Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Moving from reCAPTCHA to hCaptcha

blog.cloudflare.com

Post reply on HN
Print view View original

91–100 of 200 posts

Re: Moving from reCAPTCHA to hCaptcha

#91

Post by dicytea »

tgv wrote: post #20
elric wrote: post #14

It's a start. reCAPTCHA is a notorious pain in the arse for anyone whose browser isn't Chrome and for anyone who doesn't keep cookies. I'm not sure if hCaptcha will be better, but it's hard to imagine it being any worse.

By now, I almost immediately close a page with a reCAPTCHA, because the stream of buses, traffic lights, and cycles never seems to end when you're using Firefox. And then it says "too many requests from this computer" and refuses to continue.

Does it help if you change your user agent?

Re: Moving from reCAPTCHA to hCaptcha

#92

Post by jjoonathan »

Kalium wrote: post #77
jjoonathan wrote: post #67

Earlier quoted context omitted.

That, and ReCAPTCHA had hellbans. If you blocked cookies or were otherwise problematic, it would sometimes lock you out of all ReCAPTCHA-gated resources not by giving you a message describing what was happening, why, and how to fix it, but rather by simply pretending that your every attempt to solve the captcha failed. Obviously this is extremely frustrating, by design, but it gets even more so with compounding facto…

How, in your opinion, should Google have handled the matter in a way that does not give spammers or other abusive users ways to get around the measure? Bear in mind that any such approach has to be scalable to many zeros daily, the vast majority of which will not be empathically awful cases like your brother's very real pain and distress - most will be genuinely abusive behavior. I want to be clear that I am not atte…

> the vast majority of which will not be empathically awful

Yeah, most of the time it's "just" really, really obnoxious, not to mention coercive in a way that aligns with Google's interests.

Thanks, Google.

> How, in your opinion, should Google have handled the matter in a way that does not give spammers or other abusive users ways to get around the measure?

"Our anti-spam systems believe that you might be a robot. Your profile has been locked for (x) minutes. Sorry for the inconvenience. Go _here_ to learn tips & tricks for avoiding lockouts in the future." X gets exponentially ramped.

Note how vague the message is. It sacrifices the opportunity to tarpit a really dumb robot in exchange for not being awful to humans.

Based on ReCAPTCHA's design decisions, it's abundantly clear that eeking out every sliver of a percent of marginal efficacy is the priority over treating users humanely. That's why I have a problem with ReCAPTCHA.

Re: Moving from reCAPTCHA to hCaptcha

#93

Post by eythian »

noncoml wrote: post #38

IMHO CPATCHA is a lazy way to protect your service as you shift the burden to your users. Maybe if you are big and essential for some users, you can afford that. But if not, be aware that users will turn their back on you if you add obstacles between them and your service. Edit: meant to say “be aware that some users will turn their back to you”

I run a small forum, and it was getting flooded with fake and spam accounts, the moderators were struggling to keep up and the users were finding it annoying. So I put a captcha on the registration page. The problem went to zero, new users still showed up, and more people were happier than before.

Re: Moving from reCAPTCHA to hCaptcha

#94

Post by [deleted] »

alexnewman wrote: post #84

Hey everyone. HCaptcha founder here. We are so happy to be on hackernews. I'm curious if anyone is having any problems? We are trying hard to respond carefully to customer requests but as you can guess we are very busy. Also we are hiring :)

[deleted]

Re: Moving from reCAPTCHA to hCaptcha

#95

Post by Kalium »

jjoonathan wrote: post #92
Kalium wrote: post #77

Earlier quoted context omitted.

How, in your opinion, should Google have handled the matter in a way that does not give spammers or other abusive users ways to get around the measure? Bear in mind that any such approach has to be scalable to many zeros daily, the vast majority of which will not be empathically awful cases like your brother's very real pain and distress - most will be genuinely abusive behavior. I want to be clear that I am not atte…

> the vast majority of which will not be empathically awful Yeah, most of the time it's "just" really, really obnoxious, not to mention coercive in a way that aligns with Google's interests. Thanks, Google. > How, in your opinion, should Google have handled the matter in a way that does not give spammers or other abusive users ways to get around the measure? "Our anti-spam systems believe that you might be a robot. Y…

In my opinion and experience, ReCAPTCHA isn't really, really obnoxious most of the time. I suspect that most of the time it trips up bots who have no emotional experiences whatsoever. Most of my personal encounters with it involve solving no puzzles whatsoever. With that in mind, I expect humans and their completely real reactions might not be the default case. Of course, this is speculative, as I do not have any kind of special data on the subject.

Thank you for sharing! Have you considered the possibility that presenting any message at all - especially one with a clear block time - is sending a very clear message to bot controllers? I'm sure you've considered this, and I am just failing to understand. Wouldn't that remove any real gains from being vague with tips & tricks?

Wouldn't there also be the real chance that vague tips & tricks would leave an actual human being in tears, convinced that they're just too dumb to understand them properly?

Re: Moving from reCAPTCHA to hCaptcha

#96

Post by IAmEveryone »

chrismorgan wrote: post #25

A few days ago I encountered this when Cloudflare decided my IP address (which is behind an ISP-level NAT) was suspicious all of a sudden (which it hadn’t been doing, a pleasant change from when I was at this location three years ago when half the internet sprouted Cloudflare CAPTCHAs at me). It was awful to solve, worse than the substantial majority of reCAPTCHA checks I’ve encountered. Certainly nothing like the il…

I had the same experience. But this may just be an artefact of humanity now having been trained exceptionally well to identify traffic lights and busses, but being relative novices at identifying elephants.

And now I'm wondering if this may not be a spectacularly useful tool to raise standards of education world-wide. Imagine, say, the French government buying them and asking every person on the internet twice a day to match some vocabulary to images: Identify "le baguette"! Lingua Franca, le sequel.

Or a maps puzzle: "Please identify Equatorial Guinea, Papua New Guinea, and Guinea-Bissau".

Re: Moving from reCAPTCHA to hCaptcha

#98

Post by heinrich5991 »

rfoo wrote: post #65
elric wrote: post #14

It's a start. reCAPTCHA is a notorious pain in the arse for anyone whose browser isn't Chrome and for anyone who doesn't keep cookies. I'm not sure if hCaptcha will be better, but it's hard to imagine it being any worse.

On the other hand, their new HCAPTCHA is a notorious PITA for anyone, including those whose browser is Chrome and keep cookies. Browsing an "I'm under attack"-mode website behind Cloudflare has been super annoying for me since last week. To the point that I usually close the page when I see a HCAPTCHA. Their visual challenge is harder to navigate than reCAPTCHA, and because this is their business model I suspect they…

Why do you assume that a good CAPTCHA should positively discriminate Chrome users?

Re: Moving from reCAPTCHA to hCaptcha

#100

Post by Analemma_ »

noad wrote: post #26
zachware wrote: post #21

One of the more insidious elements of ReCAPTCHA is its propensity to challenge users who have robust cookie blocking in place. So as we encourage people to be more privacy-aware, the web gets harder and harder to use. We've seen ReCAPTCHA pop all over ecommerce, all over benign websites with little to no need to challenge use almost completely because of the increase in privacy-aware users. ReCAPTCHA essentially flie…

You're forgetting the main benefit for google, which is getting humans to train all their vision models for free. At one point they were just forcing X% of clicks to fill out a captcha regardless of origin or identity just to get more data. I for one am getting quite tired of trillion dollar corporations getting things for free out of me. Hard pass.

This really shows how popular perceptions of Google have changed for the worse over the years. I remember when RECAPTCHA was first launched, everyone knew right away that it was just helping Google train their vision models, but at the time we all thought it was cool, like "Wow, I'm helping the cause of AI research at the same time as stopping spam". But now it just pisses everyone off.

Hell, for a little while Google had a game (can't remember the name of it) which was labeling images with another person to get points and people loved it.

Post reply on HN