9 ms·

Cloudflare is horrible for blind people. Screen readers, the programs that use synthesized speech to tell us what's on the screen, cannot read images. Good cap

Cloudflare is horrible for blind people. Screen readers, the programs that use synthesized speech to tell us what's on the screen, cannot read images. Good captchas usually have audio equivalents (which come with their own set of problems), but this one doesn't. If you're blind and flagged by Cloudflare for some reason, you're cut off from accessing half the internet, potentially critical banking/governmental/medical/communications/educational services. We rely on the internet way more than our sighted peers, so this is very important. This has recently happened to me on a few sites, fortunately not critical ones, but it was not a pleasant experience nonetheless. CF engineers, please fix this ASAP. I'm surprised there still isn't a huge lawsuit over this, as this is clearly violating all sorts of laws.

deleted 6y ago
[deleted]
strombofulous 6y ago
I use audio captchas. Google will usually only let you do 2 or 3 before banning you and making you do image-based ones. I'm pretty sure the button is just there to make it seem accessible.
- dependenttypes 6y ago
  I had exactly the same issue. I am surprised how neither cloudflare nor google have been sued for making most of the web inaccessible to people with disabilities.
  - lopmotr 6y ago
    Shouldn't that liability be with the operators of websites that use those captchas if they're required to be blind-accessible? If they get sued, it'll apply pressure up the supply chain.
    - kbenson 6y ago
      I agree. You don't sue the contractor because they built to the specification you provided. At the same time, if Google is advertising Recaptcha as accessible and it's not really, then they need to be held accountable for that, because that has a real impact on huge swaths of the internet, and especially for sites that try to do the right thing and find out Google has screwed them.
      - ztjio 6y ago
        > You don't sue the contractor because they built to the specification you provided. In the world of licensed contracting you absolutely do. If you provide a contractor specifications that result in a code violation, they have to tell you no. If they don't tell you no then you, the non expert, are reasonable to assume what you asked for is acceptable. If they actually build the thing, they are liable for the violation of code. The last thing we need is to hand out more excuses to evade accountability and responsibility for making the world worse.
        kbenson 6y ago
        Yeah, contractor is a bad metaphor. I started with Home Depot, but that didn't really fit either. It's more that you bought a ramp that's designed to fit over a two step rise. Was it advertised as accessible in your state/county (which will likely have specific gradient and handrail rules? If not, you should have looked. If the salesperson assured you it was, well that sucks, but I'm not sure you'll get more than your money back. > The last thing we need is to hand out more excuses to evade accountability and responsibility for making the world worse. I'm definitely not advocating that. I'm more advocating that you can't leave all this to someone else entirely. Even if you pay someone for a turn-key custom website and make sure it's accessible, there's no guarantee it still meets standards a year from now, just as if you pay a contractor to build a ramp for you that perfectly meets standards. Things change, and people need to pay attention to the things that matter to them to make sure they follow the law. Whether that's occasionally checking it yourself or paying someone else to do so (and thus ensuring it happens), it still needs to happen.
    - 6y ago
- shp0ngle 6y ago
  CloudFlare doesn't use Google ReCaptcha anymore. They use some Blockchain Captcha thing now.
1f60c 6y ago
Thank you for sharing your experience. Cloudflare switched to using hCaptcha a couple months ago, I think and I only just noticed that they do not offer an audio-based captcha. However, hCaptcha integrates with Privacy Pass[0], and you can top up your tokens by solving a captcha at [1] and [2]. What you could do (and I realize this is far from ideal), is getting a sighted friend to solve a couple of captchas so you have enough tokens to last you a couple months. [0]: https://privacypass.github.io/ https://privacypass.github.io/ [1]: https://captcha.website/ https://captcha.website/ [2]: https://www.hcaptcha.com/privacy-pass https://www.hcaptcha.com/privacy-pass
- waheoo 6y ago
  This is such an out of touch dev response. The problem is hcaptcha, the solution is stop using hcaptcha. Not placate and evade with work arounds you wouldn't even suggest to non blind people. Also this ask a friend solution is like telling someone in a wheelchair to ask a friend to help them up those steps instead of just installing a ramp. You don't get to take over half the internet and just ignore social responsibility.
  - BTinfinity 6y ago
    Solutions can’t be implemented instantly; a work around is needed until that ramp is installed. As much as the lack of audio solution sucks, you can’t expect half the internet to just give up on a piece of technology overnight
    - waheoo 6y ago
      Why not?
      - Thorrez 6y ago
        When you move fast you tend to break things. When half the internet relies on you you want to avoid outages.
userbinator 6y ago
Just like Google, it is also horrible for those who use more "nonstandard" configurations. I don't remember if it's CF or Google or someone else but I recall coming across sites that would block you if you have JS disabled, claiming that you're a bot, and the ban-page was the same across those sites, so it was a common "provider".
jiggawatts 6y ago
The "human detector" of the modern internet doesn't accept disabled people as sufficiently human. That's... the most dystopian thing I've heard in a while!
- userbinator 6y ago
  In the other direction, Google thinks I'm a bot if I use complex search queries (exclusions, site:, quotes, etc.) in an attempt to find what I'm looking for. Apparently it thinks I'm too intelligent to be a human.
  - nikanj 6y ago
    You’re not profitable enough. You’re insisting on finding the thing you want, instead of settling for what Google is pushing today.
    - anchpop 6y ago
      Since they're on HN they likely use uBlock, which means that they're not profitable for Google regardless of how they search
    - kjeetgill 6y ago
      I get that you meant that sardonically but it's worth pointing out that it would be even more unprofitable implementing ways to catch and redirect you.
booblik 6y ago
Seems like if this issue could easily be solved, a startup would have formed to solve it. Are there any alternatives to recaptcha and hcaptcha that are effective and also accessible?
DrJosiah 6y ago
Hi! I work at hCaptcha (we handle the CF captchas), and to respond specifically: audio is inaccessible for those with visual and auditory processing issues, as well as being broken by ML techniques. Not to project, but we suspect this is why Google turns it off if your browser looks at all suspicious. Another user mentioned the Privacy Pass solution: https://news.ycombinator.com/item?id=23902870 https://news.ycombinator.com/item?id=23902870 While Privacy Pass is not perfect, we are working towards getting better. I'm not in the product flow for accessibility, but if you have ideas outside of audio that you believe would be able to distinguish between yourself and a robot, I'd be happy to discuss via email to ensure that we can get a solution for you and anyone who can reasonably interact with a computer. eta: you can email me directly at work via: josiah@intuitionmachines.com eta2: http://hcaptcha.com/accessibility http://hcaptcha.com/accessibility
- drivebycomment 6y ago
  Audio captchas are considered broken completely (search for various papers over the past decade, including one from CMU), so it has limited usefulness only in a very narrow context in practice. I suspect this is a harbinger of things to come - as we close the gap on passing the Turing test, captchas are likely to get less effective, and we will need to transition to a very different solution for bot detection.
  - chillfox 6y ago
    or, just let the bots be. often it's easier to just use a website as api instead of using some broken xml nightmare that requires knowledge of the database tables. If the concern is rate limiting then just rate limit the website. And if you don't like people operating websites with bots then I don't know, maybe stop making websites.
    - Karunamon 6y ago
      Easy proxying means rate limiting doesn’t really help all that much to defeat bots. And then if you do something like blocking or severely restricting something like Tor (the world's largest open proxy and hence, primary abusive traffic source; something which it would make sense to throw extra bot walls in front of), privacy and accessibility advocates jump down your throat. This is a no-win situation. I’m not convinced it’s possible to have ones cake and eat it too, here. Someone upthread said “security, privacy, accessibility, pick any two”, and I have yet to see any evidence of a third option.
virtue3 6y ago
It might be worth filing an ADA compliance notice against cloudflare. This is seriously disturbing. As someone that works in ed tech - anyone that supports higher education is required to support screen readers etc. If any of those sites are using cloudflare that would block them from being compliant pretty seriously.
- Craighead 6y ago
  Isn't this a title 9 violation?
- miki123211 6y ago
  I'm not american, otherwise I would definitely do so. This issue is mostly unnoticeable, as long as you're not considered malicious to Cloudflare, everything works perfectly and passes accessibility audits. When something weird happens and Cloudflare flags you, you cannot access the system at all. For those doing accessibility audits out there, this kind of issues might be worth looking into, as they're very non obvious and very critical.
  - alexnewman 6y ago
    Have you tried our accessibility option? https://www.hcaptcha.com/accessibility https://www.hcaptcha.com/accessibility
whatsmyusername 6y ago
They switched from recaptcha to some gargage cryptocoin meme captcha service. For the first week I spent most days bouncing from sites because I got tired of getting captched every page. If you captcha me on every page I don't give you money. Real easy.
reactchain 6y ago
I'd love to read more about the economics of captchas - what is the "labor" of classifying images worth? What is the marginal cost per captcha of human solver farms, etc. Can anyone point me to some resources?
ramanova 6y ago
The a11y problem is super urgent for the majority of products out there. Not only it prevents blind/non hearing people of using systems. People also tend to forget that having a11y in place elevates UX on another level. It enables using apps/web with shortkeys, makes everything more readable, changes entire UX flows into simpler ones.
an_d_rew 6y ago
I have no affiliation with CloudFlare at all, but my interactions with them have all been kind, professional, and courteous. I might recommend reaching out to the CEO, Matthew Prince, with a succinct explanation of your problem and I would be surprised if that by itself does not kick off some serious positive action!
alexnewman 6y ago
As a founder of HCaptcha with a legally blind sister I take accessibility very seriously. We implemented this solution when we were still a tiny startup and I think our accessibility is by far the best of all the captchas. Please email support@hcaptcha.com if you are having any issues and we will find a solution. I'm sorry for the confusion and difficulty you may have suffered.
- alexnewman 6y ago
  https://www.hcaptcha.com/accessibility https://www.hcaptcha.com/accessibility

deleted 6y ago

[deleted]

strombofulous 6y ago

I use audio captchas. Google will usually only let you do 2 or 3 before banning you and making you do image-based ones. I'm pretty sure the button is just there to make it seem accessible.

dependenttypes 6y ago
I had exactly the same issue. I am surprised how neither cloudflare nor google have been sued for making most of the web inaccessible to people with disabilities.
- lopmotr 6y ago
  Shouldn't that liability be with the operators of websites that use those captchas if they're required to be blind-accessible? If they get sued, it'll apply pressure up the supply chain.
  - kbenson 6y ago
    I agree. You don't sue the contractor because they built to the specification you provided. At the same time, if Google is advertising Recaptcha as accessible and it's not really, then they need to be held accountable for that, because that has a real impact on huge swaths of the internet, and especially for sites that try to do the right thing and find out Google has screwed them.
    - ztjio 6y ago
      > You don't sue the contractor because they built to the specification you provided. In the world of licensed contracting you absolutely do. If you provide a contractor specifications that result in a code violation, they have to tell you no. If they don't tell you no then you, the non expert, are reasonable to assume what you asked for is acceptable. If they actually build the thing, they are liable for the violation of code. The last thing we need is to hand out more excuses to evade accountability and responsibility for making the world worse.
      - kbenson 6y ago
        Yeah, contractor is a bad metaphor. I started with Home Depot, but that didn't really fit either. It's more that you bought a ramp that's designed to fit over a two step rise. Was it advertised as accessible in your state/county (which will likely have specific gradient and handrail rules? If not, you should have looked. If the salesperson assured you it was, well that sucks, but I'm not sure you'll get more than your money back. > The last thing we need is to hand out more excuses to evade accountability and responsibility for making the world worse. I'm definitely not advocating that. I'm more advocating that you can't leave all this to someone else entirely. Even if you pay someone for a turn-key custom website and make sure it's accessible, there's no guarantee it still meets standards a year from now, just as if you pay a contractor to build a ramp for you that perfectly meets standards. Things change, and people need to pay attention to the things that matter to them to make sure they follow the law. Whether that's occasionally checking it yourself or paying someone else to do so (and thus ensuring it happens), it still needs to happen.
  - 6y ago
shp0ngle 6y ago
CloudFlare doesn't use Google ReCaptcha anymore. They use some Blockchain Captcha thing now.

1f60c 6y ago

Thank you for sharing your experience. Cloudflare switched to using hCaptcha a couple months ago, I think and I only just noticed that they do not offer an audio-based captcha. However, hCaptcha integrates with Privacy Pass[0], and you can top up your tokens by solving a captcha at [1] and [2]. What you could do (and I realize this is far from ideal), is getting a sighted friend to solve a couple of captchas so you have enough tokens to last you a couple months. [0]: https://privacypass.github.io/ https://privacypass.github.io/ [1]: https://captcha.website/ https://captcha.website/ [2]: https://www.hcaptcha.com/privacy-pass https://www.hcaptcha.com/privacy-pass

waheoo 6y ago
This is such an out of touch dev response. The problem is hcaptcha, the solution is stop using hcaptcha. Not placate and evade with work arounds you wouldn't even suggest to non blind people. Also this ask a friend solution is like telling someone in a wheelchair to ask a friend to help them up those steps instead of just installing a ramp. You don't get to take over half the internet and just ignore social responsibility.
- BTinfinity 6y ago
  Solutions can’t be implemented instantly; a work around is needed until that ramp is installed. As much as the lack of audio solution sucks, you can’t expect half the internet to just give up on a piece of technology overnight
  - waheoo 6y ago
    Why not?
    - Thorrez 6y ago
      When you move fast you tend to break things. When half the internet relies on you you want to avoid outages.

userbinator 6y ago

Just like Google, it is also horrible for those who use more "nonstandard" configurations. I don't remember if it's CF or Google or someone else but I recall coming across sites that would block you if you have JS disabled, claiming that you're a bot, and the ban-page was the same across those sites, so it was a common "provider".

jiggawatts 6y ago

The "human detector" of the modern internet doesn't accept disabled people as sufficiently human. That's... the most dystopian thing I've heard in a while!

userbinator 6y ago
In the other direction, Google thinks I'm a bot if I use complex search queries (exclusions, site:, quotes, etc.) in an attempt to find what I'm looking for. Apparently it thinks I'm too intelligent to be a human.
- nikanj 6y ago
  You’re not profitable enough. You’re insisting on finding the thing you want, instead of settling for what Google is pushing today.
  - anchpop 6y ago
    Since they're on HN they likely use uBlock, which means that they're not profitable for Google regardless of how they search
  - kjeetgill 6y ago
    I get that you meant that sardonically but it's worth pointing out that it would be even more unprofitable implementing ways to catch and redirect you.

booblik 6y ago

Seems like if this issue could easily be solved, a startup would have formed to solve it. Are there any alternatives to recaptcha and hcaptcha that are effective and also accessible?

DrJosiah 6y ago

Hi! I work at hCaptcha (we handle the CF captchas), and to respond specifically: audio is inaccessible for those with visual and auditory processing issues, as well as being broken by ML techniques. Not to project, but we suspect this is why Google turns it off if your browser looks at all suspicious. Another user mentioned the Privacy Pass solution: https://news.ycombinator.com/item?id=23902870 https://news.ycombinator.com/item?id=23902870 While Privacy Pass is not perfect, we are working towards getting better. I'm not in the product flow for accessibility, but if you have ideas outside of audio that you believe would be able to distinguish between yourself and a robot, I'd be happy to discuss via email to ensure that we can get a solution for you and anyone who can reasonably interact with a computer. eta: you can email me directly at work via: josiah@intuitionmachines.com eta2: http://hcaptcha.com/accessibility http://hcaptcha.com/accessibility

drivebycomment 6y ago
Audio captchas are considered broken completely (search for various papers over the past decade, including one from CMU), so it has limited usefulness only in a very narrow context in practice. I suspect this is a harbinger of things to come - as we close the gap on passing the Turing test, captchas are likely to get less effective, and we will need to transition to a very different solution for bot detection.
- chillfox 6y ago
  or, just let the bots be. often it's easier to just use a website as api instead of using some broken xml nightmare that requires knowledge of the database tables. If the concern is rate limiting then just rate limit the website. And if you don't like people operating websites with bots then I don't know, maybe stop making websites.
  - Karunamon 6y ago
    Easy proxying means rate limiting doesn’t really help all that much to defeat bots. And then if you do something like blocking or severely restricting something like Tor (the world's largest open proxy and hence, primary abusive traffic source; something which it would make sense to throw extra bot walls in front of), privacy and accessibility advocates jump down your throat. This is a no-win situation. I’m not convinced it’s possible to have ones cake and eat it too, here. Someone upthread said “security, privacy, accessibility, pick any two”, and I have yet to see any evidence of a third option.

virtue3 6y ago

It might be worth filing an ADA compliance notice against cloudflare. This is seriously disturbing. As someone that works in ed tech - anyone that supports higher education is required to support screen readers etc. If any of those sites are using cloudflare that would block them from being compliant pretty seriously.

Craighead 6y ago
Isn't this a title 9 violation?
miki123211 6y ago
I'm not american, otherwise I would definitely do so. This issue is mostly unnoticeable, as long as you're not considered malicious to Cloudflare, everything works perfectly and passes accessibility audits. When something weird happens and Cloudflare flags you, you cannot access the system at all. For those doing accessibility audits out there, this kind of issues might be worth looking into, as they're very non obvious and very critical.
- alexnewman 6y ago
  Have you tried our accessibility option? https://www.hcaptcha.com/accessibility https://www.hcaptcha.com/accessibility

whatsmyusername 6y ago

They switched from recaptcha to some gargage cryptocoin meme captcha service. For the first week I spent most days bouncing from sites because I got tired of getting captched every page. If you captcha me on every page I don't give you money. Real easy.

reactchain 6y ago

I'd love to read more about the economics of captchas - what is the "labor" of classifying images worth? What is the marginal cost per captcha of human solver farms, etc. Can anyone point me to some resources?

ramanova 6y ago

The a11y problem is super urgent for the majority of products out there. Not only it prevents blind/non hearing people of using systems. People also tend to forget that having a11y in place elevates UX on another level. It enables using apps/web with shortkeys, makes everything more readable, changes entire UX flows into simpler ones.

an_d_rew 6y ago

I have no affiliation with CloudFlare at all, but my interactions with them have all been kind, professional, and courteous. I might recommend reaching out to the CEO, Matthew Prince, with a succinct explanation of your problem and I would be surprised if that by itself does not kick off some serious positive action!

alexnewman 6y ago

As a founder of HCaptcha with a legally blind sister I take accessibility very seriously. We implemented this solution when we were still a tiny startup and I think our accessibility is by far the best of all the captchas. Please email support@hcaptcha.com if you are having any issues and we will find a solution. I'm sorry for the confusion and difficulty you may have suffered.

alexnewman 6y ago
https://www.hcaptcha.com/accessibility https://www.hcaptcha.com/accessibility