4 ms·

Worth noting that this title is primarily due to Cloudflare having switched to them from ReCAPTCHA, and Cloudflare is... well, relatively popular, to say the le

by ve55 6y ago

Worth noting that this title is primarily due to Cloudflare having switched to them from ReCAPTCHA, and Cloudflare is... well, relatively popular, to say the least. I'm curious what kind of data may exist on the experience of switching for larger providers; do the users like it? how much more/less time do they spend solving? do they care, let alone even notice that it's not Google's ReCAPTCHA? Regardless, as ReCAPTCHA is not only terribly annoying but also built for surveillance from the ground up, I still view this as a good improvement.

QUFB 6y ago
Honest question: How do you view it as an improvement? The same data is being shared, and the only difference is that Cloudflare isn't immediately behaving in the same evil ways as Google. But once you concentrate power in an entity, perhaps bad things might happen? ... If there was an on-premise captcha implementation that actually worked, that would be great.
- fab1an 6y ago
  Unlike Google, hCaptcha isn't running an ad network "on the side" of their bot management business :) joking aside, hCaptcha is an extremely privacy-conscious operation, Google is not.
  - QUFB 6y ago
    I'm not a lawyer, but can you explain how their privacy policy is privacy-conscious now and going forward, and how centralization of network transit with Cloudflare isn't a bad thing? https://www.hcaptcha.com/privacy https://www.hcaptcha.com/privacy
    - eatbots 6y ago
      hCaptcha is more focused on technical solutions to privacy that minimize required trust. A privacy policy is one thing, but a mathematical guarantee is quite another. We are working through the IETF and directly with browser makers to support provably private options like Privacy Pass, and are currently the only CAPTCHA service to support this. Similarly, on the enterprise side we offer various technical options to let our enterprise customers guarantee exactly what data we can and cannot see. (disclaimer: work there, comments not official, etc.)
      - aftbit 6y ago
        How does support for Privacy Pass interact with services that pay humans pennies per thousands of captcha solves? Wouldn't it be easy to buy a ton of these blinded tokens then have an extension that provides them on demand to the captcha service?
- identity0 6y ago
  hCaptcha works on Tor, sometimes.
judge2020 6y ago
For site operators, they don’t like the change since users are more likely to complain to the website than directly to CF. The following community post has 20k views and >100 replies asking Cloudflare to move back to recaptcha in some form. https://community.cloudflare.com/t/stop-using-hcaptcha/158968?u=judge https://community.cloudflare.com/t/stop-using-hcaptcha/15896...
- TechBro8615 6y ago
  Maybe the user should have the option to choose which CAPTCHA to solve.
- elaus 6y ago
  To be fair it doesn't seem to be _that_ bad on this thread: There's the very vocal OP as well as a "discussion" between various users that ranges from "please switch back to ReCaptcha" to "please keep hCaptcha". For a change that affects "15% of the internet" this seems like very little negative feedback in a period of 8 months.
- sxt 6y ago
  > hCaptcha is making cloudflare money by earning them Human Tokens on the Ethereum blockchain > Most people do the convenience from Google CAPTCHA, although they sell some kind of info, but they won’t hurt you I can't even...this is the Cloudflare forum wow. I've personally had a few hiccups with hCaptcha quite some time back as I "wasn't sure what I was looking for" and consistently fail on VPNs. But in recent months these there's definitely been substantial improvement , and needless to say I hope to see hCaptcha be the majority provider
OJFord 6y ago
Worldwide? And since when? I've never hit one of these, I get reCaptcha'd to ~death~ anger all the time. Although having said that, maybe I am hitting it and that I've been unaware and uninterrogated is high praise! Hm.
gaieges 6y ago
Disclaimer: I've been an engineer at hCaptcha for a few years now building out the service. I'm just as interested in you as hearing about customer and user success/pain stories! > Worth noting that this title is primarily due to Cloudflare having switched to them from ReCAPTCHA, and Cloudflare is... well, relatively popular, to say the least. That's definitely a part of it, but we also have a number of other large sites and services that use hCaptcha to protect against bots, and more that get added every day because of our more advanced bot detection special sauce. > I'm curious what kind of data may exist on the experience of switching for larger providers; do the users like it? how much more/less time do they spend solving? do they care, let alone even notice that it's not Google's ReCAPTCHA? From what we've seen, the integration process is generally smooth, especially if you're a previous reCAPTCHA user, since we keep the interface and workflow largely the same. Solving is roughly the same although we have a number of other protections that irritate bot maintainers and get activated when we detect them. Not sure if the majority of people are aware of the change, I'm sure some technically savvy people pick up on it more than not. > Regardless, as ReCAPTCHA is not only terribly annoying but also built for surveillance from the ground up, I still view this as a good improvement. That's actually one the top reasons we've had a lot of customers come over to us; we put a heavy emphasis on user privacy / security, including adopting/supporting privacy-preserving protocols (PrivacyPass, Tor), and minimal retention of data (see our data privacy policy on our site).
- disgrunt 6y ago
  Your CAPTCHA accessibility leaves much to be desired. You require screen reader users to register an account to create a magic cookie that itself requires Safari users to disable security protections in their browser in order to use -- and then it doesn't actually work. Please do better. You're blocking off a non-trivial amount of the Internet to blind users. You will eventually be sued for this.
  - eatbots 6y ago
    We actually spend quite a lot of time on this, and regularly work with blind users to test and improve these flows. Most vision-impaired users have no issue in our testing, and it is a much more accessible option than audio challenges, which discriminate against those with auditory processing impairments. (disclosure: work there.)
fab1an 6y ago
OP here, and full disclosure I work with the hCaptcha team. Yep, Cloudflare is a big part of this, but you'll find our enterprise offering (BotStop.com) running on many many other large sites and apps. If you've used the internet in 2020, you almost certainly interacted with our products :)
drusepth 6y ago
>do the users like it? This is completely anecdotal (and seems antithetical to the typical HN response to hCaptcha vs ReCAPTCHA), but I feel like I end up spending at least twice as much time trying to solve hCaptchas successfully because they have a lot less consistency in the objects you're searching for. I always have to zoom in to the modal and carefully search through each image, which invariably breaks whatever flow I'm in (moreso than other captchas). For example, here's a screenshot from the hCaptcha website's "try it out" section [1] -- I barely recognized either boat in image #1 because it was so small. I missed image #3 because I didn't realize it was a huge cruise-esque boat (so big you can't even see any water) and I spent a good amount of time deliberating on #4 because, well, it looks like a car + windshield but... on the water? If it's a boat, I can't really tell, but I marked it as one solely because of the water in the background. Not sure if it was right or not. It also seems to occasionally provide "find all the X" challenges without there actually being any X, which feels super cognitively weird ("am I just not seeing it?!"). I'd say ReCAPTCHA's main problem is deciding whether mostly-consistent objects being partially in-frame is enough to "count", whereas hCaptcha's main problem is actually recognizing the widely-varying objects in the frame. I think the former is a little more frustrating when you get something wrong, but the latter is mentally "harder" and takes more time on average, for me at least. [1] https://i.imgur.com/uyqvs5u.png https://i.imgur.com/uyqvs5u.png from https://www.hcaptcha.com/ https://www.hcaptcha.com/
hda2 6y ago
> Do the users like it? Absolutely. Having to solving only one captcha every few days beats solving 5 or 6 on each page visit. hcaptcha supports privacy pass but Recaptcha doesn't.

by ve55 6y ago

QUFB 6y ago

Honest question: How do you view it as an improvement? The same data is being shared, and the only difference is that Cloudflare isn't immediately behaving in the same evil ways as Google. But once you concentrate power in an entity, perhaps bad things might happen? ... If there was an on-premise captcha implementation that actually worked, that would be great.

fab1an 6y ago
Unlike Google, hCaptcha isn't running an ad network "on the side" of their bot management business :) joking aside, hCaptcha is an extremely privacy-conscious operation, Google is not.
- QUFB 6y ago
  I'm not a lawyer, but can you explain how their privacy policy is privacy-conscious now and going forward, and how centralization of network transit with Cloudflare isn't a bad thing? https://www.hcaptcha.com/privacy https://www.hcaptcha.com/privacy
  - eatbots 6y ago
    hCaptcha is more focused on technical solutions to privacy that minimize required trust. A privacy policy is one thing, but a mathematical guarantee is quite another. We are working through the IETF and directly with browser makers to support provably private options like Privacy Pass, and are currently the only CAPTCHA service to support this. Similarly, on the enterprise side we offer various technical options to let our enterprise customers guarantee exactly what data we can and cannot see. (disclaimer: work there, comments not official, etc.)
    - aftbit 6y ago
      How does support for Privacy Pass interact with services that pay humans pennies per thousands of captcha solves? Wouldn't it be easy to buy a ton of these blinded tokens then have an extension that provides them on demand to the captcha service?
identity0 6y ago
hCaptcha works on Tor, sometimes.

judge2020 6y ago

For site operators, they don’t like the change since users are more likely to complain to the website than directly to CF. The following community post has 20k views and >100 replies asking Cloudflare to move back to recaptcha in some form. https://community.cloudflare.com/t/stop-using-hcaptcha/158968?u=judge https://community.cloudflare.com/t/stop-using-hcaptcha/15896...

TechBro8615 6y ago
Maybe the user should have the option to choose which CAPTCHA to solve.
elaus 6y ago
To be fair it doesn't seem to be _that_ bad on this thread: There's the very vocal OP as well as a "discussion" between various users that ranges from "please switch back to ReCaptcha" to "please keep hCaptcha". For a change that affects "15% of the internet" this seems like very little negative feedback in a period of 8 months.
sxt 6y ago
> hCaptcha is making cloudflare money by earning them Human Tokens on the Ethereum blockchain > Most people do the convenience from Google CAPTCHA, although they sell some kind of info, but they won’t hurt you I can't even...this is the Cloudflare forum wow. I've personally had a few hiccups with hCaptcha quite some time back as I "wasn't sure what I was looking for" and consistently fail on VPNs. But in recent months these there's definitely been substantial improvement , and needless to say I hope to see hCaptcha be the majority provider

OJFord 6y ago

Worldwide? And since when? I've never hit one of these, I get reCaptcha'd to ~death~ anger all the time. Although having said that, maybe I am hitting it and that I've been unaware and uninterrogated is high praise! Hm.

gaieges 6y ago

Disclaimer: I've been an engineer at hCaptcha for a few years now building out the service. I'm just as interested in you as hearing about customer and user success/pain stories! > Worth noting that this title is primarily due to Cloudflare having switched to them from ReCAPTCHA, and Cloudflare is... well, relatively popular, to say the least. That's definitely a part of it, but we also have a number of other large sites and services that use hCaptcha to protect against bots, and more that get added every day because of our more advanced bot detection special sauce. > I'm curious what kind of data may exist on the experience of switching for larger providers; do the users like it? how much more/less time do they spend solving? do they care, let alone even notice that it's not Google's ReCAPTCHA? From what we've seen, the integration process is generally smooth, especially if you're a previous reCAPTCHA user, since we keep the interface and workflow largely the same. Solving is roughly the same although we have a number of other protections that irritate bot maintainers and get activated when we detect them. Not sure if the majority of people are aware of the change, I'm sure some technically savvy people pick up on it more than not. > Regardless, as ReCAPTCHA is not only terribly annoying but also built for surveillance from the ground up, I still view this as a good improvement. That's actually one the top reasons we've had a lot of customers come over to us; we put a heavy emphasis on user privacy / security, including adopting/supporting privacy-preserving protocols (PrivacyPass, Tor), and minimal retention of data (see our data privacy policy on our site).

disgrunt 6y ago
Your CAPTCHA accessibility leaves much to be desired. You require screen reader users to register an account to create a magic cookie that itself requires Safari users to disable security protections in their browser in order to use -- and then it doesn't actually work. Please do better. You're blocking off a non-trivial amount of the Internet to blind users. You will eventually be sued for this.
- eatbots 6y ago
  We actually spend quite a lot of time on this, and regularly work with blind users to test and improve these flows. Most vision-impaired users have no issue in our testing, and it is a much more accessible option than audio challenges, which discriminate against those with auditory processing impairments. (disclosure: work there.)

fab1an 6y ago

OP here, and full disclosure I work with the hCaptcha team. Yep, Cloudflare is a big part of this, but you'll find our enterprise offering (BotStop.com) running on many many other large sites and apps. If you've used the internet in 2020, you almost certainly interacted with our products :)

drusepth 6y ago

>do the users like it? This is completely anecdotal (and seems antithetical to the typical HN response to hCaptcha vs ReCAPTCHA), but I feel like I end up spending at least twice as much time trying to solve hCaptchas successfully because they have a lot less consistency in the objects you're searching for. I always have to zoom in to the modal and carefully search through each image, which invariably breaks whatever flow I'm in (moreso than other captchas). For example, here's a screenshot from the hCaptcha website's "try it out" section [1] -- I barely recognized either boat in image #1 because it was so small. I missed image #3 because I didn't realize it was a huge cruise-esque boat (so big you can't even see any water) and I spent a good amount of time deliberating on #4 because, well, it looks like a car + windshield but... on the water? If it's a boat, I can't really tell, but I marked it as one solely because of the water in the background. Not sure if it was right or not. It also seems to occasionally provide "find all the X" challenges without there actually being any X, which feels super cognitively weird ("am I just not seeing it?!"). I'd say ReCAPTCHA's main problem is deciding whether mostly-consistent objects being partially in-frame is enough to "count", whereas hCaptcha's main problem is actually recognizing the widely-varying objects in the frame. I think the former is a little more frustrating when you get something wrong, but the latter is mentally "harder" and takes more time on average, for me at least. [1] https://i.imgur.com/uyqvs5u.png https://i.imgur.com/uyqvs5u.png from https://www.hcaptcha.com/ https://www.hcaptcha.com/

hda2 6y ago

> Do the users like it? Absolutely. Having to solving only one captcha every few days beats solving 5 or 6 on each page visit. hcaptcha supports privacy pass but Recaptcha doesn't.