if you're not on a major provider, the possibility is high that a major provider will at some point have deliverability issues to or from you due to automated anti-SPAM measures. The degree of difficulty with participating in the network does somewhat degrade its openness in my opinion.

If anything works in the favor of email it is that email is not published. It is not necessary very private inherently, but it is at least not a system where things get broadcasted publicly. IMO this limits the value of spamming people over e-mail: you have to send a very high volume of e-mail to SPAM effectively over e-mail, and this high volume use pattern is not something that ordinary users will ever engage in, so it's easy to at least separate out "possible SPAM operation" versus "guy sending email to a friend". (I'm not saying that systems are necessarily perfect at distinguishing one from the other, but at the very least it would be hard to mistake the average Gmail account for being part of a massive SPAM operation. The volume is just too low.)

I hope the open web survives, but if e-mail is any kind of sign, it's not a great one in my opinion.

Re: I was banned from the hCaptcha accessibility account for not being blind (2023)

#83

Post by plingbang »

jchw wrote: post #41

I hope we can end the CAPTCHA experiment soon. It didn't work. Phone verification isn't good either, but for as much as I hate phone verification at least it actually raises the cost of spamming somewhat. CAPTCHA does not. Almost all turnkey CAPTCHA services can be solved for pennies. Solving the problems of SPAM and malicious traffic will be challenging... I am worried it will come down to three possible things: - A…

> It's tricky, though. What else can you do?

I had an idea about amost-privacy-preserving system by involving government ID and blind signatures:

1. The service passes a random string to the user. 2. The user authenticates to their government and asks the government to sign it. 3. The government applies a blind signature which basically says "this user/citizen hasn't registered an account in the last 60 minutes". 4. The government records the timestamp. 5. The user passes the signature back to the service.

Upsides:

* Bypassing this would be orders of magnitude more expensive than phone numbers. * Almost private

Downsides:

* Won't happen. Remote HW attestation is likely to win :( * The service knows your citizenship * The gov knows when and how often you register. * Any gov can always bypass the limits for themselves.

I think it may be also possible to extend it so that the government attests that you have only one account on the service but without being able to find which account is yours.

Re: I was banned from the hCaptcha accessibility account for not being blind (2023)

#84

Post by mindslight »

jchw wrote: post #41

I hope we can end the CAPTCHA experiment soon. It didn't work. Phone verification isn't good either, but for as much as I hate phone verification at least it actually raises the cost of spamming somewhat. CAPTCHA does not. Almost all turnkey CAPTCHA services can be solved for pennies. Solving the problems of SPAM and malicious traffic will be challenging... I am worried it will come down to three possible things: - A…

meh, continuing the pearl clutching and asserting there has to be some general "solution" is itself part of the problem. The sheer majority of captchas I come across are while browsing essentially static content. If simple source IP based rate limiting can't keep the server load at something manageable, then the real problem is with how the site is built. And adding even more bloat to address another managerial bullet point is exactly how it got that way.

Re: I was banned from the hCaptcha accessibility account for not being blind (2023)

#85

Post by jstanley »

ta1243 wrote: post #22
Rastonbury wrote: post #14

Some captchas are getting pretty discriminatory, not everyone lives in the West and can identify the objects they are asking you to. Another recent one sticks out where they asked me to pick a shape as the same number of conoids on screen. If you ask people on a street what a conoids I bet a significant amount will give you blank looks Also at least now I know some people call those markings crosswalks

Sorry I live in the west, what's a "crosswalk" Did you mean to say > not everyone lives in the USA Other things I don't have a clue about - a fire hydrant, yellow taxis, yellow buses (Obviously I do, because of American cultural imperialism through things like Captchas which mean the world has to understand American cultural touchstones)

You don't think you could identify yellow buses without cultural knowledge?

I think simply knowing "yellow" and "buses" would suffice.

Re: I was banned from the hCaptcha accessibility account for not being blind (2023)

#86

Post by binarycoffee »

Spivak wrote: post #52
stanmancan wrote: post #29

Earlier quoted context omitted.

I had to add a captcha to a registration page a couple years ago. Bots were signing up for thousands of fake accounts with other people’s email addresses. The email confirmation we sent would then get reported as spam since the recipient didn’t sign up for our service. Our email provider suspended our account for high spam reports.

I hope the other lesson was the good email verification hygiene of making the user take an affirmative action and click a "verify email" button rather then send it unsolicited. You essentially had an open public unauthed form that would send an email to any address you typed in it. Surely that alone raises some eyebrows.

Not a solution. Verification emails alone got a small web site I set up to be blacklisted within days. Most of the unwilling recipients presumably couldn't understand the language the verification email was written in and reported it as spam.

Re: I was banned from the hCaptcha accessibility account for not being blind (2023)

#87

Post by gruez »

michaelt wrote: post #26
jerf wrote: post #10

Earlier quoted context omitted.

Remember that from hCaptcha's point of view, by this point they've probably dealt with hundreds of other people claiming that they are blind when they really aren't, so their bots will work. This isn't a defense, just an explanation... but it is also an explanation of why the entire idea of "we'll not give blind people a way past the CAPTCHA but just give a pass to 'real' blind people so we can pass ADA", which is th…

> As big as Google, Facebook, or Amazon are, they would struggle under the load of trying to create a system for determining who is "truly" blind... and that's still true if we ignore questions like exactly what "blind" is anyhow. In several countries, the government issues certificates of blindness [1] which grant access to certain extra types of support. We don't want severely vision-impaired people being forced to…

This is a moot point anyways because the Americans with Disabilities act bans businesses from asking people about their specific disabilities. Asking for proof of blindness will almost certainly be in contravention of that.

Re: I was banned from the hCaptcha accessibility account for not being blind (2023)

#88

Post by RobMurray »

ta1243 wrote: post #22
Rastonbury wrote: post #14

Some captchas are getting pretty discriminatory, not everyone lives in the West and can identify the objects they are asking you to. Another recent one sticks out where they asked me to pick a shape as the same number of conoids on screen. If you ask people on a street what a conoids I bet a significant amount will give you blank looks Also at least now I know some people call those markings crosswalks

Sorry I live in the west, what's a "crosswalk" Did you mean to say > not everyone lives in the USA Other things I don't have a clue about - a fire hydrant, yellow taxis, yellow buses (Obviously I do, because of American cultural imperialism through things like Captchas which mean the world has to understand American cultural touchstones)

And audio Captchas are in English. I suppose blind people who don't speak English or have any kind of hearing difficulty don't deserve accessibility.

Re: I was banned from the hCaptcha accessibility account for not being blind (2023)

#89

Post by account42 »

jchw wrote: post #41

I hope we can end the CAPTCHA experiment soon. It didn't work. Phone verification isn't good either, but for as much as I hate phone verification at least it actually raises the cost of spamming somewhat. CAPTCHA does not. Almost all turnkey CAPTCHA services can be solved for pennies. Solving the problems of SPAM and malicious traffic will be challenging... I am worried it will come down to three possible things: - A…

A start would be what kinds of websites even need a CAPTCHA in the first place. Why does just viewing websites with static conent ever need to result in a captcha prompt.

Re: I was banned from the hCaptcha accessibility account for not being blind (2023)

#90

Post by grishka »

isodev wrote: post #21

Why are captchas even a thing still? If folks want to scrape something or build an automation around something, then why not let them do it? They still have to respect the system they're logging in. Not to mention the privacy perk of not exposing your visitors to some captcha service with a dozen or more data subprocessors.

Simple distorted-characters captchas still do a good job of catching unsophisticated bots, which is most of them. They work even better when combined with hidden form fields because these bots don't support CSS.

Targeted attacks though? You're making your legitimate users suffer only so that you defeat 99% of bots instead of 95%.

Post reply on HN