3 ms·

Far, far superior to reCaptcha from a user's perspective using Tor. I can solve a few puzzles with hCaptcha and I know I'll get through and see the content. Wit

Far, far superior to reCaptcha from a user's perspective using Tor. I can solve a few puzzles with hCaptcha and I know I'll get through and see the content. With reCaptcha I might solve 3 puzzles and then get denied anyway, or I might solve 10 puzzles with no end in sight and give up.

seisvelas 6y ago
On the other hand, many Tor users disable Javascript. Out of curiosity, does anyone know a good CAPTCHA that doesn't use JS?
- jdu9 6y ago
  BotStop by hCaptcha (enterprise). AFAIK there's also a Google reCaptcha frontend that doesn't require JS. Neither companies offer those solutions because of privacy or security benefits, but to support old IE versions of course.
  - seisvelas 6y ago
    > BotStop by hCaptcha Cool, I didn't know about this! Too bad there doesn't seem to be a strong open source option, but I'll check this out.
CodesInChaos 6y ago
Not sure if I'm seeing patterns in noise, but with recaptcha I felt that timing and mouse movements are just as important as clicking the right images. It feels like solving the puzzle quickly and using minimal mouse movements has a higher chance of being denied compared to waiting some time between clicks and adding some superfluous mouse movements.
- MattGaiser 6y ago
  It also seems to be this way too. If I am using Tor, it seems like I need to swirl my mouse around a few times to pass a recaptcha.
jdu9 6y ago
But also far superior to reCaptcha from a bot's perspective using Tor. Don't get me wrong: I also hate solving a gazillion captchas only because I'm using a VPN or get outright denied because my IP address happens to be a Tor exit node. At the same time you have to acknoledge that captchas don't stop bots, only slow them down or increase their operating costs. People in third world countries happily solve one image recognition challenge by Google or hCaptcha for far less than a penny. If Google's goal is to drive the costs up for malicious bot operators, then they're definitely doing the right thing. In the end, it won't stop them either since buying a couple thousand infected computers is probably not that expensive, but it is yet another stepping stone for anyone trying to bypass their captcha.

seisvelas 6y ago

On the other hand, many Tor users disable Javascript. Out of curiosity, does anyone know a good CAPTCHA that doesn't use JS?

jdu9 6y ago
BotStop by hCaptcha (enterprise). AFAIK there's also a Google reCaptcha frontend that doesn't require JS. Neither companies offer those solutions because of privacy or security benefits, but to support old IE versions of course.
- seisvelas 6y ago
  > BotStop by hCaptcha Cool, I didn't know about this! Too bad there doesn't seem to be a strong open source option, but I'll check this out.

CodesInChaos 6y ago

Not sure if I'm seeing patterns in noise, but with recaptcha I felt that timing and mouse movements are just as important as clicking the right images. It feels like solving the puzzle quickly and using minimal mouse movements has a higher chance of being denied compared to waiting some time between clicks and adding some superfluous mouse movements.

MattGaiser 6y ago
It also seems to be this way too. If I am using Tor, it seems like I need to swirl my mouse around a few times to pass a recaptcha.

jdu9 6y ago

But also far superior to reCaptcha from a bot's perspective using Tor. Don't get me wrong: I also hate solving a gazillion captchas only because I'm using a VPN or get outright denied because my IP address happens to be a Tor exit node. At the same time you have to acknoledge that captchas don't stop bots, only slow them down or increase their operating costs. People in third world countries happily solve one image recognition challenge by Google or hCaptcha for far less than a penny. If Google's goal is to drive the costs up for malicious bot operators, then they're definitely doing the right thing. In the end, it won't stop them either since buying a couple thousand infected computers is probably not that expensive, but it is yet another stepping stone for anyone trying to bypass their captcha.