20 ms·

hCaptcha now runs on fifteen percent of the internet

605 points by fab1an 6y ago

Normille 6y ago
Is that meant to be a proud boast? Because, to me, it equates to someone bragging that 15% of the people they've slept with now have syphilis.
alexnewman 6y ago
Curious what people think about hCaptcha?
- mtmail 6y ago
  We switched a couple of months ago. Integration wasn't more or less difficult, works alright with our test suite. Some users feedback "Why do I have to identify boats?" but otherwise we found no difference number of blocks or user behavior.
- DoctorOW 6y ago
  Personally I find it much more difficult than recaptcha. The tests themselves aren't much worse but since I have a Google account HCaptcha shows up more frequently.
  - californical 6y ago
    Small price to pay to prevent Google from having tracking scripts and metrics on users of every major website. hCaptcha at least somewhat values user privacy.
- jtbayly 6y ago
  Far, far superior to reCaptcha from a user's perspective using Tor. I can solve a few puzzles with hCaptcha and I know I'll get through and see the content. With reCaptcha I might solve 3 puzzles and then get denied anyway, or I might solve 10 puzzles with no end in sight and give up.
  - seisvelas 6y ago
    On the other hand, many Tor users disable Javascript. Out of curiosity, does anyone know a good CAPTCHA that doesn't use JS?
    - jdu9 6y ago
      BotStop by hCaptcha (enterprise). AFAIK there's also a Google reCaptcha frontend that doesn't require JS. Neither companies offer those solutions because of privacy or security benefits, but to support old IE versions of course.
      - seisvelas 6y ago
        > BotStop by hCaptcha Cool, I didn't know about this! Too bad there doesn't seem to be a strong open source option, but I'll check this out.
  - CodesInChaos 6y ago
    Not sure if I'm seeing patterns in noise, but with recaptcha I felt that timing and mouse movements are just as important as clicking the right images. It feels like solving the puzzle quickly and using minimal mouse movements has a higher chance of being denied compared to waiting some time between clicks and adding some superfluous mouse movements.
    - MattGaiser 6y ago
      It also seems to be this way too. If I am using Tor, it seems like I need to swirl my mouse around a few times to pass a recaptcha.
  - jdu9 6y ago
    But also far superior to reCaptcha from a bot's perspective using Tor. Don't get me wrong: I also hate solving a gazillion captchas only because I'm using a VPN or get outright denied because my IP address happens to be a Tor exit node. At the same time you have to acknoledge that captchas don't stop bots, only slow them down or increase their operating costs. People in third world countries happily solve one image recognition challenge by Google or hCaptcha for far less than a penny. If Google's goal is to drive the costs up for malicious bot operators, then they're definitely doing the right thing. In the end, it won't stop them either since buying a couple thousand infected computers is probably not that expensive, but it is yet another stepping stone for anyone trying to bypass their captcha.
- eznzt 6y ago
  I don't like it because Buster doesn't work on it. Also since only cloudflare uses it, and I dislike cloudflare, I have this irrational hatred of it.
  - jdu9 6y ago
    >because Buster doesn't work on it Assuming you mean Debian Buster: Then get a newer Firefox version from backports. This is more related to Firefox ESR than Buster. Edit: Nevermind... After reading other replies, I think eznzt referred to https://github.com/dessant/buster https://github.com/dessant/buster
- innocenat 6y ago
  For me I find hCaptcha harder and more ambiguous than what I have experienced with reCaptcha. The ambiguity might be because my phone is set to Japanese. I got asked to identify 電車 (Densha, electric train), but there were also images of diesel train. Is it translation error, or is it really asking me to identify electric train? (The correct term for train in general in Japanese is 列車 ressha)
  - deleted 6y ago
    [deleted]
  - fab1an 6y ago
    Great catch. If you'd like, you can actually submit a better translation via a pr here: https://github.com/hCaptcha/hcaptcha-i18n https://github.com/hCaptcha/hcaptcha-i18n
    - gnud 6y ago
      I don't think you can? That repo has the translations of the strings used by the "meta"-part of the service, stuff like "accessibility information". I can't see any text used by the actual tasks.
- nekoashide 6y ago
  It's been terrible, when Cloudflare switched to hCaptcha it not only broke our app but it seems every time they make a change it breaks something else. We might be a special case but it's hard to say since all they say it's "quirks" and they keep making changes without announcing anything.
- slig 6y ago
  Dislike it, to say the least. Since it doesn't seems to remember that I'm a human (reCpatcha did), now I have to constantly solve captchas on CF sites.
  - eatbots 6y ago
    With hCaptcha (enterprise ver) this is entirely under the control of the customer. We're not "remembering" in the same way, but have good enough instantaneous scoring to correctly guess whether or not a challenge is required most of the time. Some customers may disable that option to meet their requirements. Not much we can do about that :)
    - slig 6y ago
      Thank you for clarifying that, hope that CF decides to use this feature.
- meibo 6y ago
  I really don't like it. They are generally harder and if I visit a CF site multiple times, I have to solve them multiple times. Even if this is up to the customer, it's annoying and should be discouraged. I didn't mind solving a reCaptcha once, I mind forcing myself through these every 10 minutes.
- maple3142 6y ago
  It is more annoying than reCAPTCHA if you don't aggressively block tracking. because I rarely need to solve it manually in reCAPTCHA, while it is not the case with hCaptcha.
ve55 6y ago
Worth noting that this title is primarily due to Cloudflare having switched to them from ReCAPTCHA, and Cloudflare is... well, relatively popular, to say the least. I'm curious what kind of data may exist on the experience of switching for larger providers; do the users like it? how much more/less time do they spend solving? do they care, let alone even notice that it's not Google's ReCAPTCHA? Regardless, as ReCAPTCHA is not only terribly annoying but also built for surveillance from the ground up, I still view this as a good improvement.
- QUFB 6y ago
  Honest question: How do you view it as an improvement? The same data is being shared, and the only difference is that Cloudflare isn't immediately behaving in the same evil ways as Google. But once you concentrate power in an entity, perhaps bad things might happen? ... If there was an on-premise captcha implementation that actually worked, that would be great.
  - fab1an 6y ago
    Unlike Google, hCaptcha isn't running an ad network "on the side" of their bot management business :) joking aside, hCaptcha is an extremely privacy-conscious operation, Google is not.
    - QUFB 6y ago
      I'm not a lawyer, but can you explain how their privacy policy is privacy-conscious now and going forward, and how centralization of network transit with Cloudflare isn't a bad thing? https://www.hcaptcha.com/privacy https://www.hcaptcha.com/privacy
      - eatbots 6y ago
        hCaptcha is more focused on technical solutions to privacy that minimize required trust. A privacy policy is one thing, but a mathematical guarantee is quite another. We are working through the IETF and directly with browser makers to support provably private options like Privacy Pass, and are currently the only CAPTCHA service to support this. Similarly, on the enterprise side we offer various technical options to let our enterprise customers guarantee exactly what data we can and cannot see. (disclaimer: work there, comments not official, etc.)
blindm 6y ago
I think it's great. So many sites sit behind Cloudflare now and Cloudflare now uses hCaptcha, which is a big win. And the hCaptchas themselves are easy to complete. No more wondering if you actually clicked on 'all' the traffic lights anymore, yay! I inspected the source code of Google's reCaptcha offering and was disgusted at how many bits of information they were collecting. They also seem to be fingerprinting users so they can't keep registering new accounts on a platform, locking out anonymous users who are usually the best types of users on the platform, as IMHO anonymous voices are (usually) the best voices, or at least the more interesting of voices. Google's reCaptcha code seemed to be very keen on knowing my 'cadence' or the way I used my mouse and how quickly (or how slow) I completed the captcha. It also looked at things like timezone, screen resolution, battery charge level etc So they could determine if it was 'you' who was using the captcha, soon after, in a separate session (even on a different device!)
- dheera 6y ago
  reCaptcha has also gotten increasingly annoying lately. I forgot my password to one site and tried about 2 or 3 different passwords and in-between each it asked me to do about 7 or 8 of those labelling exercises. I finally just gave up and left the site. Not only that, but the labelling exercises weren't clear. It wanted me to label a "公交車" which means more like a public city bus and there were also school buses which would normally not be called that in Chinese so I didn't label them but Google thought they were part of that class, and wouldn't let me proceed without me labelling them, and furthermore, punished me with more "hard" exercises like that. I guess they are trying to turn me into a stupid bot.
  - dsabanin 6y ago
    Recently Google's captcha asked me to mark all the traffic meters on the photos, and amongst the choices was a photo of a mailbox. It didn't let me through until I marked it as a meter as well. Good luck to whatever self driving car they are training using this data.
    - dmurray 6y ago
abhinav22 6y ago
I really hate all these captcha codes Why can’t they do something like a reverse SSL where we have to authenticate ourselves as humans? For example if I have an Apple account on my Apple devices, why can’t they figure out a way to authenticate me as a human from that information? This doesn’t work for all scenarios (eg throwaway accounts), but it could work for the majority?
- mathnmusic 6y ago
  Webauthn may make it easy because it supports platform authenticators like Touch ID / Face ID. Two good demos are at http://webauthn.me/ http://webauthn.me/ and https://webauthn.io/ https://webauthn.io/ It's now supported in all major browsers but platform authenticators are likely not supported on all OS yet.
  - abhinav22 6y ago
    This makes a lot of sense - exactly what I was thinking
    - mathnmusic 6y ago
      I'm not sure it will be as secure as captchas though. Browsers will probably allow dummy platform authenticators for ease of development, which can be used by bots as well.
- hombre_fatal 6y ago
  Well, the point is to avoid automated abuse. Your Apple account on your Apple device doesn't stop you from unwittingly being part of a botnet, for example.
  - abhinav22 6y ago
    Why wouldn’t it? Unless they hack my account Genuine question - I don’t know much about this field
- 6y ago
kaycebasques 6y ago
This sounds kinda nitpicky but I think it's an important distinction. We're talking about the web, not the internet, right? Or is hcaptcha also used for iOS apps, Android apps, etc.?
- fab1an 6y ago
  hCaptcha runs anywhere, even works on Telegram groups: https://github.com/hCaptcha/telegram-bot https://github.com/hCaptcha/telegram-bot
- paxys 6y ago
  That distinction is already blurred beyond recognition. There's nothing that makes a phone app more or less "web" than a SPA, for example.
  - kaycebasques 6y ago
    The distinction between iOS apps built in Swift and distributed on App Store (for example) and a website built in JS/HTML/CSS and distributed via the web's decentralized architecture is pretty clear IMO. Case in point I don't see hCaptcha/reCAPTCHA on iOS apps as frequently as I do on websites. The way I was taught in my elementary networking class was: the web is an application of the internet. The internet as a concept is much broader than the web.
    - paxys 6y ago
      "The web's decentralized architecture" isn't a thing. There are clients and servers and communication protocols, that's it. There are plenty of web apps distributed from custom stores. And the web doesn't mandate using JS/HTML/CSS. A client (whether browser, CLI, phone app, bot or anything else) making resource requests identified by a URL to an HTTP server is as "web" as it gets. The reason you see fewer capchas on iOS and Android is that it is a lot harder to automate them for spam, that's all.
      - kaycebasques 6y ago
markosaric 6y ago
That's great to see! At Plausible Analytics, we had a wave of spam attacks two months ago or so and hCaptcha saved us. Great product and great service both for companies and for users. We're very happy with how it works. And great to have a quality de-Googled alternative for this use case!
dvduval 6y ago
I appreciate at least having a good option that doesn't involve putting a Google product on my website. We tried to use our own captcha back in the day, and then used some third party, and they just weren't good enough. I'm glad to see them getting this market share because it means that they will get the opportunity to improve based on a large set of users similar to how Google is able to make their products so good.
TechBro8615 6y ago
I vastly prefer hCaptcha to recaptcha because it doesn't treat me any differently just because I'm using Tor. Recently (last year or so), Google has started to explicitly refuse service to me when I use Tor (only after forcing me to solve a CAPTCHA for 3 minutes). Question for dang -- why does HN continue to use recaptcha? It's impossible to signup via Tor, and Google is a user hostile company. One thing I will note, is that hcaptcha seems to be more loose in what answers it accepts. Sometimes I click random images and it still lets me pass.
amasad 6y ago
We've moved to hCaptcha from reCAPTCHA after Google surprised us with their pricing (blog[1], hn discussion[2]), and couldn't be happier. We use it in invisible mode and it does a great job at finding bots while getting out of users' way. Also top-notch customer support. The CEO was personally in the slack channel helping us. Highly recommended. [1]: https://blog.repl.it/anon https://blog.repl.it/anon [2]: https://news.ycombinator.com/item?id=25004476 https://news.ycombinator.com/item?id=25004476
- judge2020 6y ago
  > We use it in invisible mode and it does a great job at finding bots while getting out of users' way. Interesting didn't realize this was a thing hcaptcha did[0]. It's basically recaptcha in terms of tracking which sites you visit then, no? 0: https://docs.hcaptcha.com/invisible https://docs.hcaptcha.com/invisible
  - fab1an 6y ago
    I think parent means hCaptcha enterprise in passive mode, where hCaptcha is detecting bots in the background using ML: botstop.com
    - aftbit 6y ago
      Surely this ML must be presented a wide set of data on the user and their browser to make this determination? So just like recaptcha, they determine if they should admit you based on passively snooped data rather than active challenges.
      - ve55 6y ago
        My knowledge of this is that hCaptcha uses anonymized user data to ensure that the user doesn't look like a bot. What ReCAPTCHA did differently is not only not anonymizing data, but specifically trying to find out which person was presented with their captcha by matching cookies and profiles to Google accounts (which the majority of users would have and be logged into for many reasons). When you combine this with Google owning everything from Gmail to Youtube to Android to Chrome, it gets extremely pervasive.
fulyscentedking 6y ago
How do we know your product preserves privacy when it's close sourced? Also, users should not be manipulated and used for training your machine learning models when they are trying to sign in on a website. I simply don't used it if the website is trying to give me this kind of nonsense.
Zak 6y ago
I dislike the widespread use of captcha regardless of provider. I realize anything connected to the internet will be subject to automated abuse, and it's impossible to run some types of services without taking some steps to defend against it, but it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time. The exact details will vary based on the type of service, of course. One particularly egregious misuse of captcha in a service I use presents one after I enter a correct username and password. An incorrect login says so without presenting a captcha. The potential reward for an attacker who successfully gains access to an account is high, so it seems almost certain anyone running a targeted attack would defeat this by handing it off to a human upon detecting that they had a good account.
- jsnell 6y ago
  There's a good reason for what you're identifying as misuse. If you show a captcha after a failed password, you need to show a one after a correct password as well. Otherwise you leak information. You can have other solutions, e.g. in a login flow that splits the username and password entry, it's advantageous to put the captcha between those two steps. But even in those solutions the display of the captcha must be independent of password correctness.
  - aleph1 6y ago
    That's not what's happening: > An incorrect login says so without presenting a captcha.
    - jsnell 6y ago
      Thanks, I misread. Then that indeed makes no sense!
  - aftbit 6y ago
    There's a lot of arguments against captchas, but I do not agree with this one. You will always leak whether or not a password is correct based on how your app behaves - a correct password will grant entry to the application. If you only ask for a captcha when a user account exists but fail to ask if they use a made up username, that's an information leak.
tuckerconnelly 6y ago
As someone who scrapes, captcha's are pretty silly. One of the sites we scrape implemented hCaptcha, and it was a breeze to get around. There are a few things that make my life more difficult, but captchas aren't one of them, and nothing can stop scraping altogether.
- alexnewman 6y ago
  How'd you do it?
  - driverdan 6y ago
    I'm not OP but there are cheap solving services that will fill them in for you. The cost is trivial and they have decent APIs for automatic integration into scrapers.
    - londons_explore 6y ago
      many captchas let you fill them in once and then use the resulting cookie to do whatever else you like on the site. Just manually copy the cookie to your bot hosts.
- hombre_fatal 6y ago
  Meh, there's always going to be a longtail of targeted abuse so it's not much to boast over. Xrumer software in 2001 could even let you sit at your computer and fill out those common PHP-lib captchas (like on EZBoard) while Xrumer spammed internet forums and blogs. You could even hire a cubicle farm of humans to manually abuse a web service. Captchas filter out the 90% bulk of automated abuse. Btw, web scraping is on the nearly harmless side of abuse.
  - tuckerconnelly 6y ago
    That makes sense that there's longtail abuse, thanks. What would you say is more harmful abuse? Spamming endpoints for SQL and other injection attacks?
xapata 6y ago
hCaptcha makes money by having humans label things to teach machines. This suggests that at some point, the machines will be nearly as good as the humans at labeling. At this point, until the humans are tasked with a different training exercise, a bot will be effectively indistinguishable from a human via hCaptcha. If there's value in it, it sounds like a spammer could train an hCaptcha-defeating bot via hCaptcha.
- aciswhat 6y ago
  I think it's likely they'll add new types of exercises as this starts to happen.
  - xapata 6y ago
    The exercises are dependent on what researchers are paying for. The spammer needs to keep up. Which they can do by sampling hCaptchas and figuring out what tasks are being done. The question is how much value spamming provides. If it's significant, then it pays for the arms race. Given the investment in beating reCaptcha, it seems that spam provides high value. Edit: And! And! hCaptcha could become victim to a malicious bot that feeds bad data into other researchers' training sets. The bot would need to reply to an overwhelming number of hCaptcha captures, such that it becomes the dominant validation set. It would be a self-fulfilling model. It'd even be performed at the expense of the legitimate researchers, who must pay ethercoin for every hCaptcha response. Much like cryptocurrency networks, hCaptcha is susceptible to a cartel. In this case, it'd be a bot-cartel, feeding bad data. Humans could be locked out, as hCaptcha might be convinced the humans are bots and the bots are human.
- trianglem 6y ago
  Wait they actually use the labeling for something other than admittance? Well that takes care of my concern about this tech then, gotta go back and change some of my other comments...
  - fab1an 6y ago
    Google uses reCAPTCHA labels exclusively for themselves, and is extracting hundreds of free person years of labor from internet users every single day via this. hCaptcha lets anyone access this type of service, provided they follow certain ethical AI guidelines
catovh 6y ago
Not keen on hcaptcha because I'm almost always need to solve 2 sets of the puzzle vs 1 with recaptcha. Theres a thin line between privacy and convenience, most of the time I've felt hcaptcha to be on the least convenience side.
- abc-xyz 6y ago
  Only 2? I usually need 5+.. not that recaptcha was any better. I sincerely hope they, along with all other companies providing captcha services, go bankrupt.
hlava 6y ago
I hate hCaptcha, those pictures are messy, they pop up everytime and theres 2 slides of them... Why not just use the honeypot method?
drngdds 6y ago
Is hCaptcha less of a pain for users who block tracking (with Brave, Privacy Badger, uBlock Origin, etc) than reCaptcha is? I'm not sure I've ever solved an hCaptcha, but I find reCaptchas to routinely be incredibly time-consuming, and I suspect it's because I block their trackers.
- fab1an 6y ago
  Google reCaptcha likely discriminates against non Chrome users, hCaptcha does not. Also, we support and co-develop https://www.hcaptcha.com/privacy-pass https://www.hcaptcha.com/privacy-pass !
- intellirogue 6y ago
  I'm using Brave plus NextDNS, and am on a CG-NAT IPv4 address, so reCaptcha absolutely hates me. I always need to do at least 5 rounds of matching before it'll let me past. My record has been 12 rounds. hCaptcha seems to pretty consistently only make me do 2 rounds, so I certainly prefer it.
seanwilson 6y ago
How is hCaptcha for page performance? Google Recaptcha ruins your page speed rankings as it ideally has to load chunk of JavaScript on all pages on page load to continually monitor user behaviour. You could e.g. only load it when someone starts filling out a form but this kind of integration isn't standard.
- fab1an 6y ago
  You only put hCaptcha / BotStop where you actually need the protection, and it certainly doesn't follow your users around unnecessarily
throwaway1723 6y ago
Reading their website: >Presented Challenges: >Comparison - Select all images that match query >Bounding Box - Define bounding area for objects >Categorization - Identify the corresponding labels >..and other simple tasks. No, hCaptcha, no way am I going to train your neural networks for free, so please join Google on your journey to hell.
rootusrootus 6y ago
I'm really starting to hate all the captchas with a burning passion. Partly because the corporation I work for seems to have gotten our NAT addresses onto a blacklist so I get captcha'd constantly, and partly because my close up vision is getting noticeably weaker (pushing 50, that's why) and without hunting down my reading glasses it can be difficult to make out the smaller details necessary to solve the puzzle. Especially when I'm on my phone. I really wish we could find something relatively foolproof that didn't rely heavily on tracking or really good vision.
- chrismorgan 6y ago
  Similar deal where I am at present in India: the small ISP uses carrier-grade NAT, so there’s malware and related activity occurring every day from at least one of the who-knows-how-many people behind this one IP address. Last time I was here in 2016 it was actually a lot worse than it is now (then, any Cloudflare site would trigger it, so I’d be hitting dozens of challenges per day), but I still get the occasional hCaptcha here (e.g. the Audacity wiki), and they’re awful. I normally take two or three attempts (quite apart from the regular times when you finish the challenge and press submit, and it just does nothing), guessing things like whether they want to count this particular dark smudge as a motorcycle or not, or whether this fragment of a motorcycle should count or not. I wish people would just face up to the reality that challenge-based CAPTHCA techniques have failed, and stop using them.
  - hda2 6y ago
    Try using privacy pass. It's designed for use cases like yours.
    - LeoPanthera 6y ago
      Not available for Safari though. Or any mobile browser?
    - chrismorgan 6y ago
      That still requires you to fill out a CAPTCHA at least once, and also requires that you install a browser extension, which I baulk at doing, especially when it needs the “do anything on any website” permission.
cute_boi 6y ago
thanks for making something that has capacity to break google recaptcha v3.
surround 6y ago
Almost all of the users that Cloudflare shows captchas to are Tor users. Is there any reason why this couldn’t be done without Javascript?
- thewebcount 6y ago
  I don't believe this to be true. I've never touched Tor, and am constantly hounded by different Captcha mechanisms. I do aggressively block tracking, though.
koreanguy 6y ago
Captcha is a terrible 90s technology, it should have been completely destroyed in year 2000. it's really annoying.
- heavyset_go 6y ago
  Don't worry, the next iteration of CAPTCHAs will rely heavily on browser feature detection, ensuring that you're not using an unauthorized version of Chrome that can be automated. Only authorized and trusted browsers will pass the tests.
  - GekkePrutser 6y ago
    Which will mean even more restrictions on the types of browsers we can use, and gathering more information. Not OK either.
    - heavyset_go 6y ago
      This was my point. Google is already doing this[1] for account access, and they will prevent competitors' browsers from logging in. [1] https://news.ycombinator.com/item?id=25172755 https://news.ycombinator.com/item?id=25172755
- kevincox 6y ago
  If it should have been destroyed what is the reason you think it hasn't been? People aren't adding captchas to websites for fun, it is clearly solving a problem for them. So what do you propose instead?
  - GekkePrutser 6y ago
    It's solving a problem for THEM at OUR (the users') expense. We should fight this more heavily just like we do ads and tracking and hopefully this practice will at least stop expanding. The amount of sites now showing captchas is crazy. Or introduce a law where they have to pay us for using up our 'brain time'.
TaylorAlexander 6y ago
Anyone know why their seems to be military imagery on hCapcha? I don’t want to train anything for the military...
svacko 6y ago
I see the product is offered in 2 plans, though the only paid plan is enterprise without publicly disclosed pricing. Anyone has info whether it's affordable also for small and bootstrapped businesses or it's primarily focusing on larger enterprises?
- gingerlime 6y ago
  Last time I enquired they quoted starting $999/mo for 10m verifications...
  - svacko 6y ago
    Thank you. That's not a small sum, though they probably have some internal tiers per number of requests so for lower traffic scenarios the monthly price might be more affordable.
    - gingerlime 6y ago
      I asked and they said that’s the minimum, and they had no plans to introduce smaller self-serve tiers.
kraig 6y ago
So we use 15% of the internet for captchas and I lose 15% of my life identifying crossroads, stoplights, and buses to computers. There's got to be a better way
- dmtroyer 6y ago
  you spend 100% of your life on the internet?
- xiphias2 6y ago
  You should take a Waymo while solving the puzzles to get back the time
accounted 6y ago
I don't understand why anyone likes hCaptcha. With reCaptcha, I rarely got more than the checkbox. Now I get a series of puzzles every time I want to look at a web page. When that happens, I'm just closing out, and going to a better website.
- thewebcount 6y ago
  Because many of us get the same puzzles over and over with reCaptcha, and often get sent into the infinite puzzles zone despite being both a human and answering correctly. The assumptions built in to reCaptcha just aren't good. There are people that don't accept cookies for anything, but who aren't bots. There are real humans using text-only browsers. There are people who's mouse and keyboard events fall far outside the expected range of normal human users, or who use aids such as macro keys that playback canned responses and confuse Google's methods. So I can definitely imagine anyone who's dealt with that shit for years being happy to have something different to try. Even if it's just as annoying, at least it's not the same damn thing!
  - accounted 6y ago
    I would say it's not just as annoying, it's worse. It has all the same annoyances, except now I get the worst outcome every time.
  - tomjen3 6y ago
    My favourite failure mode was when I was using a roller as a mouse and it constantly failed. It took me a while to figure out that it was probably failing because my mouse would move in a straight line. Naturally if I was logged into my google account I wouldn't have much of an issue, because I would be feeding the surveillance machine.
- neop1x 6y ago
  We need more auto-solver services. Pay a subscription and let developing country workers solve captchas for us. Extra expense on top of internet connectivity plan.
deleted 6y ago
[deleted]
heavyset_go 6y ago
I used to think that reCAPTCHA was bad, but then I had to solve numerous CAPTCHAs from hCaptcha. Now I think that they're all bad.
pieterhg 6y ago
My mom and dad's shared IP (somewhere in Europe) repeatedly gets on CloudFlare's IP ban list meaning my mom keeps having to solve these hCaptcha's. hCaptcha's is a lot more difficult to complete than Google's reCaptcha and she has a lot of trouble with it. Why they get on these IP lists is I think because it's a general consumer ISP and probably a lot of people get bot nets on there.
- hda2 6y ago
  Install privacy pass on their computers. It won't eliminate the captchas completely but will decrease the number of times they'll see them. I believe cloudflair gives you 30 passes for each captcha solved.
- MeatBro 6y ago
  What service they use have a big implication of if they get captcha'd. Try switchingservices
- bastawhiz 6y ago
  I've learned that folks end up unintentionally installing software which acts as essentially "proxy server as a service". I've heard of browser extensions doing this, but I would be unsurprised if mobile apps did it. Every holiday I do a sweep of my parents' devices to make sure they haven't installed anything silly (my mom somehow always has three or four different weather apps). I'd suggest giving it a look the next time you can.
- drivebycomment 6y ago
  Or, it could be that their computers or home network is infested with malware or bots. Majority of people complaining about captcha need to look at their system first. Of course any detection system has false positive, but the false positive rate is not double digit percentage in vast majority of cases.
EGreg 6y ago
Aren't Apple and Google almost obviating the need for this, since they control their duopoly platforms? https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_rest_api/authenticating_users_with_sign_in_with_apple https://developer.apple.com/documentation/sign_in_with_apple... PS: Anyone have the corresponding Google link?
LockAndLol 6y ago
Honestly, I thought hCatpcha was being run by OpenAI in order to provide the benefits of millions of people training AI, but they seem to be completely unaffiliated. What happened to OpenAI? Do they belong to Microsoft now or something?
ve55 6y ago
The sub-header of this blog post is "You can beat Google by putting privacy first", and at this point it's interesting to think of how many businesses have done exactly this for an entire range of Google products with success.
arendtio 6y ago
Their demo even doesn't work for me. It displays an error message in my native language similar to 'Rate limited or network error. Please try again.'. Reloading doesn't change the situation (maybe related to my ad blocker). Doesn't make the best impression...
Animats 6y ago
Anyone have an example of hCaptcha usage?
withinboredom 6y ago
I'd really love these captcha services to allow me to download an extension that allows me to bypass their captchas. This extension could verify my identity and/or device, or just keep an eye on my behavior to validate that I'm human.
- mdaniel 6y ago
  Are you aware of their accessibility cookie? https://www.hcaptcha.com/accessibility https://www.hcaptcha.com/accessibility It's not exactly what you were asking for, but it can make their disease less painful
dathinab 6y ago
Honestly captcha seem pointles to me. Literally every time I'm in a situation where I'm required to use a captcha to access a site it is impossible to successfully solve the captcha in any sane amount of time. This happens both with google and cloudflare. Tbh. if they don't trust my connection can't they just tell me so instead of pretending to provide a "I'm not a robot" test which is practically (close to) unsolvable??? (Note that this post only refers to captchars guarden the access of an site if they somehow don't trust your connection, not "I'm not a robot captures" on forms or similar).
superkuh 6y ago
15% of the web. And probably only of the commercial web.
YetAnotherNick 6y ago
From the privacy policy We collect the following categories of information: Information that can be used to identify or contact an individual ("Personal Information"), such as name, email address, and country.... We may also verify the identity of our Integrators and Customers by comparing personal information against third party databases or official legal documents. Information collected automatically as a result of an Integrator’s or Customer’s use of the our Sites or the Services ("Analytics Information"), such as IP addresses, browser type, Internet service provider, platform type, device type, operating system, date and time stamp of access, and other similar information. Some Analytics Information is collected on our behalf by third parties we engage for that purpose, and some Analytics Information is collected through a variety of tracking technologies, including cookies In the preceding 12 months, we have shared the following categories of information with third parties for a business purpose: Identifiers. A real name, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers. Shared with Service Providers Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). A name, credit card number, debit card number, or any other financial information. Shared with Service Providers Commercial information. Records of products or services purchased, obtained, or considered. Shared with Service Providers Internet or other electronic network activity. Browsing history, information on a consumer's interaction with an internet website, application, or advertisement. Shared with Service Providers Note: Fraud risk associated with an individual IP address may be shared with an Integrator upon request. https://www.hcaptcha.com/privacy https://www.hcaptcha.com/privacy
- einpoklum 6y ago
  Wait, that's the hCaptcha policy? Can you link to it on their website?
  - YetAnotherNick 6y ago
    Updated it in end. By the way I am not in anyways related to hcaptcha. Just sharing it because they don't seem to be the saint that everyone else is believing them here.
jedberg 6y ago
"hCaptcha has grown into the largest independent cybersecurity service in the world" I feel like Cloudflare might have something to say about that, given that Cloudflare is an independent cybersecurity service and uses hCaptcha.
Razengan 6y ago
I can’t be the only one offended by the unpaid labor involved in CAPTCHAs (training self-driving AIs or whatever). I wish Apple would offer a way for sites and services to verify that a client is indeed human via Touch ID/Face ID.
White_Wolf 6y ago
tbh it no ammount of captcha will help a popular platform. If you go black hat for around $150 in private proxies + poster bot + spinner + (insert capcha service here because I dont' want to advertise them) you can pretty much spam anything for a while. That being said it does make it harder to spam if you don't have a budget to start with.
XCSme 6y ago
Is there any place where you can just solve captchas from hCaptcha? I was curious what kind of questions/labels it displays.
- drusepth 6y ago
  https://www.hcaptcha.com/ https://www.hcaptcha.com/ has a "Try it out" section on the homepage you can repeatedly solve for examples.
vrperson 6y ago
reCaptcha is horrible. If you are a business, please stop using it. It feels like working for Google. why the hell should I have to do work for Google when I want to do business with you?
dep_b 6y ago
I haven't tried Firefox + AdBlocker in a while but I always had the idea that in a very Mechanical Turk way I had to earn my few cents worth income for the machine before I was allowed to have no ads and live outside of the Google Empire.
solinent 6y ago
While privacy is definitely my main concern here, it's not just privacy that's the issue here--I believe people should be compensated for the work that they offer society and if Google is using a captcha to create driverless cars then it's obviously antithetical to this premise. I always try to miss some of the obvious items or make mistakes and I (almost) always get through. There's only one service that uses a Google captcha that I continue to use, so it's not really a huge issue for me anyways, and I have decided to stop using it! It's not too difficult to host your own captcha, I don't see why this can't be an open-source effort.[1] [1] https://github.com/dchest/captcha https://github.com/dchest/captcha
deleted 6y ago
[deleted]
elliottinvent 6y ago
It’s good to hear that alternatives to any Google tech are gaining market share. For me, all captchas are a stain on the web - in most cases, shifting (and multiplying) the wasted human hours from the company collecting data (eg the owner of the contact form) to the user (the person completing the contact form). The company is saved from filtering through contact form responses from bots (spam and injection attempts) but simply shifts the work to the user who they hope to pay for their service, losing countless enquiries from frustrated users. In my opinion, the only acceptable use for captchas is when you’re making a useful, free, no-login-required service available to the public and even then should only be brought in after bursting reasonable rate limits.
- throwaways885 6y ago
  > For me, all captchas are a stain on the web - in most cases, shifting (and multiplying) the wasted human hours from the company collecting data (eg the owner of the contact form) to the user (the person completing the contact form). I run a contact form for a small business. Explaining to them why their tiny website has tens of thousands of spammy requests filled with porn keywords is not easy. Of course webmasters add reCAPTCHA, because they're vastly outnumbered by bots and users.
  - elliottinvent 6y ago
    I did this too. Providing contact forms for lots of websites. In my opinion, back end filters are the solution to the problem you’re describing. Not making the genuine users jump through hoops.
deleted 6y ago
[deleted]
deleted 6y ago
[deleted]
terrycody 6y ago
hydrant car airplane crosswalk traffic light nightmare
ac42 6y ago
Just tried the demo and found it somewhat confusing "enter your name and your favourite vegetable" is to lure bots into responding? When "I am human", I am asked to select boats and fail because I didn't tick the images with ships. I would not like to add a Captcha that appears to be smart Alec, has a tendency to trigger the same in the respondents or, worse, makes customers feel stupid. reCaptcha somehow seems better at avoiding this.
fierarul 6y ago
Never heard of them before but went to their main site and got served the Romanian version which is so bad I think it could be used as commedy. Also loved how their front page image shows a barrier with their logo stopping some robots but the robots are facing the backside of their logo/stop sign! Like, hire me for more! I'm curious how can they train ML models while preserving privacy. Where does the corpus come from?
vilifiedtwin 6y ago
I should have a right to not disclose whether I am a human or not. Captchas invade privacy and essentially you become an unpaid content classifier.
Proven 6y ago
Has anyone estimated the cost of lost users or visitors thanks to this crap? Sure it may prevent robots from visiting but it also loses business. Personally I just close the tab if I see that crap and go elsewhere.
jokethrowaway 6y ago
Is this mainly thanks to getting Cloudflare as a customer? Congrats, albeit I have to say I had less problems with recaptcha captchas. I experienced a couple of cases of hcaptcha just not working correctly and being unable to access something despite the captcha success, which never happened with recaptcha (in my experience).
gregmac 6y ago
I see there's several "captcha solving services" (Google the term, I don't want to link any) that charge in the $1's per 1000 solves. This makes me wonder how effective captchas really are. Do they just raise the bar high enough so only spammers actually making money attack the more lucrative sites? Can anyone talk about their experience running a (large) service with a spam problem where adding a captcha helped? How about still battling bots/spam/abuse despite having a captcha? Supposedly these services have humans solving these. I remember hearing about a bypass in use where the attacker would pass-through captchas and present them to users on their own pirate/torrent/porn/etc sites, and then when the user solved it, they'd get at the content and the spammer would do whatever they were doing on the original site. I wonder if that technique is still in use, or if there are people specifically sitting there solving captchas all day being paid fractional pennies per solve?
- wraptile 6y ago
  Captchas are not effective at preventing attacks at all. There are many human and AI powered services as well as secret exploits that attackers can use. Captchas only stop spam, amateur scripts and web-scrapers. It's a real shame that because of this "safety feature" the web is losing is programability. You can't even curl many pages these days let alone write some programs that connect to the web. This whole bloated scene of browser emulation had to be spawned and now instead of serving 1kb htmls to few friendly bots several megabytes of junk traffic and countless processing cycles are wasted on some menial tasks like retrieving sport match results from the internet. The problem with these captcha services are _free_ which means people just throw them anywhere. Imagine a world where land mines are free for everyone at the tip of their fingers - you could hardly go outside! Well you can hardly go online now.
- drivebycomment 6y ago
  A classic case where captcha is essential is ddos attacks. By sheer volume, they are not able to bypass captcha, as they can't solve captcha at million qps. Rate limiting doesn't work under ddos as ddos attack can overwhelm rate limiting itself and also there are still many proxies that simple ip base rate limiting will cause large collateral damage. Captcha is a very effective tool for ddos protection. For spam/abuse, captcha is mainly about raising the cost of attack, not about eliminating completely, while still minimizing the collateral damage. Captcha is never meant to be a protection against any targeted narrow scoped attacks anyway. If the attack is small enough that attackers can pay captcha solving service, it's not big enough to matter. Captcha is here to stay. It is fundamentally a technical mean to deal with the tragedy of commons, and thus won't disappear anytime soon.
newscracker 6y ago
I like that this isn’t Google and isn’t tracking people. I tried this on its own homepage. I didn’t find it a whole lot easier (I was asked to choose photos with boats in them), but it was a little more easier than the blurry photos on reCAPTCHA. What I didn’t like: when I looked for pricing information, I saw that there’s a free tier and there’s a “Contact Sales” tier (for enterprise). There is no intermediate level if you want finer control and just want to know how much that could cost. If anyone from hCaptcha is reading this, I’d strongly recommend adding one or two more tiers or expanding the feature set of the current free tier, at least for some level of granular control.
known 6y ago
ublock should include captcha
sriku 6y ago
I was a bit surprised to not find a reference to the singularly most irritating thing about Google's recaptcha - that it treats me - the one trying to authenticate - as a free source of data labels for its ML systems. I guess I'm unlikely to be the only one irked by another "identify all the bicycles" challenge. Do the labels I provide belong to me or to Google? .. when I signed no job contract with them to provide that information. edit: aha! https://www.hcaptcha.com/labeling https://www.hcaptcha.com/labeling - that's why it wasn't mentioned. One more labelling service that I won't like.
tgsovlerkhgsel 6y ago
I personally found hCaptcha harder to pass than reCaptcha, to the point where I will leave a site that demands one if that's a realistic option (e.g. not really an option if it's my bank, totally an option if it's one of many stores selling an item). It's possible that I just got unlucky (one of my recent experiences was a site that didn't let me in even after solving it, which really soured me), but I feel like the main reason it's hated less is because people haven't seen it as much yet. Edit: TIL how offputting a single bad experience can be. From going through my HN history, I found out that this terrible experience was 6 months ago.
- bastawhiz 6y ago
  I largely agree. Cloudflare requires hcaptcha if you mistype your password a single time when accessing their dashboard. The UX of hcaptcha is not good, especially in a flow where I'm already fixed on goal (doing something in my dashboard). If I need to stop thinking about dns settings or caching to pick out photos with bicycles, that's a really expensive context switch for my brain. And in my experience, you need to do two "pages" to complete the captcha. By comparison, I've been asked to complete recaptcha exactly zero times day to day (perhaps I'm lucky?). The last time must have been many months ago. It's hard to speak to the specific UX qualities of the captcha itself, but I find recaptcha generally less difficult. But a captcha that I don't need to complete always wins out over one that I do.
  - rcMgD2BwE72F 6y ago
    You're probably leaking lots of data to Google. Browse the Web with strong privacy protection (temporary container addon in firefox, ublock, privacy badger, decentralize...) and you'll see that recaptcha UX is just worse (slowly loading new pieces to identify after you solve them, one after the other). I can't count the number of stairs, hills, fire hydrants, cars, trucks, bicycles, traffic lights, pedestrian crossings... I had to point out just this month.
    - bastawhiz 6y ago
      I've completed both of them, and I am firmly of the opinion that hcaptcha is harder to complete than recaptcha. That is when I'm being prompted to complete it. I'm comfortable with the amount of data I'm exposing online. And where I'm at, hcaptcha is not better. And even if recaptcha prompted at the same rate, I'd still prefer recaptcha over hcaptcha.
kpennell 6y ago
ugh, the craigslist ones are annoying
Uhrheber 6y ago
Please die a screaming death. All of you captcha services. I hate you.
neop1x 6y ago
Yesterday I noticed CloudFlare uses it so maybe that is the reason for 15 percent of the internet.
woof 6y ago
"hCaptcha now ruins fifteen percent of the internet" I loathe captchas, especially Googles who seems to punish my use of privacy extensions (ie ublock origin, Ghostery Lite). Captcha is a ok tool when you have valid reasons to assume the user is a bot (multiple failed logins, unusual traffic, password resets etc.). Used as a default it only antagonizes users.
daveoc64 6y ago
Accessibility - I am surprised nobody mentioned it. We looked at hCaptcha, and the feedback we got was that their approach to accessibility is simply unacceptable. If you can't solve the challenges, you have to sign up on their website, in advance, and provide them with your email address. https://www.hcaptcha.com/accessibility https://www.hcaptcha.com/accessibility We just couldn't justify that sort of privacy imposition. Personally, I think all Captcha needs to go.
mattl 6y ago
15% of the web, surely?
johnisgood 6y ago
I cannot stand captchas. I cannot even solve them myself sometimes and I think I am human. Or when they show "1/5", then at the 4th they add + 2 because why not... Stop wasting my time. This is actually done by hCaptcha.

605 points by fab1an 6y ago

Is that meant to be a proud boast? Because, to me, it equates to someone bragging that 15% of the people they've slept with now have syphilis.

alexnewman 6y ago

Curious what people think about hCaptcha?

mtmail 6y ago
We switched a couple of months ago. Integration wasn't more or less difficult, works alright with our test suite. Some users feedback "Why do I have to identify boats?" but otherwise we found no difference number of blocks or user behavior.
DoctorOW 6y ago
Personally I find it much more difficult than recaptcha. The tests themselves aren't much worse but since I have a Google account HCaptcha shows up more frequently.
- californical 6y ago
  Small price to pay to prevent Google from having tracking scripts and metrics on users of every major website. hCaptcha at least somewhat values user privacy.
jtbayly 6y ago
Far, far superior to reCaptcha from a user's perspective using Tor. I can solve a few puzzles with hCaptcha and I know I'll get through and see the content. With reCaptcha I might solve 3 puzzles and then get denied anyway, or I might solve 10 puzzles with no end in sight and give up.
- seisvelas 6y ago
  On the other hand, many Tor users disable Javascript. Out of curiosity, does anyone know a good CAPTCHA that doesn't use JS?
  - jdu9 6y ago
    BotStop by hCaptcha (enterprise). AFAIK there's also a Google reCaptcha frontend that doesn't require JS. Neither companies offer those solutions because of privacy or security benefits, but to support old IE versions of course.
    - seisvelas 6y ago
      > BotStop by hCaptcha Cool, I didn't know about this! Too bad there doesn't seem to be a strong open source option, but I'll check this out.
- CodesInChaos 6y ago
  Not sure if I'm seeing patterns in noise, but with recaptcha I felt that timing and mouse movements are just as important as clicking the right images. It feels like solving the puzzle quickly and using minimal mouse movements has a higher chance of being denied compared to waiting some time between clicks and adding some superfluous mouse movements.
  - MattGaiser 6y ago
    It also seems to be this way too. If I am using Tor, it seems like I need to swirl my mouse around a few times to pass a recaptcha.
- jdu9 6y ago
  But also far superior to reCaptcha from a bot's perspective using Tor. Don't get me wrong: I also hate solving a gazillion captchas only because I'm using a VPN or get outright denied because my IP address happens to be a Tor exit node. At the same time you have to acknoledge that captchas don't stop bots, only slow them down or increase their operating costs. People in third world countries happily solve one image recognition challenge by Google or hCaptcha for far less than a penny. If Google's goal is to drive the costs up for malicious bot operators, then they're definitely doing the right thing. In the end, it won't stop them either since buying a couple thousand infected computers is probably not that expensive, but it is yet another stepping stone for anyone trying to bypass their captcha.
eznzt 6y ago
I don't like it because Buster doesn't work on it. Also since only cloudflare uses it, and I dislike cloudflare, I have this irrational hatred of it.
- jdu9 6y ago
  >because Buster doesn't work on it Assuming you mean Debian Buster: Then get a newer Firefox version from backports. This is more related to Firefox ESR than Buster. Edit: Nevermind... After reading other replies, I think eznzt referred to https://github.com/dessant/buster https://github.com/dessant/buster
innocenat 6y ago
For me I find hCaptcha harder and more ambiguous than what I have experienced with reCaptcha. The ambiguity might be because my phone is set to Japanese. I got asked to identify 電車 (Densha, electric train), but there were also images of diesel train. Is it translation error, or is it really asking me to identify electric train? (The correct term for train in general in Japanese is 列車 ressha)
- deleted 6y ago
  [deleted]
- fab1an 6y ago
  Great catch. If you'd like, you can actually submit a better translation via a pr here: https://github.com/hCaptcha/hcaptcha-i18n https://github.com/hCaptcha/hcaptcha-i18n
  - gnud 6y ago
    I don't think you can? That repo has the translations of the strings used by the "meta"-part of the service, stuff like "accessibility information". I can't see any text used by the actual tasks.
nekoashide 6y ago
It's been terrible, when Cloudflare switched to hCaptcha it not only broke our app but it seems every time they make a change it breaks something else. We might be a special case but it's hard to say since all they say it's "quirks" and they keep making changes without announcing anything.
slig 6y ago
Dislike it, to say the least. Since it doesn't seems to remember that I'm a human (reCpatcha did), now I have to constantly solve captchas on CF sites.
- eatbots 6y ago
  With hCaptcha (enterprise ver) this is entirely under the control of the customer. We're not "remembering" in the same way, but have good enough instantaneous scoring to correctly guess whether or not a challenge is required most of the time. Some customers may disable that option to meet their requirements. Not much we can do about that :)
  - slig 6y ago
    Thank you for clarifying that, hope that CF decides to use this feature.
meibo 6y ago
I really don't like it. They are generally harder and if I visit a CF site multiple times, I have to solve them multiple times. Even if this is up to the customer, it's annoying and should be discouraged. I didn't mind solving a reCaptcha once, I mind forcing myself through these every 10 minutes.
maple3142 6y ago
It is more annoying than reCAPTCHA if you don't aggressively block tracking. because I rarely need to solve it manually in reCAPTCHA, while it is not the case with hCaptcha.

ve55 6y ago

Worth noting that this title is primarily due to Cloudflare having switched to them from ReCAPTCHA, and Cloudflare is... well, relatively popular, to say the least. I'm curious what kind of data may exist on the experience of switching for larger providers; do the users like it? how much more/less time do they spend solving? do they care, let alone even notice that it's not Google's ReCAPTCHA? Regardless, as ReCAPTCHA is not only terribly annoying but also built for surveillance from the ground up, I still view this as a good improvement.

QUFB 6y ago
Honest question: How do you view it as an improvement? The same data is being shared, and the only difference is that Cloudflare isn't immediately behaving in the same evil ways as Google. But once you concentrate power in an entity, perhaps bad things might happen? ... If there was an on-premise captcha implementation that actually worked, that would be great.
- fab1an 6y ago
  Unlike Google, hCaptcha isn't running an ad network "on the side" of their bot management business :) joking aside, hCaptcha is an extremely privacy-conscious operation, Google is not.
  - QUFB 6y ago
    I'm not a lawyer, but can you explain how their privacy policy is privacy-conscious now and going forward, and how centralization of network transit with Cloudflare isn't a bad thing? https://www.hcaptcha.com/privacy https://www.hcaptcha.com/privacy
    - eatbots 6y ago
      hCaptcha is more focused on technical solutions to privacy that minimize required trust. A privacy policy is one thing, but a mathematical guarantee is quite another. We are working through the IETF and directly with browser makers to support provably private options like Privacy Pass, and are currently the only CAPTCHA service to support this. Similarly, on the enterprise side we offer various technical options to let our enterprise customers guarantee exactly what data we can and cannot see. (disclaimer: work there, comments not official, etc.)

blindm 6y ago

I think it's great. So many sites sit behind Cloudflare now and Cloudflare now uses hCaptcha, which is a big win. And the hCaptchas themselves are easy to complete. No more wondering if you actually clicked on 'all' the traffic lights anymore, yay! I inspected the source code of Google's reCaptcha offering and was disgusted at how many bits of information they were collecting. They also seem to be fingerprinting users so they can't keep registering new accounts on a platform, locking out anonymous users who are usually the best types of users on the platform, as IMHO anonymous voices are (usually) the best voices, or at least the more interesting of voices. Google's reCaptcha code seemed to be very keen on knowing my 'cadence' or the way I used my mouse and how quickly (or how slow) I completed the captcha. It also looked at things like timezone, screen resolution, battery charge level etc So they could determine if it was 'you' who was using the captcha, soon after, in a separate session (even on a different device!)

dheera 6y ago
reCaptcha has also gotten increasingly annoying lately. I forgot my password to one site and tried about 2 or 3 different passwords and in-between each it asked me to do about 7 or 8 of those labelling exercises. I finally just gave up and left the site. Not only that, but the labelling exercises weren't clear. It wanted me to label a "公交車" which means more like a public city bus and there were also school buses which would normally not be called that in Chinese so I didn't label them but Google thought they were part of that class, and wouldn't let me proceed without me labelling them, and furthermore, punished me with more "hard" exercises like that. I guess they are trying to turn me into a stupid bot.
- dsabanin 6y ago
  Recently Google's captcha asked me to mark all the traffic meters on the photos, and amongst the choices was a photo of a mailbox. It didn't let me through until I marked it as a meter as well. Good luck to whatever self driving car they are training using this data.
  - dmurray 6y ago

abhinav22 6y ago

I really hate all these captcha codes Why can’t they do something like a reverse SSL where we have to authenticate ourselves as humans? For example if I have an Apple account on my Apple devices, why can’t they figure out a way to authenticate me as a human from that information? This doesn’t work for all scenarios (eg throwaway accounts), but it could work for the majority?

mathnmusic 6y ago
Webauthn may make it easy because it supports platform authenticators like Touch ID / Face ID. Two good demos are at http://webauthn.me/ http://webauthn.me/ and https://webauthn.io/ https://webauthn.io/ It's now supported in all major browsers but platform authenticators are likely not supported on all OS yet.
- abhinav22 6y ago
  This makes a lot of sense - exactly what I was thinking
  - mathnmusic 6y ago
    I'm not sure it will be as secure as captchas though. Browsers will probably allow dummy platform authenticators for ease of development, which can be used by bots as well.
hombre_fatal 6y ago
Well, the point is to avoid automated abuse. Your Apple account on your Apple device doesn't stop you from unwittingly being part of a botnet, for example.
- abhinav22 6y ago
  Why wouldn’t it? Unless they hack my account Genuine question - I don’t know much about this field
6y ago

kaycebasques 6y ago

This sounds kinda nitpicky but I think it's an important distinction. We're talking about the web, not the internet, right? Or is hcaptcha also used for iOS apps, Android apps, etc.?

fab1an 6y ago
hCaptcha runs anywhere, even works on Telegram groups: https://github.com/hCaptcha/telegram-bot https://github.com/hCaptcha/telegram-bot
paxys 6y ago
That distinction is already blurred beyond recognition. There's nothing that makes a phone app more or less "web" than a SPA, for example.
- kaycebasques 6y ago
  The distinction between iOS apps built in Swift and distributed on App Store (for example) and a website built in JS/HTML/CSS and distributed via the web's decentralized architecture is pretty clear IMO. Case in point I don't see hCaptcha/reCAPTCHA on iOS apps as frequently as I do on websites. The way I was taught in my elementary networking class was: the web is an application of the internet. The internet as a concept is much broader than the web.
  - paxys 6y ago
    "The web's decentralized architecture" isn't a thing. There are clients and servers and communication protocols, that's it. There are plenty of web apps distributed from custom stores. And the web doesn't mandate using JS/HTML/CSS. A client (whether browser, CLI, phone app, bot or anything else) making resource requests identified by a URL to an HTTP server is as "web" as it gets. The reason you see fewer capchas on iOS and Android is that it is a lot harder to automate them for spam, that's all.
    - kaycebasques 6y ago

markosaric 6y ago

That's great to see! At Plausible Analytics, we had a wave of spam attacks two months ago or so and hCaptcha saved us. Great product and great service both for companies and for users. We're very happy with how it works. And great to have a quality de-Googled alternative for this use case!

dvduval 6y ago

I appreciate at least having a good option that doesn't involve putting a Google product on my website. We tried to use our own captcha back in the day, and then used some third party, and they just weren't good enough. I'm glad to see them getting this market share because it means that they will get the opportunity to improve based on a large set of users similar to how Google is able to make their products so good.

TechBro8615 6y ago

I vastly prefer hCaptcha to recaptcha because it doesn't treat me any differently just because I'm using Tor. Recently (last year or so), Google has started to explicitly refuse service to me when I use Tor (only after forcing me to solve a CAPTCHA for 3 minutes). Question for dang -- why does HN continue to use recaptcha? It's impossible to signup via Tor, and Google is a user hostile company. One thing I will note, is that hcaptcha seems to be more loose in what answers it accepts. Sometimes I click random images and it still lets me pass.

amasad 6y ago

We've moved to hCaptcha from reCAPTCHA after Google surprised us with their pricing (blog[1], hn discussion[2]), and couldn't be happier. We use it in invisible mode and it does a great job at finding bots while getting out of users' way. Also top-notch customer support. The CEO was personally in the slack channel helping us. Highly recommended. [1]: https://blog.repl.it/anon https://blog.repl.it/anon [2]: https://news.ycombinator.com/item?id=25004476 https://news.ycombinator.com/item?id=25004476

judge2020 6y ago
> We use it in invisible mode and it does a great job at finding bots while getting out of users' way. Interesting didn't realize this was a thing hcaptcha did[0]. It's basically recaptcha in terms of tracking which sites you visit then, no? 0: https://docs.hcaptcha.com/invisible https://docs.hcaptcha.com/invisible
- fab1an 6y ago
  I think parent means hCaptcha enterprise in passive mode, where hCaptcha is detecting bots in the background using ML: botstop.com
  - aftbit 6y ago
    Surely this ML must be presented a wide set of data on the user and their browser to make this determination? So just like recaptcha, they determine if they should admit you based on passively snooped data rather than active challenges.
    - ve55 6y ago
      My knowledge of this is that hCaptcha uses anonymized user data to ensure that the user doesn't look like a bot. What ReCAPTCHA did differently is not only not anonymizing data, but specifically trying to find out which person was presented with their captcha by matching cookies and profiles to Google accounts (which the majority of users would have and be logged into for many reasons). When you combine this with Google owning everything from Gmail to Youtube to Android to Chrome, it gets extremely pervasive.

fulyscentedking 6y ago

How do we know your product preserves privacy when it's close sourced? Also, users should not be manipulated and used for training your machine learning models when they are trying to sign in on a website. I simply don't used it if the website is trying to give me this kind of nonsense.

Zak 6y ago

I dislike the widespread use of captcha regardless of provider. I realize anything connected to the internet will be subject to automated abuse, and it's impossible to run some types of services without taking some steps to defend against it, but it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time. The exact details will vary based on the type of service, of course. One particularly egregious misuse of captcha in a service I use presents one after I enter a correct username and password. An incorrect login says so without presenting a captcha. The potential reward for an attacker who successfully gains access to an account is high, so it seems almost certain anyone running a targeted attack would defeat this by handing it off to a human upon detecting that they had a good account.

jsnell 6y ago
There's a good reason for what you're identifying as misuse. If you show a captcha after a failed password, you need to show a one after a correct password as well. Otherwise you leak information. You can have other solutions, e.g. in a login flow that splits the username and password entry, it's advantageous to put the captcha between those two steps. But even in those solutions the display of the captcha must be independent of password correctness.
- aleph1 6y ago
  That's not what's happening: > An incorrect login says so without presenting a captcha.
  - jsnell 6y ago
    Thanks, I misread. Then that indeed makes no sense!
- aftbit 6y ago
  There's a lot of arguments against captchas, but I do not agree with this one. You will always leak whether or not a password is correct based on how your app behaves - a correct password will grant entry to the application. If you only ask for a captcha when a user account exists but fail to ask if they use a made up username, that's an information leak.

tuckerconnelly 6y ago

As someone who scrapes, captcha's are pretty silly. One of the sites we scrape implemented hCaptcha, and it was a breeze to get around. There are a few things that make my life more difficult, but captchas aren't one of them, and nothing can stop scraping altogether.

alexnewman 6y ago
How'd you do it?
- driverdan 6y ago
  I'm not OP but there are cheap solving services that will fill them in for you. The cost is trivial and they have decent APIs for automatic integration into scrapers.
  - londons_explore 6y ago
    many captchas let you fill them in once and then use the resulting cookie to do whatever else you like on the site. Just manually copy the cookie to your bot hosts.
hombre_fatal 6y ago
Meh, there's always going to be a longtail of targeted abuse so it's not much to boast over. Xrumer software in 2001 could even let you sit at your computer and fill out those common PHP-lib captchas (like on EZBoard) while Xrumer spammed internet forums and blogs. You could even hire a cubicle farm of humans to manually abuse a web service. Captchas filter out the 90% bulk of automated abuse. Btw, web scraping is on the nearly harmless side of abuse.
- tuckerconnelly 6y ago
  That makes sense that there's longtail abuse, thanks. What would you say is more harmful abuse? Spamming endpoints for SQL and other injection attacks?

xapata 6y ago

hCaptcha makes money by having humans label things to teach machines. This suggests that at some point, the machines will be nearly as good as the humans at labeling. At this point, until the humans are tasked with a different training exercise, a bot will be effectively indistinguishable from a human via hCaptcha. If there's value in it, it sounds like a spammer could train an hCaptcha-defeating bot via hCaptcha.

aciswhat 6y ago
I think it's likely they'll add new types of exercises as this starts to happen.
- xapata 6y ago
  The exercises are dependent on what researchers are paying for. The spammer needs to keep up. Which they can do by sampling hCaptchas and figuring out what tasks are being done. The question is how much value spamming provides. If it's significant, then it pays for the arms race. Given the investment in beating reCaptcha, it seems that spam provides high value. Edit: And! And! hCaptcha could become victim to a malicious bot that feeds bad data into other researchers' training sets. The bot would need to reply to an overwhelming number of hCaptcha captures, such that it becomes the dominant validation set. It would be a self-fulfilling model. It'd even be performed at the expense of the legitimate researchers, who must pay ethercoin for every hCaptcha response. Much like cryptocurrency networks, hCaptcha is susceptible to a cartel. In this case, it'd be a bot-cartel, feeding bad data. Humans could be locked out, as hCaptcha might be convinced the humans are bots and the bots are human.
trianglem 6y ago
Wait they actually use the labeling for something other than admittance? Well that takes care of my concern about this tech then, gotta go back and change some of my other comments...
- fab1an 6y ago
  Google uses reCAPTCHA labels exclusively for themselves, and is extracting hundreds of free person years of labor from internet users every single day via this. hCaptcha lets anyone access this type of service, provided they follow certain ethical AI guidelines

catovh 6y ago

Not keen on hcaptcha because I'm almost always need to solve 2 sets of the puzzle vs 1 with recaptcha. Theres a thin line between privacy and convenience, most of the time I've felt hcaptcha to be on the least convenience side.

abc-xyz 6y ago
Only 2? I usually need 5+.. not that recaptcha was any better. I sincerely hope they, along with all other companies providing captcha services, go bankrupt.

hlava 6y ago

I hate hCaptcha, those pictures are messy, they pop up everytime and theres 2 slides of them... Why not just use the honeypot method?

drngdds 6y ago

Is hCaptcha less of a pain for users who block tracking (with Brave, Privacy Badger, uBlock Origin, etc) than reCaptcha is? I'm not sure I've ever solved an hCaptcha, but I find reCaptchas to routinely be incredibly time-consuming, and I suspect it's because I block their trackers.

fab1an 6y ago
Google reCaptcha likely discriminates against non Chrome users, hCaptcha does not. Also, we support and co-develop https://www.hcaptcha.com/privacy-pass https://www.hcaptcha.com/privacy-pass !
intellirogue 6y ago
I'm using Brave plus NextDNS, and am on a CG-NAT IPv4 address, so reCaptcha absolutely hates me. I always need to do at least 5 rounds of matching before it'll let me past. My record has been 12 rounds. hCaptcha seems to pretty consistently only make me do 2 rounds, so I certainly prefer it.

seanwilson 6y ago

How is hCaptcha for page performance? Google Recaptcha ruins your page speed rankings as it ideally has to load chunk of JavaScript on all pages on page load to continually monitor user behaviour. You could e.g. only load it when someone starts filling out a form but this kind of integration isn't standard.

fab1an 6y ago
You only put hCaptcha / BotStop where you actually need the protection, and it certainly doesn't follow your users around unnecessarily

throwaway1723 6y ago

Reading their website: >Presented Challenges: >Comparison - Select all images that match query >Bounding Box - Define bounding area for objects >Categorization - Identify the corresponding labels >..and other simple tasks. No, hCaptcha, no way am I going to train your neural networks for free, so please join Google on your journey to hell.

rootusrootus 6y ago

I'm really starting to hate all the captchas with a burning passion. Partly because the corporation I work for seems to have gotten our NAT addresses onto a blacklist so I get captcha'd constantly, and partly because my close up vision is getting noticeably weaker (pushing 50, that's why) and without hunting down my reading glasses it can be difficult to make out the smaller details necessary to solve the puzzle. Especially when I'm on my phone. I really wish we could find something relatively foolproof that didn't rely heavily on tracking or really good vision.

chrismorgan 6y ago
Similar deal where I am at present in India: the small ISP uses carrier-grade NAT, so there’s malware and related activity occurring every day from at least one of the who-knows-how-many people behind this one IP address. Last time I was here in 2016 it was actually a lot worse than it is now (then, any Cloudflare site would trigger it, so I’d be hitting dozens of challenges per day), but I still get the occasional hCaptcha here (e.g. the Audacity wiki), and they’re awful. I normally take two or three attempts (quite apart from the regular times when you finish the challenge and press submit, and it just does nothing), guessing things like whether they want to count this particular dark smudge as a motorcycle or not, or whether this fragment of a motorcycle should count or not. I wish people would just face up to the reality that challenge-based CAPTHCA techniques have failed, and stop using them.
- hda2 6y ago
  Try using privacy pass. It's designed for use cases like yours.
  - LeoPanthera 6y ago
    Not available for Safari though. Or any mobile browser?
  - chrismorgan 6y ago
    That still requires you to fill out a CAPTCHA at least once, and also requires that you install a browser extension, which I baulk at doing, especially when it needs the “do anything on any website” permission.

cute_boi 6y ago

thanks for making something that has capacity to break google recaptcha v3.

surround 6y ago

Almost all of the users that Cloudflare shows captchas to are Tor users. Is there any reason why this couldn’t be done without Javascript?

thewebcount 6y ago
I don't believe this to be true. I've never touched Tor, and am constantly hounded by different Captcha mechanisms. I do aggressively block tracking, though.

koreanguy 6y ago

Captcha is a terrible 90s technology, it should have been completely destroyed in year 2000. it's really annoying.

heavyset_go 6y ago
Don't worry, the next iteration of CAPTCHAs will rely heavily on browser feature detection, ensuring that you're not using an unauthorized version of Chrome that can be automated. Only authorized and trusted browsers will pass the tests.
- GekkePrutser 6y ago
  Which will mean even more restrictions on the types of browsers we can use, and gathering more information. Not OK either.
  - heavyset_go 6y ago
    This was my point. Google is already doing this[1] for account access, and they will prevent competitors' browsers from logging in. [1] https://news.ycombinator.com/item?id=25172755 https://news.ycombinator.com/item?id=25172755
kevincox 6y ago
If it should have been destroyed what is the reason you think it hasn't been? People aren't adding captchas to websites for fun, it is clearly solving a problem for them. So what do you propose instead?
- GekkePrutser 6y ago
  It's solving a problem for THEM at OUR (the users') expense. We should fight this more heavily just like we do ads and tracking and hopefully this practice will at least stop expanding. The amount of sites now showing captchas is crazy. Or introduce a law where they have to pay us for using up our 'brain time'.

TaylorAlexander 6y ago

Anyone know why their seems to be military imagery on hCapcha? I don’t want to train anything for the military...

svacko 6y ago

I see the product is offered in 2 plans, though the only paid plan is enterprise without publicly disclosed pricing. Anyone has info whether it's affordable also for small and bootstrapped businesses or it's primarily focusing on larger enterprises?

gingerlime 6y ago
Last time I enquired they quoted starting $999/mo for 10m verifications...
- svacko 6y ago
  Thank you. That's not a small sum, though they probably have some internal tiers per number of requests so for lower traffic scenarios the monthly price might be more affordable.
  - gingerlime 6y ago
    I asked and they said that’s the minimum, and they had no plans to introduce smaller self-serve tiers.

kraig 6y ago

So we use 15% of the internet for captchas and I lose 15% of my life identifying crossroads, stoplights, and buses to computers. There's got to be a better way

dmtroyer 6y ago
you spend 100% of your life on the internet?
xiphias2 6y ago
You should take a Waymo while solving the puzzles to get back the time

accounted 6y ago

I don't understand why anyone likes hCaptcha. With reCaptcha, I rarely got more than the checkbox. Now I get a series of puzzles every time I want to look at a web page. When that happens, I'm just closing out, and going to a better website.

thewebcount 6y ago
Because many of us get the same puzzles over and over with reCaptcha, and often get sent into the infinite puzzles zone despite being both a human and answering correctly. The assumptions built in to reCaptcha just aren't good. There are people that don't accept cookies for anything, but who aren't bots. There are real humans using text-only browsers. There are people who's mouse and keyboard events fall far outside the expected range of normal human users, or who use aids such as macro keys that playback canned responses and confuse Google's methods. So I can definitely imagine anyone who's dealt with that shit for years being happy to have something different to try. Even if it's just as annoying, at least it's not the same damn thing!
- accounted 6y ago
  I would say it's not just as annoying, it's worse. It has all the same annoyances, except now I get the worst outcome every time.
- tomjen3 6y ago
  My favourite failure mode was when I was using a roller as a mouse and it constantly failed. It took me a while to figure out that it was probably failing because my mouse would move in a straight line. Naturally if I was logged into my google account I wouldn't have much of an issue, because I would be feeding the surveillance machine.
neop1x 6y ago
We need more auto-solver services. Pay a subscription and let developing country workers solve captchas for us. Extra expense on top of internet connectivity plan.

deleted 6y ago

[deleted]

heavyset_go 6y ago

I used to think that reCAPTCHA was bad, but then I had to solve numerous CAPTCHAs from hCaptcha. Now I think that they're all bad.

pieterhg 6y ago

My mom and dad's shared IP (somewhere in Europe) repeatedly gets on CloudFlare's IP ban list meaning my mom keeps having to solve these hCaptcha's. hCaptcha's is a lot more difficult to complete than Google's reCaptcha and she has a lot of trouble with it. Why they get on these IP lists is I think because it's a general consumer ISP and probably a lot of people get bot nets on there.

hda2 6y ago
Install privacy pass on their computers. It won't eliminate the captchas completely but will decrease the number of times they'll see them. I believe cloudflair gives you 30 passes for each captcha solved.
MeatBro 6y ago
What service they use have a big implication of if they get captcha'd. Try switchingservices
bastawhiz 6y ago
I've learned that folks end up unintentionally installing software which acts as essentially "proxy server as a service". I've heard of browser extensions doing this, but I would be unsurprised if mobile apps did it. Every holiday I do a sweep of my parents' devices to make sure they haven't installed anything silly (my mom somehow always has three or four different weather apps). I'd suggest giving it a look the next time you can.
drivebycomment 6y ago
Or, it could be that their computers or home network is infested with malware or bots. Majority of people complaining about captcha need to look at their system first. Of course any detection system has false positive, but the false positive rate is not double digit percentage in vast majority of cases.

EGreg 6y ago

Aren't Apple and Google almost obviating the need for this, since they control their duopoly platforms? https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_rest_api/authenticating_users_with_sign_in_with_apple https://developer.apple.com/documentation/sign_in_with_apple... PS: Anyone have the corresponding Google link?

LockAndLol 6y ago

Honestly, I thought hCatpcha was being run by OpenAI in order to provide the benefits of millions of people training AI, but they seem to be completely unaffiliated. What happened to OpenAI? Do they belong to Microsoft now or something?

ve55 6y ago

The sub-header of this blog post is "You can beat Google by putting privacy first", and at this point it's interesting to think of how many businesses have done exactly this for an entire range of Google products with success.

arendtio 6y ago

Their demo even doesn't work for me. It displays an error message in my native language similar to 'Rate limited or network error. Please try again.'. Reloading doesn't change the situation (maybe related to my ad blocker). Doesn't make the best impression...

Animats 6y ago

Anyone have an example of hCaptcha usage?

withinboredom 6y ago

I'd really love these captcha services to allow me to download an extension that allows me to bypass their captchas. This extension could verify my identity and/or device, or just keep an eye on my behavior to validate that I'm human.

mdaniel 6y ago
Are you aware of their accessibility cookie? https://www.hcaptcha.com/accessibility https://www.hcaptcha.com/accessibility It's not exactly what you were asking for, but it can make their disease less painful

dathinab 6y ago

Honestly captcha seem pointles to me. Literally every time I'm in a situation where I'm required to use a captcha to access a site it is impossible to successfully solve the captcha in any sane amount of time. This happens both with google and cloudflare. Tbh. if they don't trust my connection can't they just tell me so instead of pretending to provide a "I'm not a robot" test which is practically (close to) unsolvable??? (Note that this post only refers to captchars guarden the access of an site if they somehow don't trust your connection, not "I'm not a robot captures" on forms or similar).

superkuh 6y ago

15% of the web. And probably only of the commercial web.

YetAnotherNick 6y ago

From the privacy policy We collect the following categories of information: Information that can be used to identify or contact an individual ("Personal Information"), such as name, email address, and country.... We may also verify the identity of our Integrators and Customers by comparing personal information against third party databases or official legal documents. Information collected automatically as a result of an Integrator’s or Customer’s use of the our Sites or the Services ("Analytics Information"), such as IP addresses, browser type, Internet service provider, platform type, device type, operating system, date and time stamp of access, and other similar information. Some Analytics Information is collected on our behalf by third parties we engage for that purpose, and some Analytics Information is collected through a variety of tracking technologies, including cookies In the preceding 12 months, we have shared the following categories of information with third parties for a business purpose: Identifiers. A real name, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers. Shared with Service Providers Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). A name, credit card number, debit card number, or any other financial information. Shared with Service Providers Commercial information. Records of products or services purchased, obtained, or considered. Shared with Service Providers Internet or other electronic network activity. Browsing history, information on a consumer's interaction with an internet website, application, or advertisement. Shared with Service Providers Note: Fraud risk associated with an individual IP address may be shared with an Integrator upon request. https://www.hcaptcha.com/privacy https://www.hcaptcha.com/privacy

einpoklum 6y ago
Wait, that's the hCaptcha policy? Can you link to it on their website?
- YetAnotherNick 6y ago
  Updated it in end. By the way I am not in anyways related to hcaptcha. Just sharing it because they don't seem to be the saint that everyone else is believing them here.

jedberg 6y ago

"hCaptcha has grown into the largest independent cybersecurity service in the world" I feel like Cloudflare might have something to say about that, given that Cloudflare is an independent cybersecurity service and uses hCaptcha.

Razengan 6y ago

I can’t be the only one offended by the unpaid labor involved in CAPTCHAs (training self-driving AIs or whatever). I wish Apple would offer a way for sites and services to verify that a client is indeed human via Touch ID/Face ID.

White_Wolf 6y ago

tbh it no ammount of captcha will help a popular platform. If you go black hat for around $150 in private proxies + poster bot + spinner + (insert capcha service here because I dont' want to advertise them) you can pretty much spam anything for a while. That being said it does make it harder to spam if you don't have a budget to start with.

XCSme 6y ago

Is there any place where you can just solve captchas from hCaptcha? I was curious what kind of questions/labels it displays.

drusepth 6y ago
https://www.hcaptcha.com/ https://www.hcaptcha.com/ has a "Try it out" section on the homepage you can repeatedly solve for examples.

vrperson 6y ago

reCaptcha is horrible. If you are a business, please stop using it. It feels like working for Google. why the hell should I have to do work for Google when I want to do business with you?

dep_b 6y ago

I haven't tried Firefox + AdBlocker in a while but I always had the idea that in a very Mechanical Turk way I had to earn my few cents worth income for the machine before I was allowed to have no ads and live outside of the Google Empire.

solinent 6y ago

While privacy is definitely my main concern here, it's not just privacy that's the issue here--I believe people should be compensated for the work that they offer society and if Google is using a captcha to create driverless cars then it's obviously antithetical to this premise. I always try to miss some of the obvious items or make mistakes and I (almost) always get through. There's only one service that uses a Google captcha that I continue to use, so it's not really a huge issue for me anyways, and I have decided to stop using it! It's not too difficult to host your own captcha, I don't see why this can't be an open-source effort.[1] [1] https://github.com/dchest/captcha https://github.com/dchest/captcha

deleted 6y ago

[deleted]

elliottinvent 6y ago

It’s good to hear that alternatives to any Google tech are gaining market share. For me, all captchas are a stain on the web - in most cases, shifting (and multiplying) the wasted human hours from the company collecting data (eg the owner of the contact form) to the user (the person completing the contact form). The company is saved from filtering through contact form responses from bots (spam and injection attempts) but simply shifts the work to the user who they hope to pay for their service, losing countless enquiries from frustrated users. In my opinion, the only acceptable use for captchas is when you’re making a useful, free, no-login-required service available to the public and even then should only be brought in after bursting reasonable rate limits.

throwaways885 6y ago
> For me, all captchas are a stain on the web - in most cases, shifting (and multiplying) the wasted human hours from the company collecting data (eg the owner of the contact form) to the user (the person completing the contact form). I run a contact form for a small business. Explaining to them why their tiny website has tens of thousands of spammy requests filled with porn keywords is not easy. Of course webmasters add reCAPTCHA, because they're vastly outnumbered by bots and users.
- elliottinvent 6y ago
  I did this too. Providing contact forms for lots of websites. In my opinion, back end filters are the solution to the problem you’re describing. Not making the genuine users jump through hoops.

deleted 6y ago

[deleted]

deleted 6y ago

[deleted]

terrycody 6y ago

hydrant car airplane crosswalk traffic light nightmare

ac42 6y ago

Just tried the demo and found it somewhat confusing "enter your name and your favourite vegetable" is to lure bots into responding? When "I am human", I am asked to select boats and fail because I didn't tick the images with ships. I would not like to add a Captcha that appears to be smart Alec, has a tendency to trigger the same in the respondents or, worse, makes customers feel stupid. reCaptcha somehow seems better at avoiding this.

fierarul 6y ago

Never heard of them before but went to their main site and got served the Romanian version which is so bad I think it could be used as commedy. Also loved how their front page image shows a barrier with their logo stopping some robots but the robots are facing the backside of their logo/stop sign! Like, hire me for more! I'm curious how can they train ML models while preserving privacy. Where does the corpus come from?

vilifiedtwin 6y ago

I should have a right to not disclose whether I am a human or not. Captchas invade privacy and essentially you become an unpaid content classifier.

Proven 6y ago

Has anyone estimated the cost of lost users or visitors thanks to this crap? Sure it may prevent robots from visiting but it also loses business. Personally I just close the tab if I see that crap and go elsewhere.

jokethrowaway 6y ago

Is this mainly thanks to getting Cloudflare as a customer? Congrats, albeit I have to say I had less problems with recaptcha captchas. I experienced a couple of cases of hcaptcha just not working correctly and being unable to access something despite the captcha success, which never happened with recaptcha (in my experience).

gregmac 6y ago

I see there's several "captcha solving services" (Google the term, I don't want to link any) that charge in the $1's per 1000 solves. This makes me wonder how effective captchas really are. Do they just raise the bar high enough so only spammers actually making money attack the more lucrative sites? Can anyone talk about their experience running a (large) service with a spam problem where adding a captcha helped? How about still battling bots/spam/abuse despite having a captcha? Supposedly these services have humans solving these. I remember hearing about a bypass in use where the attacker would pass-through captchas and present them to users on their own pirate/torrent/porn/etc sites, and then when the user solved it, they'd get at the content and the spammer would do whatever they were doing on the original site. I wonder if that technique is still in use, or if there are people specifically sitting there solving captchas all day being paid fractional pennies per solve?

wraptile 6y ago
Captchas are not effective at preventing attacks at all. There are many human and AI powered services as well as secret exploits that attackers can use. Captchas only stop spam, amateur scripts and web-scrapers. It's a real shame that because of this "safety feature" the web is losing is programability. You can't even curl many pages these days let alone write some programs that connect to the web. This whole bloated scene of browser emulation had to be spawned and now instead of serving 1kb htmls to few friendly bots several megabytes of junk traffic and countless processing cycles are wasted on some menial tasks like retrieving sport match results from the internet. The problem with these captcha services are _free_ which means people just throw them anywhere. Imagine a world where land mines are free for everyone at the tip of their fingers - you could hardly go outside! Well you can hardly go online now.
drivebycomment 6y ago
A classic case where captcha is essential is ddos attacks. By sheer volume, they are not able to bypass captcha, as they can't solve captcha at million qps. Rate limiting doesn't work under ddos as ddos attack can overwhelm rate limiting itself and also there are still many proxies that simple ip base rate limiting will cause large collateral damage. Captcha is a very effective tool for ddos protection. For spam/abuse, captcha is mainly about raising the cost of attack, not about eliminating completely, while still minimizing the collateral damage. Captcha is never meant to be a protection against any targeted narrow scoped attacks anyway. If the attack is small enough that attackers can pay captcha solving service, it's not big enough to matter. Captcha is here to stay. It is fundamentally a technical mean to deal with the tragedy of commons, and thus won't disappear anytime soon.

newscracker 6y ago

I like that this isn’t Google and isn’t tracking people. I tried this on its own homepage. I didn’t find it a whole lot easier (I was asked to choose photos with boats in them), but it was a little more easier than the blurry photos on reCAPTCHA. What I didn’t like: when I looked for pricing information, I saw that there’s a free tier and there’s a “Contact Sales” tier (for enterprise). There is no intermediate level if you want finer control and just want to know how much that could cost. If anyone from hCaptcha is reading this, I’d strongly recommend adding one or two more tiers or expanding the feature set of the current free tier, at least for some level of granular control.

known 6y ago

ublock should include captcha

sriku 6y ago

I was a bit surprised to not find a reference to the singularly most irritating thing about Google's recaptcha - that it treats me - the one trying to authenticate - as a free source of data labels for its ML systems. I guess I'm unlikely to be the only one irked by another "identify all the bicycles" challenge. Do the labels I provide belong to me or to Google? .. when I signed no job contract with them to provide that information. edit: aha! https://www.hcaptcha.com/labeling https://www.hcaptcha.com/labeling - that's why it wasn't mentioned. One more labelling service that I won't like.

tgsovlerkhgsel 6y ago

I personally found hCaptcha harder to pass than reCaptcha, to the point where I will leave a site that demands one if that's a realistic option (e.g. not really an option if it's my bank, totally an option if it's one of many stores selling an item). It's possible that I just got unlucky (one of my recent experiences was a site that didn't let me in even after solving it, which really soured me), but I feel like the main reason it's hated less is because people haven't seen it as much yet. Edit: TIL how offputting a single bad experience can be. From going through my HN history, I found out that this terrible experience was 6 months ago.

bastawhiz 6y ago
I largely agree. Cloudflare requires hcaptcha if you mistype your password a single time when accessing their dashboard. The UX of hcaptcha is not good, especially in a flow where I'm already fixed on goal (doing something in my dashboard). If I need to stop thinking about dns settings or caching to pick out photos with bicycles, that's a really expensive context switch for my brain. And in my experience, you need to do two "pages" to complete the captcha. By comparison, I've been asked to complete recaptcha exactly zero times day to day (perhaps I'm lucky?). The last time must have been many months ago. It's hard to speak to the specific UX qualities of the captcha itself, but I find recaptcha generally less difficult. But a captcha that I don't need to complete always wins out over one that I do.
- rcMgD2BwE72F 6y ago
  You're probably leaking lots of data to Google. Browse the Web with strong privacy protection (temporary container addon in firefox, ublock, privacy badger, decentralize...) and you'll see that recaptcha UX is just worse (slowly loading new pieces to identify after you solve them, one after the other). I can't count the number of stairs, hills, fire hydrants, cars, trucks, bicycles, traffic lights, pedestrian crossings... I had to point out just this month.
  - bastawhiz 6y ago
    I've completed both of them, and I am firmly of the opinion that hcaptcha is harder to complete than recaptcha. That is when I'm being prompted to complete it. I'm comfortable with the amount of data I'm exposing online. And where I'm at, hcaptcha is not better. And even if recaptcha prompted at the same rate, I'd still prefer recaptcha over hcaptcha.

kpennell 6y ago

ugh, the craigslist ones are annoying

Uhrheber 6y ago

Please die a screaming death. All of you captcha services. I hate you.

neop1x 6y ago

Yesterday I noticed CloudFlare uses it so maybe that is the reason for 15 percent of the internet.

woof 6y ago

"hCaptcha now ruins fifteen percent of the internet" I loathe captchas, especially Googles who seems to punish my use of privacy extensions (ie ublock origin, Ghostery Lite). Captcha is a ok tool when you have valid reasons to assume the user is a bot (multiple failed logins, unusual traffic, password resets etc.). Used as a default it only antagonizes users.

daveoc64 6y ago

Accessibility - I am surprised nobody mentioned it. We looked at hCaptcha, and the feedback we got was that their approach to accessibility is simply unacceptable. If you can't solve the challenges, you have to sign up on their website, in advance, and provide them with your email address. https://www.hcaptcha.com/accessibility https://www.hcaptcha.com/accessibility We just couldn't justify that sort of privacy imposition. Personally, I think all Captcha needs to go.

mattl 6y ago

15% of the web, surely?

johnisgood 6y ago

I cannot stand captchas. I cannot even solve them myself sometimes and I think I am human. Or when they show "1/5", then at the 4th they add + 2 because why not... Stop wasting my time. This is actually done by hCaptcha.