4 ms·

Curious what people think about hCaptcha?

mtmail 6y ago
We switched a couple of months ago. Integration wasn't more or less difficult, works alright with our test suite. Some users feedback "Why do I have to identify boats?" but otherwise we found no difference number of blocks or user behavior.
DoctorOW 6y ago
Personally I find it much more difficult than recaptcha. The tests themselves aren't much worse but since I have a Google account HCaptcha shows up more frequently.
- californical 6y ago
  Small price to pay to prevent Google from having tracking scripts and metrics on users of every major website. hCaptcha at least somewhat values user privacy.
jtbayly 6y ago
Far, far superior to reCaptcha from a user's perspective using Tor. I can solve a few puzzles with hCaptcha and I know I'll get through and see the content. With reCaptcha I might solve 3 puzzles and then get denied anyway, or I might solve 10 puzzles with no end in sight and give up.
- seisvelas 6y ago
  On the other hand, many Tor users disable Javascript. Out of curiosity, does anyone know a good CAPTCHA that doesn't use JS?
  - jdu9 6y ago
    BotStop by hCaptcha (enterprise). AFAIK there's also a Google reCaptcha frontend that doesn't require JS. Neither companies offer those solutions because of privacy or security benefits, but to support old IE versions of course.
    - seisvelas 6y ago
      > BotStop by hCaptcha Cool, I didn't know about this! Too bad there doesn't seem to be a strong open source option, but I'll check this out.
- CodesInChaos 6y ago
  Not sure if I'm seeing patterns in noise, but with recaptcha I felt that timing and mouse movements are just as important as clicking the right images. It feels like solving the puzzle quickly and using minimal mouse movements has a higher chance of being denied compared to waiting some time between clicks and adding some superfluous mouse movements.
  - MattGaiser 6y ago
    It also seems to be this way too. If I am using Tor, it seems like I need to swirl my mouse around a few times to pass a recaptcha.
- jdu9 6y ago
  But also far superior to reCaptcha from a bot's perspective using Tor. Don't get me wrong: I also hate solving a gazillion captchas only because I'm using a VPN or get outright denied because my IP address happens to be a Tor exit node. At the same time you have to acknoledge that captchas don't stop bots, only slow them down or increase their operating costs. People in third world countries happily solve one image recognition challenge by Google or hCaptcha for far less than a penny. If Google's goal is to drive the costs up for malicious bot operators, then they're definitely doing the right thing. In the end, it won't stop them either since buying a couple thousand infected computers is probably not that expensive, but it is yet another stepping stone for anyone trying to bypass their captcha.
eznzt 6y ago
I don't like it because Buster doesn't work on it. Also since only cloudflare uses it, and I dislike cloudflare, I have this irrational hatred of it.
- jdu9 6y ago
  >because Buster doesn't work on it Assuming you mean Debian Buster: Then get a newer Firefox version from backports. This is more related to Firefox ESR than Buster. Edit: Nevermind... After reading other replies, I think eznzt referred to https://github.com/dessant/buster https://github.com/dessant/buster
innocenat 6y ago
For me I find hCaptcha harder and more ambiguous than what I have experienced with reCaptcha. The ambiguity might be because my phone is set to Japanese. I got asked to identify 電車 (Densha, electric train), but there were also images of diesel train. Is it translation error, or is it really asking me to identify electric train? (The correct term for train in general in Japanese is 列車 ressha)
- deleted 6y ago
  [deleted]
- fab1an 6y ago
  Great catch. If you'd like, you can actually submit a better translation via a pr here: https://github.com/hCaptcha/hcaptcha-i18n https://github.com/hCaptcha/hcaptcha-i18n
  - gnud 6y ago
    I don't think you can? That repo has the translations of the strings used by the "meta"-part of the service, stuff like "accessibility information". I can't see any text used by the actual tasks.
nekoashide 6y ago
It's been terrible, when Cloudflare switched to hCaptcha it not only broke our app but it seems every time they make a change it breaks something else. We might be a special case but it's hard to say since all they say it's "quirks" and they keep making changes without announcing anything.
slig 6y ago
Dislike it, to say the least. Since it doesn't seems to remember that I'm a human (reCpatcha did), now I have to constantly solve captchas on CF sites.
- eatbots 6y ago
  With hCaptcha (enterprise ver) this is entirely under the control of the customer. We're not "remembering" in the same way, but have good enough instantaneous scoring to correctly guess whether or not a challenge is required most of the time. Some customers may disable that option to meet their requirements. Not much we can do about that :)
  - slig 6y ago
    Thank you for clarifying that, hope that CF decides to use this feature.
meibo 6y ago
I really don't like it. They are generally harder and if I visit a CF site multiple times, I have to solve them multiple times. Even if this is up to the customer, it's annoying and should be discouraged. I didn't mind solving a reCaptcha once, I mind forcing myself through these every 10 minutes.
maple3142 6y ago
It is more annoying than reCAPTCHA if you don't aggressively block tracking. because I rarely need to solve it manually in reCAPTCHA, while it is not the case with hCaptcha.

We switched a couple of months ago. Integration wasn't more or less difficult, works alright with our test suite. Some users feedback "Why do I have to identify boats?" but otherwise we found no difference number of blocks or user behavior.

DoctorOW 6y ago

Personally I find it much more difficult than recaptcha. The tests themselves aren't much worse but since I have a Google account HCaptcha shows up more frequently.

californical 6y ago
Small price to pay to prevent Google from having tracking scripts and metrics on users of every major website. hCaptcha at least somewhat values user privacy.

jtbayly 6y ago

Far, far superior to reCaptcha from a user's perspective using Tor. I can solve a few puzzles with hCaptcha and I know I'll get through and see the content. With reCaptcha I might solve 3 puzzles and then get denied anyway, or I might solve 10 puzzles with no end in sight and give up.

seisvelas 6y ago
On the other hand, many Tor users disable Javascript. Out of curiosity, does anyone know a good CAPTCHA that doesn't use JS?
- jdu9 6y ago
  BotStop by hCaptcha (enterprise). AFAIK there's also a Google reCaptcha frontend that doesn't require JS. Neither companies offer those solutions because of privacy or security benefits, but to support old IE versions of course.
  - seisvelas 6y ago
    > BotStop by hCaptcha Cool, I didn't know about this! Too bad there doesn't seem to be a strong open source option, but I'll check this out.
CodesInChaos 6y ago
Not sure if I'm seeing patterns in noise, but with recaptcha I felt that timing and mouse movements are just as important as clicking the right images. It feels like solving the puzzle quickly and using minimal mouse movements has a higher chance of being denied compared to waiting some time between clicks and adding some superfluous mouse movements.
- MattGaiser 6y ago
  It also seems to be this way too. If I am using Tor, it seems like I need to swirl my mouse around a few times to pass a recaptcha.
jdu9 6y ago
But also far superior to reCaptcha from a bot's perspective using Tor. Don't get me wrong: I also hate solving a gazillion captchas only because I'm using a VPN or get outright denied because my IP address happens to be a Tor exit node. At the same time you have to acknoledge that captchas don't stop bots, only slow them down or increase their operating costs. People in third world countries happily solve one image recognition challenge by Google or hCaptcha for far less than a penny. If Google's goal is to drive the costs up for malicious bot operators, then they're definitely doing the right thing. In the end, it won't stop them either since buying a couple thousand infected computers is probably not that expensive, but it is yet another stepping stone for anyone trying to bypass their captcha.

eznzt 6y ago

I don't like it because Buster doesn't work on it. Also since only cloudflare uses it, and I dislike cloudflare, I have this irrational hatred of it.

jdu9 6y ago
>because Buster doesn't work on it Assuming you mean Debian Buster: Then get a newer Firefox version from backports. This is more related to Firefox ESR than Buster. Edit: Nevermind... After reading other replies, I think eznzt referred to https://github.com/dessant/buster https://github.com/dessant/buster

innocenat 6y ago

For me I find hCaptcha harder and more ambiguous than what I have experienced with reCaptcha. The ambiguity might be because my phone is set to Japanese. I got asked to identify 電車 (Densha, electric train), but there were also images of diesel train. Is it translation error, or is it really asking me to identify electric train? (The correct term for train in general in Japanese is 列車 ressha)

deleted 6y ago
[deleted]
fab1an 6y ago
Great catch. If you'd like, you can actually submit a better translation via a pr here: https://github.com/hCaptcha/hcaptcha-i18n https://github.com/hCaptcha/hcaptcha-i18n
- gnud 6y ago
  I don't think you can? That repo has the translations of the strings used by the "meta"-part of the service, stuff like "accessibility information". I can't see any text used by the actual tasks.

nekoashide 6y ago

It's been terrible, when Cloudflare switched to hCaptcha it not only broke our app but it seems every time they make a change it breaks something else. We might be a special case but it's hard to say since all they say it's "quirks" and they keep making changes without announcing anything.

slig 6y ago

Dislike it, to say the least. Since it doesn't seems to remember that I'm a human (reCpatcha did), now I have to constantly solve captchas on CF sites.

eatbots 6y ago
With hCaptcha (enterprise ver) this is entirely under the control of the customer. We're not "remembering" in the same way, but have good enough instantaneous scoring to correctly guess whether or not a challenge is required most of the time. Some customers may disable that option to meet their requirements. Not much we can do about that :)
- slig 6y ago
  Thank you for clarifying that, hope that CF decides to use this feature.

meibo 6y ago

I really don't like it. They are generally harder and if I visit a CF site multiple times, I have to solve them multiple times. Even if this is up to the customer, it's annoying and should be discouraged. I didn't mind solving a reCaptcha once, I mind forcing myself through these every 10 minutes.

maple3142 6y ago

It is more annoying than reCAPTCHA if you don't aggressively block tracking. because I rarely need to solve it manually in reCAPTCHA, while it is not the case with hCaptcha.