22 ms·
Ask HN: Any good FOSS alternative to Google's reCAPTCHA?
Google's reCAPTCHA is everywhere, they seem to have the monopoly of checking if the user's not a robot.
CAPTCHA systems are essentials to the web, and it seems important to me to have a (good) FOSS alternative, but I can't find any.
Are all CAPTCHA closed-source to make it harder for attackers? Am I missing something?
- tmlee 6y agoWe are trying out https://www.hcaptcha.com/ https://www.hcaptcha.com/ in our application. It's not FOSS, but seem to be a viable alternative to give a go. So far it does the job, though the images load a little bit slower than recaptcha
- whatsmyusername 6y agoI suspect you will see a considerable bounce rate once you switch. Pretty much the day Cloudflare flipped over half the web became 'captcha every 5 seconds' garbage. Some sites that are the only source of what I'm looking for will be fine, but most I just bounce from now.
- vmednis 6y agoI'm not a big fan of hCAPTCHA at it's current form. The challenges seems so much harder than reCAPTCHA ones and I keep failing them. The images are just extremely low quality. Maybe I'm a bot.
- zozbot234 6y agoI get easy challenges. Perhaps even a bit easier than the reCAPTCHA ones, and less of them for sure.
- pot8n 6y agoIt's way worse than Google's for me. I am using Firefox and I don't even try anymore whenever get exposed to it on any Cloudflare website.
- alexnewman 6y agoFounder of HCaptcha here. Have you tried our privacy pass or accessibility features?
- pot8n 6y agoNo, I haven't but your service is making it literally impossible to browse with Firefox and Tor (understandably because you're here to make money from your customers labeling people like me as a threat in their dashboards not to enable people to actually browse easily). Even reCAPTCHA doesn't do that.
- isochronous 6y agoThe answer to "your basic service doesn't work well" should not be "well have you tried our additional services?"
- mrwesleycrusher 6y agoI am scrolling through HN on my phone and saw privacy pass isn't supported for android. Is porting privacy pass to the android version of Firefox on your roadmap at all? If not, would you consider adding it to your roadmap? Thanks.
- alexandernst 6y agoA quick search revealed the following: * https://github.com/Lokno/click-captcha https://github.com/Lokno/click-captcha * https://www.phpcaptcha.org https://www.phpcaptcha.org * https://source.netsyms.com/Netsyms/Captcheck https://source.netsyms.com/Netsyms/Captcheck
- thanksforfish 6y agoClick-captcha has tiny touchpoints, so I fail a couple times on mobile, just from that. Phpcaptcha has autocorrect enabled on the text box, so "alk" was changed to "all", causing a fail. Captcheck worked well.
- juliend2 6y agoI know it's not as usable for visually impaired people, but I kinda like those that ask you to drag a piece of puzzle on an image : https://github.com/ArgoZhang/SliderCaptcha https://github.com/ArgoZhang/SliderCaptcha
- ehonda 6y agoI second phpcaptcha.org.
- nerdbaggy 6y agoProblem is CAPTCHA is a hard problem to solve now days. It’s not like before when you can just display and image and ask what the letters are. It takes machine learning, lots of training data, etc.
- amelius 6y agoAlso it has to take into account that the puzzle may be sent to a farm of human puzzle solvers. Or that the puzzle is sent to unsuspicious users of another website. I think this is what makes Google's approach powerful because they have the best view on IP addresses used worldwide. (Whether that's desirable is still another question).
- moviuro 6y agoWhat's your threat model? Maybe a CAPTCHA is not your only or not even a good solution. What about blind users? or with some other disability? Think: rate-limit, IP rating/scoring, your own filter on messages, etc.
- londt8 6y agoJust FYI: google recaptcha works with screen readers too and blind users can use it.
- dkdk8283 6y agoYep. Apache beam with fraud detection heuristics.
- Belphemur 6y agoLatest version of recaptcha doesn't even require any solving. It just analyse the traffic and give the site owner a score [0.0 - 1.0] on how sure they are the visitor is human. They don't explain how they calculate the score, but from my usage it's pretty accurate. They suggest to consider at first anything higher than 0.5 to be a human.
- moviuro 6y agoAnd they also disregard RGPD completely. Maybe OP has strict legal requirements that make using Google's tools a NOGO.
- Semaphor 6y agoIs that a new version that isn’t in use anywhere yet? Because for me reCaptcha is still a tool that analyses how much they know about you and if you dgaf about privacy, it lets you through.
- dropofwill 6y agoIt came out at the end of 2018. You probably just haven't noticed it because the only visual is a little badge at the bottom right hand corner of the page.
- simongr3dal 6y agoCloudflare recently moved away from Google's reCAPTCHA to hCaptcha. Announcement: https://blog.cloudflare.com/moving-from-recaptcha-to-hcaptcha/ https://blog.cloudflare.com/moving-from-recaptcha-to-hcaptch... Discussion on HN:https://news.ycombinator.com/item?id=22812509 https://news.ycombinator.com/item?id=22812509
- whatsmyusername 6y agoYes, and it made half the web unusable. Getting captchaed twice in 60 seconds is an immediate bounce from me.
- chipperyman573 6y agoIf I understood their blog posts correctly, the captcha rate should be the same - it's shown to you when Cloudflare detects that you need one, not when reCaptcha/hCaptcha decide. CF just has them show the captcha.
- judge2020 6y agoThe amount of Captcha's you need to solve will likely go up if you previously got them but had a good enough ReCaptcha score to not need to solve their challenges every time. hCaptcha does not yet have something that makes one captcha solve bypass the following few captchas.
- 6y ago
- three_seagrass 6y agoLatest reCAPTCHA isn't even detectible. It runs in the background of the browser and gives predictions for bot traffic. The days of reading images as validation are going to be one of those "remember when" moments on the internet.
- xirdstl 6y agoSo long as you're using Chrome. I encounter them all the time.
- Mediterraneo10 6y agoIt has been 2–3 years already since I heard of the new reCAPTCHA running in the background. However, that must be dependent on Chrome or on some JS that Firefox NoScript users may leave disabled, because privacy-aware internet users will still encounter image CAPTCHA hell doing many ordinary things on the web, and the situation only gets worse if you add Tor to the mix.
- vmednis 6y agoThe worst are the sites that don't have a fallback. If the new CAPTCHA decides you are a bot because, for example, you are running a VPN or something there's absolutely nothing you can do. Has happened to me two or three times.
- whatch 6y agoExcept when you use a couple of privacy-related extensions in Firefox and every other website forces you to mark bicycles or buses. Or do these websites use older versions?
- gnulinux 6y agoI still pick bikes and road signs and markets in the same frequency as before. Didn't notice anywhere before reading this comment. I use Firefox.
- gen220 6y ago
- vortico 6y agoWhat is your use case? I get exactly 0 spam on my website (of 100,000s of users) by simply writing my user registration page in a nonstandard way that bots aren't familiar with filling out automatically. It uses JS to `fetch()` a custom API endpoint and then redirects to the homepage. Or for example, a fixed question "What color is the sky?" or something can reduce spam by orders of magnitude relative to nothing at all.
- VWWHFSfQ 6y agohow do you handle blind or colorblind visitors
- vmednis 6y agoBlind and colorblind people still know what color the sky is. It's impossible to live long enough to register on a website and have never heard that.
- BiteCode_dev 6y agoThey know it culturally.
- tyingq 6y agoIf you aren't a big target, sometimes just a visually hidden form field that shouldn't contain anything is good enough.
- judge2020 6y agoThat's if you aren't a target at all, which is only applicable for very few services. Any inexperienced attacker could use burp suite or inspect element to see and imitate this hidden field.
- tyingq 6y agoSure, but that's often the case. You might only be a target, for example, because you're running WordPress. Nobody is deliberately going after your site specifically. There's plenty of sites that don't need a full-on captcha.
- pedrogpimenta 6y agoOooo, I like this, thanks for the tip :)
- modzu 6y agocaptcha is the cancer of the web
- rapnie 6y agoHere are some [0] and if your submission is not on there, pls consider PR'ing it. OP is right, we need more alternatives. [0] https://github.com/ZYSzys/awesome-captcha https://github.com/ZYSzys/awesome-captcha
- kdeldycke 6y agoJust answered you call at: https://github.com/ZYSzys/awesome-captcha/pull/15 https://github.com/ZYSzys/awesome-captcha/pull/15 :)
- beshrkayali 6y agoPrevious reCAPTCHA discussion, with some alternatives https://news.ycombinator.com/item?id=20158386 https://news.ycombinator.com/item?id=20158386
- ParadisoShlee 6y agoI've found https://github.com/koto-bank/kocaptcha https://github.com/koto-bank/kocaptcha
- zzo38computer 6y agoWhat some wikis do is just asking a question (in text) that you can then type in the answer (and if you don't know, can look it up in a book, Wikipedia, Google, or whatever you want to look it up, or ask someone who does know the answer). I think that work much better than reCAPTCHA.
- majkinetor 6y agoI just did research few days back, and there are none that aren't passable with some OCR/tensorflow tech. Anything simple and the question is why do you need it ? Anything hard enough for bots not to beat it will also fail many humans. Add rate limiter instead and put CF infront or something similar. Way better experience then any captcha. In case you still want it here is solid one: https://github.com/dchest/captcha https://github.com/dchest/captcha
- flatiron 6y agoI wonder what all those darkmarkets use. I assume they are pretty resilient!
- web007 6y agoDo you need a CAPTCHA? Or do you need to slow down / stop spammers? Consider hashcash [1] instead of CAPTCHA if #2 is your goal. It can be used in any place where real users interact with your site at almost zero effort on their behalf, and can slow down spamming enough to make you an unattractive target. I have a terrible / incomplete / janky proof-of-concept version at [2] that you could build from, or you could find one that was built for your CMS / language du jour. [1] https://en.wikipedia.org/wiki/Hashcash https://en.wikipedia.org/wiki/Hashcash [2] https://github.com/007/hashcash https://github.com/007/hashcash
- throwayzz- 6y agoProof of work is better IMO
- stickac 6y agohashcash is proof of work
- gbmor 6y ago> [2] https://github.com/007/hashcash https://github.com/007/hashcash Looks like your repo is https://github.com/007/hashcash-js https://github.com/007/hashcash-js But, cool! Thanks for sharing.
- LaurentS 6y agoNot exactly answering the question, but I recently used aliexpress.com and their captcha system is super easy: it shows a sliding button like the one to answer a call on a phone. The prompt just asks you to slide it to validate your input. Not sure how it works, but it sure is a much better UX than when I have to spend 3 minutes identifying for hydrants. Maybe we could make a FLOSS version of it?
- renewiltord 6y agoThe common recaptcha is just a "check box to prove you're human" if Google knows you even slightly otherwise.
- hexandcube 6y agoBut is that good for accessibility?
- false_kermit 6y agoI just want a version of captcha that isn't tied to my google account. This is particularly an issue on anonymous message boards like 4chan. If google wanted to, they could tie pretty much every 4chan post to a google account.
- deleted 6y ago[deleted]
- LordHeini 6y agoI would say it really depends on your use case. Lets say you have a comment section on your site where any user can write stuff. More often than not a hidden field which should not be filled (the honeypot method) and a spam filter gets the job done no problem. For registrations it can be more problematic because the spam filter does not work that well. I have yet to find a good alternative to commercial captchas as well but rolling your own solution is possible. And probably even the best idea because if every site has its own weird system it would make the life of bots quite hard. In the end a dedicated attacker can always hire people to fill the captchas and circumvent any system for an astonishingly low amount of money.
- econcon 6y agoCloudfare should run captcha service and not sell the data acquired as such. Data can be used by their ddos protection scheme but that's all about it, not to be sold to advertisers or other firms.
- bjoli 6y agoIt is not really a captcha, but I used email for people to submit comments to my website. You could rely on a third party mail provider for for filtering, which would make it even simpler.
- sapir 6y agowhat do you think about it? https://www.youtube.com/watch?v=G8Bt3jEhIwA https://www.youtube.com/watch?v=G8Bt3jEhIwA