5 ms·

Cloudflare recently moved away from Google's reCAPTCHA to hCaptcha. Announcement: https://blog.cloudflare.com/moving-from-recaptcha-to-hcaptcha/ https://blog.c

Cloudflare recently moved away from Google's reCAPTCHA to hCaptcha. Announcement: https://blog.cloudflare.com/moving-from-recaptcha-to-hcaptcha/ https://blog.cloudflare.com/moving-from-recaptcha-to-hcaptch... Discussion on HN:https://news.ycombinator.com/item?id=22812509 https://news.ycombinator.com/item?id=22812509

whatsmyusername 6y ago
Yes, and it made half the web unusable. Getting captchaed twice in 60 seconds is an immediate bounce from me.
- chipperyman573 6y ago
  If I understood their blog posts correctly, the captcha rate should be the same - it's shown to you when Cloudflare detects that you need one, not when reCaptcha/hCaptcha decide. CF just has them show the captcha.
  - judge2020 6y ago
    The amount of Captcha's you need to solve will likely go up if you previously got them but had a good enough ReCaptcha score to not need to solve their challenges every time. hCaptcha does not yet have something that makes one captcha solve bypass the following few captchas.
    - AngryData 6y ago
      I get like 3-4 ReCaptchas literally every time I encounter one, so I have zero problems with them changing.
      - ethbro 6y ago
        This. I chalked it up to aggressive Firefox settings.
- TechBro8615 6y ago
  What? The number of captchas is the same. And in my experience, hcaptcha is a heck of a lot nicer than recaptcha. It also works on Tor. This move from cloudflare will probably save me multiple hours of time per year, that I previously spent waiting for pictures of fire hydrants to load.
- alexnewman 6y ago
  Founder of HCaptcha here. Have you tried our privacy pass or accessibility features?
  - cycloptic 6y ago
    Can you please open source your frontend code? The net absolutely needs a captcha that has made a promise to not run tracking code, and sticks to that by providing transparency. Google is not doing it and has only increased the amount of tracking code. If you're doing things correctly the obfuscation of the data coming from the backend is what would be critical to keeping bots out, not the actual code administering the turing test on the frontend.
  - samoa42 6y ago
    lol wut
    - smnthermes 6y ago
      Idem.
  - wintermutestwin 6y ago
    https://imgur.com/tyZnANQ https://imgur.com/tyZnANQ Firefox through a VPN and every site that uses hcaptcha throws this up and doesn't let me in. You're the one who is responsible for this web cancer? You purposefully disable access to VPN users and then try to pass off a "privacy pass?"
    - mcpeepants 6y ago
      Cloudflare is responsible for deciding you need a captcha...
      - saagarjha 6y ago
        This is exactly the position Google tried to put themselves in with reCAPTCHAv3, where they simply provide a “score” and websites now make the decision of blocking users themselves, absolving Google of any blame. If your captcha gives scores to real users that would cause everyone to block them, that’s on you.
- jaflo 6y ago
  I have not seen this at all. In my experience hCaptcha results in the same or equal experience that reCAPTCHA had. Anecdotally my pass rate on hCaptcha is actually higher (reCAPTCHA gets suspicious more quickly and often asks to solve more than one prompt).
deleted 6y ago
[deleted]
motyar 6y ago
hCaptcha is annoying. I see it every time I open codepen and few other website.
- m-p-3 6y ago
  hCaptcha is less annoying when using Tor than ReCAPTCHA at least.
  - gatgeagent 6y ago
    Exactly my experience. And not just Tor, just about every datacenter IP address.
- ernsheong 6y ago
  I found the tasks for alternatives (might be hCaptcha) hard to complete correctly even for a human.
ignoranceprior 6y ago
It's not FOSS though, is it?
OpFour 6y ago
I use hCaptcha on multiple sites and honestly, it does the job well. To those who claim it hurts business, yes it adds an extra step to the verification process but it also keeps you and the rest of my visitors safe. It almost feels like that the inconvenience of using a multi-layered system equates to the people who want to get back to eating in restaurants while in the midst of a pandemic and will then complain if they catch Covid-19...
- kyboren 6y ago
  > it also keeps you and the rest of my visitors safe. Safe? From what? Is comment spam or increased traffic/CPU load on your server now a threat to users' safety? > It almost feels like that the inconvenience of using a multi-layered system equates to the people who want to get back to eating in restaurants while in the midst of a pandemic and will then complain if they catch Covid-19... Excuse me, but you seem to have forgotten that your mouth is between your other cheeks. EDIT: In case I wasn't absolutely clear, OP is talking completely out of his/her ass and deserves to get called out on it. It's not exactly polite to compare people who don't like CAPTCHAs to public-health-endangering hypocritical idiots.
  - saagarjha 6y ago
    Even when you disagree, please be polite.
- jakearmitage 6y ago
  This comment was brought to you by Intuition Machines, Inc, Labeling the World.
adtac 6y ago
Not sure how this is FOSS?
superasn 6y ago
hCaptcha is the worst most buggy captcha service I have ever encountered. As a matter of fact digital ocean recently added that to their login screen and it made my life a complete nightmare. The fact I had to solve it everytime I wanted to login, I genuinely decided to leave their infrastructure and move to AWS regardless of the higher bill. But I must give 100% points to DO support. Before leaving them I sent one last support ticket to DO with the recording my nightmare in a mp4 file and lo and behold they changed their entire login flow for me (1). I no longer see that and life is good again. (1) https://imgur.com/a/GKJHhtT https://imgur.com/a/GKJHhtT

whatsmyusername 6y ago

Yes, and it made half the web unusable. Getting captchaed twice in 60 seconds is an immediate bounce from me.

chipperyman573 6y ago
If I understood their blog posts correctly, the captcha rate should be the same - it's shown to you when Cloudflare detects that you need one, not when reCaptcha/hCaptcha decide. CF just has them show the captcha.
- judge2020 6y ago
  The amount of Captcha's you need to solve will likely go up if you previously got them but had a good enough ReCaptcha score to not need to solve their challenges every time. hCaptcha does not yet have something that makes one captcha solve bypass the following few captchas.
  - AngryData 6y ago
    I get like 3-4 ReCaptchas literally every time I encounter one, so I have zero problems with them changing.
    - ethbro 6y ago
      This. I chalked it up to aggressive Firefox settings.
TechBro8615 6y ago
What? The number of captchas is the same. And in my experience, hcaptcha is a heck of a lot nicer than recaptcha. It also works on Tor. This move from cloudflare will probably save me multiple hours of time per year, that I previously spent waiting for pictures of fire hydrants to load.
alexnewman 6y ago
Founder of HCaptcha here. Have you tried our privacy pass or accessibility features?
- cycloptic 6y ago
  Can you please open source your frontend code? The net absolutely needs a captcha that has made a promise to not run tracking code, and sticks to that by providing transparency. Google is not doing it and has only increased the amount of tracking code. If you're doing things correctly the obfuscation of the data coming from the backend is what would be critical to keeping bots out, not the actual code administering the turing test on the frontend.
- samoa42 6y ago
  lol wut
  - smnthermes 6y ago
    Idem.
- wintermutestwin 6y ago
  https://imgur.com/tyZnANQ https://imgur.com/tyZnANQ Firefox through a VPN and every site that uses hcaptcha throws this up and doesn't let me in. You're the one who is responsible for this web cancer? You purposefully disable access to VPN users and then try to pass off a "privacy pass?"
  - mcpeepants 6y ago
    Cloudflare is responsible for deciding you need a captcha...
    - saagarjha 6y ago
      This is exactly the position Google tried to put themselves in with reCAPTCHAv3, where they simply provide a “score” and websites now make the decision of blocking users themselves, absolving Google of any blame. If your captcha gives scores to real users that would cause everyone to block them, that’s on you.
jaflo 6y ago
I have not seen this at all. In my experience hCaptcha results in the same or equal experience that reCAPTCHA had. Anecdotally my pass rate on hCaptcha is actually higher (reCAPTCHA gets suspicious more quickly and often asks to solve more than one prompt).

deleted 6y ago

[deleted]

motyar 6y ago

hCaptcha is annoying. I see it every time I open codepen and few other website.

m-p-3 6y ago
hCaptcha is less annoying when using Tor than ReCAPTCHA at least.
- gatgeagent 6y ago
  Exactly my experience. And not just Tor, just about every datacenter IP address.
ernsheong 6y ago
I found the tasks for alternatives (might be hCaptcha) hard to complete correctly even for a human.

ignoranceprior 6y ago

It's not FOSS though, is it?

OpFour 6y ago

I use hCaptcha on multiple sites and honestly, it does the job well. To those who claim it hurts business, yes it adds an extra step to the verification process but it also keeps you and the rest of my visitors safe. It almost feels like that the inconvenience of using a multi-layered system equates to the people who want to get back to eating in restaurants while in the midst of a pandemic and will then complain if they catch Covid-19...

kyboren 6y ago
> it also keeps you and the rest of my visitors safe. Safe? From what? Is comment spam or increased traffic/CPU load on your server now a threat to users' safety? > It almost feels like that the inconvenience of using a multi-layered system equates to the people who want to get back to eating in restaurants while in the midst of a pandemic and will then complain if they catch Covid-19... Excuse me, but you seem to have forgotten that your mouth is between your other cheeks. EDIT: In case I wasn't absolutely clear, OP is talking completely out of his/her ass and deserves to get called out on it. It's not exactly polite to compare people who don't like CAPTCHAs to public-health-endangering hypocritical idiots.
- saagarjha 6y ago
  Even when you disagree, please be polite.
jakearmitage 6y ago
This comment was brought to you by Intuition Machines, Inc, Labeling the World.

adtac 6y ago

Not sure how this is FOSS?

superasn 6y ago

hCaptcha is the worst most buggy captcha service I have ever encountered. As a matter of fact digital ocean recently added that to their login screen and it made my life a complete nightmare. The fact I had to solve it everytime I wanted to login, I genuinely decided to leave their infrastructure and move to AWS regardless of the higher bill. But I must give 100% points to DO support. Before leaving them I sent one last support ticket to DO with the recording my nightmare in a mp4 file and lo and behold they changed their entire login flow for me (1). I no longer see that and life is good again. (1) https://imgur.com/a/GKJHhtT https://imgur.com/a/GKJHhtT