5 ms·

More specifically, it now uses a service called hCaptcha: https://www.hcaptcha.com/ https://www.hcaptcha.com/ It appears it pays people to use the captchas by

More specifically, it now uses a service called hCaptcha: https://www.hcaptcha.com/ https://www.hcaptcha.com/ It appears it pays people to use the captchas by providing data labeling. This is similar to Google's business case for running ReCAPTCHA, just labeling others' data instead.

eastdakota 7y ago
FYI: hCAPTCHA don’t pay us. We pay them. ReCAPTCHA decided to start charging for their service (which they have every right to do, but it was a surprise). Just to use ReCAPTCHA on our Free customers would have cost us $10M+/year, which was untenable. We’d been concerned about the privacy issues around using a Google service for some time, and this was the kick in the butt we needed to move off of them. hCAPTCHA has been incredibly responsive so far to improving their service, something even at our scale we had a tough time getting from the ReCAPTCHA team. Ultimately, we’re working toward entirely eliminating visual/audio CAPTCHAs. But, until then, we are enjoying working with the hCAPTCHA team.
- mmm_grayons 7y ago
  Thanks for the response. I hadn't previously heard of ReCAPTCHA charging users. Is it only large enterprise customers? The people I know who use it in applications haven't mentioned it, but they're nowhere near Cloudflare's scale. > Ultimately, we’re working toward entirely eliminating visual/audio CAPTCHAs. But, until then, we are enjoying working with the hCAPTCHA team. This sounds very interesting; are you able to comment on this further?
  - smitop 7y ago
    > If you wish to make more than 1k calls per second or 1m calls per month, you must use reCAPTCHA Enterprise or fill out this form and wait for an exception approval. According to https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-recaptcha https://developers.google.com/recaptcha/docs/faq#are-there-a...
- lsb 7y ago
  I recently switched my phone to route all internet traffic through Tor and the DDG browser on Android, but the hCaptcha challenges are even more exasperating than the ReCaptchas, and I've found my bounce rate close to 100%. Is the abundance of hCaptcha challenges for those of us browisng CF-fronted properties in such a manner going to change any time soon?
  - 14 7y ago
    Off topic here but since you seem knowledgeable can you point me in the direction of some good resources I can read to become informed on how to use tor? I worry I will have issues as you described. My kids school just moved online. The teacher was considering using google classroom then I voiced my concern which she thanked me and she ended up going with a Canadian company (I am Canadian) called myblueprint.ca and their privacy policy can be found here [1]. Reading their privacy policy it is quickly apparent they are a giant data collection machine and I want to throw up. I plan on sharing some of the key points but if I have to go forward want to try use like a tails live CD or what ever is recommended in 2020 to avoid their tracking. Thanks for any insight [1] https://myblueprint.ca/privacy https://myblueprint.ca/privacy
    - justusthane 7y ago
      I’m curious, what about their privacy policy has you convinced that they’re a “giant data collection machine”? I just read it and it seems pretty reasonable to me. They clearly outline all the purposes they need to use your data for, most of which are just to operate their site. I would encourage you to think twice before implementing measures that are going to o add more friction to your kids’ schooling. (Live CD? Tor? Really?)
      - silverreads 7y ago
        I worry a lot about my kid writing or saying something that would be innocent child's play when in person but might be construed as domestic terrorism if seen in the wrong data dump by the wrong enforcement agency. How can you teach right and wrong in an environment like this?
- riedel 7y ago
  Wonder if there was a business case for making a captcha service that labels open data for the social good. IMHO even a pay-for-hosted open source model sounds feasible. I would have initially expected that the labels and not the security would provide the cash flow ( I know a company who puts labelling tasks in online games and actually pays the game host)
- Eldt 7y ago
  > We’d been concerned about the privacy issues around using a Google service for some time, and this was the kick in the butt we needed to move off of them. Do you think this would have ever happened without a financial incentive?
  - zenexer 7y ago
    As someone who’s been in a similar position, there aren’t really any alternatives that don’t piss people off. reCAPTCHA is a pain to get past for a small number of visitors, typically those using public proxies (e.g. Tor), but the majority just click a checkbox and are in. Cloudflare already has a lengthy complaint thread on their forums with people insisting they switch back to reCAPTCHA for this very reason.
slezyr 7y ago
Wow, this is even worse than ReCaptcha. And I hoped for something better.
- Proven 7y ago
  Yep, same here. But after years of suffering last year I made an effort to get over it. Nowadays more often than not I just close the tab and go someplace else. F 'em.

eastdakota 7y ago

FYI: hCAPTCHA don’t pay us. We pay them. ReCAPTCHA decided to start charging for their service (which they have every right to do, but it was a surprise). Just to use ReCAPTCHA on our Free customers would have cost us $10M+/year, which was untenable. We’d been concerned about the privacy issues around using a Google service for some time, and this was the kick in the butt we needed to move off of them. hCAPTCHA has been incredibly responsive so far to improving their service, something even at our scale we had a tough time getting from the ReCAPTCHA team. Ultimately, we’re working toward entirely eliminating visual/audio CAPTCHAs. But, until then, we are enjoying working with the hCAPTCHA team.

mmm_grayons 7y ago
Thanks for the response. I hadn't previously heard of ReCAPTCHA charging users. Is it only large enterprise customers? The people I know who use it in applications haven't mentioned it, but they're nowhere near Cloudflare's scale. > Ultimately, we’re working toward entirely eliminating visual/audio CAPTCHAs. But, until then, we are enjoying working with the hCAPTCHA team. This sounds very interesting; are you able to comment on this further?
- smitop 7y ago
  > If you wish to make more than 1k calls per second or 1m calls per month, you must use reCAPTCHA Enterprise or fill out this form and wait for an exception approval. According to https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-recaptcha https://developers.google.com/recaptcha/docs/faq#are-there-a...
lsb 7y ago
I recently switched my phone to route all internet traffic through Tor and the DDG browser on Android, but the hCaptcha challenges are even more exasperating than the ReCaptchas, and I've found my bounce rate close to 100%. Is the abundance of hCaptcha challenges for those of us browisng CF-fronted properties in such a manner going to change any time soon?
- 14 7y ago
  Off topic here but since you seem knowledgeable can you point me in the direction of some good resources I can read to become informed on how to use tor? I worry I will have issues as you described. My kids school just moved online. The teacher was considering using google classroom then I voiced my concern which she thanked me and she ended up going with a Canadian company (I am Canadian) called myblueprint.ca and their privacy policy can be found here [1]. Reading their privacy policy it is quickly apparent they are a giant data collection machine and I want to throw up. I plan on sharing some of the key points but if I have to go forward want to try use like a tails live CD or what ever is recommended in 2020 to avoid their tracking. Thanks for any insight [1] https://myblueprint.ca/privacy https://myblueprint.ca/privacy
  - justusthane 7y ago
    I’m curious, what about their privacy policy has you convinced that they’re a “giant data collection machine”? I just read it and it seems pretty reasonable to me. They clearly outline all the purposes they need to use your data for, most of which are just to operate their site. I would encourage you to think twice before implementing measures that are going to o add more friction to your kids’ schooling. (Live CD? Tor? Really?)
    - silverreads 7y ago
      I worry a lot about my kid writing or saying something that would be innocent child's play when in person but might be construed as domestic terrorism if seen in the wrong data dump by the wrong enforcement agency. How can you teach right and wrong in an environment like this?
riedel 7y ago
Wonder if there was a business case for making a captcha service that labels open data for the social good. IMHO even a pay-for-hosted open source model sounds feasible. I would have initially expected that the labels and not the security would provide the cash flow ( I know a company who puts labelling tasks in online games and actually pays the game host)
Eldt 7y ago
> We’d been concerned about the privacy issues around using a Google service for some time, and this was the kick in the butt we needed to move off of them. Do you think this would have ever happened without a financial incentive?
- zenexer 7y ago
  As someone who’s been in a similar position, there aren’t really any alternatives that don’t piss people off. reCAPTCHA is a pain to get past for a small number of visitors, typically those using public proxies (e.g. Tor), but the majority just click a checkbox and are in. Cloudflare already has a lengthy complaint thread on their forums with people insisting they switch back to reCAPTCHA for this very reason.

slezyr 7y ago

Wow, this is even worse than ReCaptcha. And I hoped for something better.

Proven 7y ago
Yep, same here. But after years of suffering last year I made an effort to get over it. Nowadays more often than not I just close the tab and go someplace else. F 'em.