12 ms·

I was banned from the hCaptcha accessibility account for not being blind (2023)

410 points by blindgeek 2y ago

blindgeek 2y ago
The author was essentially too smart to be blind.
- yorwba 2y ago
  I wonder whether talking about "looking at the javascript console" somehow made them think that this person cannot possibly be blind, since how could a blind person "see" the JavaScript console? (But "having my screen reader read the content of the JavaScript console to me" is a bit of a mouthful.)
  - blindgeek 2y ago
    You know, that's a good point, and it hadn't occurred to me. For the overwhelming majority of blind people, language like "looked at" is just metaphorical. I mean, all language is symbolic anyway. The map is not the territory and the menu is not the dinner. Some of us are taught very young to use common terms like look in that kind of a metaphorical way. Partially so that we fit in and are comfortable with the rest of sighted culture. And then once in a great while, we get condescended to for it. There's a really good example of this in the second season episode of DS9, The Alternate. ``` ODO It was a dilemma for me. I'd never seen anything like these creatures either. MORA "Seen" isn't really an appropriate description. He had no eyes per se... ODO I was only trying to describe it in simple terms... MORA (ignoring that) He had never perceived anything like us before... go on... ``` I can pretty much guarantee that every blind person has had a condescending, patronizing douche canoe like Mora in their life at least once.
    - bluGill 2y ago
      Even as a sighted person, "look at" is often metamorphic - you can interview an expert over the phone and say you looked into the subject even though the only looking was around the phone number.
      - deleted 2y ago
        [deleted]
      - lagadu 2y ago
        When someone recommends me an album or artist I "take a look" at it: I listen to it. Though now that I think about it, I wouldn't say that in my other languages.
    - pbronez 2y ago
      I suppose one could say "observed" as a sense-neutral alternative to see / hear. Might be a worthwhile language shift, similar to using "they" as a gender-neutral alternative to "he" and "her". We usually talk about the inclusion benefits of neutral language. It can also be valuable by making specific terms more meaningful when used appropriately. If I know you usually say "they", then when you choose to say "he" I get more information -- there's a clear gender expression. Similarly, if you usually say "observe", then when you say "see" I know we're specifically talking about vision. Of course, it's an awkward transition. It's hard to get used to "they/them" and saying "I observed a delicious aroma" sounds like a robot impersonating a person.
      - blindgeek 2y ago
        It's notable that the majority of the people who would be "included" by the change to "more inclusive" language aren't offended in the first place. The sentence "I am watching TV" literally offended no blind person, evah. It is only sighted do-gooders who have the spoons to be offended by nothingburgers on our behalf. We're too busy dealing with stuff like, ... I dunno, landlords who refuse to rent to us because all they have is second story units and we might fall down the stairs. Yes this actually happened to me in 2000 or so, and I don't have enough faith in human intelligence to believe that it isn't happening today. We're too busy being oppressed by captchas and websites made by frontend devs who seem to care more about chasing JavaScript framework du jour than they care about accessibility. We're busy struggling against a built physical environment which has been designed for cars and not people. The supposedly non-inclusive language of "I watched TV" or "I looked at my browser's JS console" aren't even on our radar. I coined the term "Sapir-Whorf Stalinists" a few weeks ago to describe the sort of people who think that monkeying with language will magically make things better for marginalized groups. Here's Lee Atwater talking about the Southern Strategy: > You start out in 1954 by saying, “Nigger, nigger, > nigger.” By 1968 you can’t say “nigger”—that hurts you, backfires. > So you say stuff like, uh, forced busing, states’ rights, and all that stuff, > and you’re getting so abstract. Now, you’re talking about cutting taxes, > and all these things you’re talking about are totally economic things and a > byproduct of them is, blacks get hurt worse than whites.… “We want to cut > this,” is much more abstract than even the busing thing, uh, > and a hell of a lot more abstract than “Nigger, nigger.”
    - Lerc 2y ago
      This is how use of language concealed aphantasia for so long. When you use a word in a context similar to how another used it in that context there seems to be a presumption that the subjective experience is the same in that context. Given how we learn languages and words based upon encountering them in contexts, it makes sense that terms that we use in outwardly similar contexts reflect the subjective experience that each of us relate to those terms. We don't have access to another's subjective experience so I can see how it would encourage the assumption that we all perceive things the same way. There might be many undetected variances in perception akin to aphantasia lurking in us waiting to be discovered.
      - blindgeek 2y ago
        Here's the thing. We're talking about people who are the accessibility team for hCaptcha. They should at least have a figleaf of an understanding of life for blind people. The other problem we have is that online companies tend to be accountable to no one. Short of law suits, my friend who got banned from hCaptcha for "not being blind" has no recourse, because nobody is accountable.
        rascul 2y ago
        Lawsuits are how that's solved in the physical world also.
    - webspinner 2y ago
      Yes that's my mother.
  - RandallBrown 2y ago
    I'd bet that's exactly what happened.
- jesterswilde 2y ago
  Gwahahha, succinct. I run into this far too often. Being in places or doing things I (blind guy) "shouldn't be", thus, am not blind.
- webspinner 2y ago
  Yes because all of us are stupid according to hCAPTCHA!
soraminazuki 2y ago
The title kind of makes it appear far less of a problem than it actually is, because according to the article, hCaptcha made multiple rude and evidence-free accusations of lying despite the author actually being blind.
- jerf 2y ago
  Remember that from hCaptcha's point of view, by this point they've probably dealt with hundreds of other people claiming that they are blind when they really aren't, so their bots will work. This isn't a defense, just an explanation... but it is also an explanation of why the entire idea of "we'll not give blind people a way past the CAPTCHA but just give a pass to 'real' blind people so we can pass ADA", which is that it should have been transparently obvious that this approach is completely infeasible and unscalable. As big as Google, Facebook, or Amazon are, they would struggle under the load of trying to create a system for determining who is "truly" blind... and that's still true if we ignore questions like exactly what "blind" is anyhow. This shouldn't have gotten deployed and then become a problem; it should have been a 5 minute diversion in the meeting where it was proposed to analyze it's completely infeasible and never made it to so much as the design phase, let alone the deployment phase. If you had a system for completely accurately identifying characteristics like "who is blind" in the presence of extremely hostile attacks on the system, you'd have something far more valuable than the CAPTCHA system itself! The whole idea intrinsically depends on having a stronger solution to the problems CAPTCHAs are meant to solve than the CAPTCHA system itself provides... it's fundamentally a logically unsound idea.
  - anotherhue 2y ago
    > If you had a system for completely accurately identifying characteristics like "who is blind" in the presence of extremely hostile attacks on the system, you'd have something far more valuable than the CAPTCHA system itself! You are unfortunately describing worldcoin.
    - KETHERCORTEX 2y ago
      Worldcoin? Government issued auth service is a viable option too. Just get some flag like "isBlind" in it. Disabled status is granted by the government after all.
garbanz0 2y ago
That smells illegal.
Spivak 2y ago
This has got to be an open-and-shut lawsuit if the author wants to pursue it. T&C doesn't shield you from the ADA.
lupusreal 2y ago
I hope AI stuff makes captchas completely obsolete soon. I am sick of them. The cure is worse than the disease.
- edm0nd 2y ago
  Captchas have been obsolete for the past decade plus. With solving services like DeathByCaptcha and AntiCaptcha, it takes seconds to solve them. It costs something like $1.90 per 1,000 successfully solved captchas using human typers and OCR. It can easily be rolled into your code with a few lines.
- jeroenhd 2y ago
  AI stuff is why CAPTCHAs exist. It's also why they've gotten so much worse the last few years. CAPTCHAs are going to get much worse before they're replaced by account paywalls or remote hardware attestation.
- exe34 2y ago
  AI are already much better at them than I am.
- xdennis 2y ago
  But surely, it's only going to get worse: it will force the de-anonymization of the internet. You already have to provide a phone number for many services. If websites can't trust that their users are authentic they will probably institute even more intrusive checks. I haven't been optimistic about the future of technology for a while now. :'(
  - rvnx 2y ago
    In the future I think we will again go to "notarization"/"attestation" of the operating system / hardware. Essentially, the manufacturer of the device + operating system will generate a unique signature per each device, and web browsers will be able to access it. https://en.wikipedia.org/wiki/Web_Environment_Integrity https://en.wikipedia.org/wiki/Web_Environment_Integrity
Rastonbury 2y ago
Some captchas are getting pretty discriminatory, not everyone lives in the West and can identify the objects they are asking you to. Another recent one sticks out where they asked me to pick a shape as the same number of conoids on screen. If you ask people on a street what a conoids I bet a significant amount will give you blank looks Also at least now I know some people call those markings crosswalks
- throwaway519 2y ago
  [flagged]
- ta1243 2y ago
  Sorry I live in the west, what's a "crosswalk" Did you mean to say > not everyone lives in the USA Other things I don't have a clue about - a fire hydrant, yellow taxis, yellow buses (Obviously I do, because of American cultural imperialism through things like Captchas which mean the world has to understand American cultural touchstones)
  - slater 2y ago
    Please enter your five-digit ZIP code
    - deleted 2y ago
      [deleted]
    - bux93 2y ago
      90210 (Cue theme music in mind's ear)
      - thebruce87m 2y ago
        That’s my zip code too, along with millions of others who live outside the US. Haven’t needed to use it for a while.
        2y ago
nerdponx 2y ago
Lesson 1 about competing with Google should be "don't be even more disrespectful to your users than Google is". Otherwise people will just use Google. Relying on the goodwill of a small number of "never-Googlers" to carry your business, in spite of the way you do business, is not a path to success. While hCaptcha trashes its reputation, the rest of the world will go on using reCaptcha and not giving the faintest whiff of a fart about hCaptcha's existence. (Side note: the spelling is "intentional", not "intensional". Think "intent" + "-tion" + "-al", not "in-" + "tension" + "-al").
isodev 2y ago
Why are captchas even a thing still? If folks want to scrape something or build an automation around something, then why not let them do it? They still have to respect the system they're logging in. Not to mention the privacy perk of not exposing your visitors to some captcha service with a dozen or more data subprocessors.
- dewey 2y ago
  Captchas are used for many things, and the reason they are still a thing is because they mostly work. Especially fingerprinting invisible captchas. Try having a login form without a captcha and you'll realize you are capturing 100s of users every day that require you to send out a "please confirm your email address" email for each of them for no good reason. > They still have to respect the system they're logging in. Your trust in people is admirable, but in my experience running anything on the internet you'll realize that intentionally or not people will bombard your system until it falls over.
  - isodev 2y ago
    I think folks forget that we can add many of the safeguards a captchas provide as part of whatever "form serving app" is needed without torturing our visitors to prove they can count bicycles.
    - dewey 2y ago
      I think the times of the "count bicycles" type of captcha are already counted just because of the bad user experience. Now everything is about fingerprinting, as paying to get captchas solved by humans or AI is already used everywhere if it's worth it.
  - nraynaud 2y ago
    they don't work, robots have a higher speed and success rate than humans.
    - dewey 2y ago
deleted 2y ago
[deleted]
devmor 2y ago
It's quite unpleasantly often that I hear stories about accessibility accommodations being removed by someone considering themselves the sole arbiter of disability.
jchw 2y ago
I hope we can end the CAPTCHA experiment soon. It didn't work. Phone verification isn't good either, but for as much as I hate phone verification at least it actually raises the cost of spamming somewhat. CAPTCHA does not. Almost all turnkey CAPTCHA services can be solved for pennies. Solving the problems of SPAM and malicious traffic will be challenging... I am worried it will come down to three possible things: - Anonymity of users: validating someone's real-life identity sufficiently would make it possible to permanently ban malicious individuals and filter out bots with good effectiveness, but it will destroy anonymity online. In my opinion, literally untenable. - Closing the platform: approaches like Web Environment Integrity and Private Access Tokens pave the way for how the web platform could be closed down. The vast majority of web users use Google Chrome or Safari on a device with Secure Boot, so the entire boot chain can be attested. The number of users that can viably do this will only increase over time. In this future, the web ceases to meaningfully be open: alternatives to this approach will continue to become less and less useful (e.g. machine learning may not achieve AGI but it's going to kick the ass of every CAPTCHA in sight) so it will become increasingly unlikely you'll be able to get into websites without it. - Accountability of network operators: Love it or hate it, the Internet benefits a lot from gray-area operators that operate with little oversight or transparency. However, another approach to getting rid of malicious traffic is to push more accountability to network operators, severing non-compliant providers off of the Internet. This would probably also suck, and would incentivize abusing this power. It's tricky, though. What else can you do? You can try to reduce the incentives to have malicious traffic, but it's hard to do this without decreasing the value that things offer. You can make malicious traffic harder by obfuscation, but it's hard to stop motivated parties. Either way, it feels like the era of the open web is basically over. The open web may continue to exist, but it will probably be overshadowed by a new and much more closed off web.
- Telemakhos 2y ago
  This doesn’t feel so much like the end of the “open web” as it does a rehash of USENET and email spam issues. Social media killed USENET, and email managed its spam issues thanks to filtering.
  - 2y ago
RobMurray 2y ago
I am also blind. hCaptcha is the worst. Their stupid cookie expires so I have to go through their getting an email to set the cookie almost every time I encounter one. It's a horrendous UX, especially when using different devices and browsers. I imagine others just give up instead of dealing with the crap. They shouldn't use the word accessibility when their whole service is the exact opposite. The bots can probably solve them easier than blind people anyway, or they can outsource them to third world workers for next to nothing. E.G. Anticaptcha [0]: > Starting from 0.5USD per 1000 images, depending on your daily spending volume [0] https://anti-captcha.com/ https://anti-captcha.com/
- rwmj 2y ago
  Believe me, hCaptcha isn't much better even if you're not blind! They show me minuscule images which are barely distinguishable from each other. It manages to be much worse than reCaptcha, which is some achievement.
  - tracker1 2y ago
    I'm not blind, but do have visibility issues. I can get by on my phone with maxed text size, etc. The pictures for hcaptcha are horrible... I keep having to zoom in and out. It's almost as bad as modals that flow off screen. It sucks more when you work in the space and take a lot of care to usability. It's not that hard most of the time.
- nmarinov 2y ago
  What's the best captcha regarding accessibility?
  - burningChrome 2y ago
    None. There are no "best" version of captcha. I've worked on several large scale projects where captcha was floated and then quickly abandoned in favor of other methods like Honeypot or using other methods to weed out bots and other 3rd party agents. If you have to use captcha the least worst are probably reCaptcha V2 and hCaptcha for accessibility.
hyperman1 2y ago
I think, unfortunately, most accessibility options are not intended to actually be used. If you are a governement or bigco, accessibility is part of your baseline requirements. You must be able to say: Yes, we are accessible. Otherwise, the public will cause a stink. So you take your list of vendors, and remove any that don't say they enable accessibility. Vendors know this and make sure they say they are. Meanwhile, it is a hard to get right feature, only applicable to a small part of your userbase. Multiple disabilities require different affordances. No developer on the team really understands the actual requirement. The people requiring accessibility will go somewhere else, or grumble and make do. Neither will be detected on any metrics board. This combination promotes shelfware: Things you buy and put on a shelf somewhere but never really use.
miki123211 2y ago
As a blind person, I genuinely believe that hCaptcha, being as terrible as it is, is still the best solution among the ones that we can physically achieve in the world as it exists right now. Audio captchas don't work for people with hearing issues and/or who don't speak your n supported languages, where n is usually <10. I've had to help people out with these over the phone, it was not fun. Even for people for whom they do work, it's worth keeping in mind that bots can solve them by now, and so users whose activity looks too fraudulent, who are still given access to the visual captchas, have to be blocked from using the audio ones. I have also seen this happen. Text captchas are a non-option by now, they're very easy to solve with LLMs, and the way they have to be phrased makes it impossible to align LLMs not to solve them, like you can do with the visual ones. Google's ReCaptcha can get away with having no actual challenge for most users, blind or otherwise, but that's because they're Google, they do enough user tracking that they don't actually need a captcha. Google is the only company that can get away with this, and even for them, it doesn't work in all situations, even when the user fully trusts Google and has not adjusted any privacy preferences. Sure, you could stop using captchas entirely, if you're fine with receiving dozens of viagra ads on every single platform each day, abolishing all "contact us" and comment forms on the internet, having a significantly higher credit card fraud rate (which translates directly to higher prices and a much worse experience for consumers), and getting all your semi-public records and social media activity immediately scraped by shady companies and sold to anybody who expresses any interest. Unsurprisingly, most users are, in fact, not fine with this.
- blindgeek 2y ago
  > and getting all your semi-public records and social media activity immediately > scraped by shady companies and sold to anybody who expresses any interest. Public content on the Internet should be scrapable. That's what public means. The fact that my reddit posts were publicly available never bothered me. Even if they were going to be used to train some LMM. What does bother me is reddit locking up my posts and making exclusive deals with Google to train Google's LMM. Preventing scraping isn't good for the average user; it is good for the company that wants to take content created by said user, lock it up, and sell it to their buddies.
blindgeek 2y ago
And the very angry email that I (probably unwisely) just dashed off to support@hcaptcha.com: "So I've been trying to sign in repeatedly to set the accessibility cookie since last night. Every time I click the submit button, I get the useless error message "an error has occurred, please try again". My friend, who shares my roof and my static IP, got banned from hcaptcha's accessibility service last year for being too smart to be blind. And I suspect you all have banned our IP and not just his account. For the record, my static IP address is (redacted). See https://michaels.world/2023/11/i-was-banned-from-the-hcaptcha-accessibility-account-for-not-being-blind/ https://michaels.world/2023/11/i-was-banned-from-the-hcaptch... for his story. I have been broadcasting this to websites frequented by technically capable people: https://news.ycombinator.com/item?id=42171164 https://news.ycombinator.com/item?id=42171164 https://lobste.rs/s/qbkd0u/i_was_banned_from_hcaptcha_accessibility https://lobste.rs/s/qbkd0u/i_was_banned_from_hcaptcha_access... Please let your bosses know that I plan to pursue legal action against hCaptcha and/or amplify the truth to destroy its reputation in the public square. I will also be reaching out to websites who utilize hCaptcha, letting them know that the captcha provider they employ is refusing to provide reasonable accomodations to blind people. Whether it be with the force of law or the force of satyagraha, your bosses are going to get a message and we will win.
- blindgeek 2y ago
  And their thoroughly unhelpful reply: "Hi there, sorry to hear you're having difficulties! We have an alternative authentication scheme that you may prefer: https://www.hcaptcha.com/accessibility https://www.hcaptcha.com/accessibility You can sign up here: https://dashboard.hcaptcha.com/signup?type=accessibility https://dashboard.hcaptcha.com/signup?type=accessibility This lets you avoid the challenge altogether after registration. It is designed for users with any kind of difficulty solving the challenges. Thanks for reaching out, and hope this makes your experience better."
  - mp3geek 2y ago
    Brave support here, tried to reach out to hcaptcha support and got the same auto response :|
- 2y ago
andrewaylett 2y ago
CAPTCHA: Completely Automated Public Turing test to tell Computers and Humans Apart. These things have one job. Any time they fail to identify a human, they have failed at their job. How they go about administering the test, and (to a large extent) what the human does in response, should be irrelevant. I know that's hard, no-one said the job was easy, and the companies developing them are the ones making claims about their efficacy. If you want to block 100% of bots, don't put your stuff on the Internet. If you want to block bots and allow humans then you're going to have false negatives. Failing to acknowledge them is dishonest. None of which stops me filling them out when I encounter them, but I don't have to like it.
throw_a_grenade 2y ago
If you're in Europe, consider filing GDPR complaint to your local data protection authority. One of the rights recognised in GDPR is right to rectify information about you, and it was clearly not afforded by the provider here.
mathfailure 2y ago
hCaptcha is worse, than reCaptcha. I pass the captcha (I am not blind and not using accessibility account) and get response like Your response to the CAPTCHA appears to be invalid. Please re-verify that you're not a robot below. (Reference ID: 4035128747213959) And you are given captcha again (passing which will have the same result). reCaptcha had similar issue, but choosing 'accessibility' would transform the captcha from visual to auditory one and passing it had no such problems. In the end I just gave up.
Pxtl 2y ago
Please just let my link some kind of government-backed ID to an email account and then clients can ask "hey government, is this email account a real human being in your country"? And government can say "yes" and they can go forward knowing that if I turn out to be a bot and they ban me it will be a huge pain in my ass because I've got to go through government enrollment process again.
neilv 2y ago
> I emailed back a day or so later, requesting an unban because, y'know, I actually* am blind, but they gave a pretty canned response of no, your account is remaining banned.* Do I understand correctly that hCaptcha has created an accessibility problem that's denying this blind person access to all sorts of Web sites? Is there an ADA angle here, for many customers of hCaptcha?
intunderflow 2y ago
reCaptcha is better than hCaptcha

410 points by blindgeek 2y ago

blindgeek 2y ago

The author was essentially too smart to be blind.

yorwba 2y ago
I wonder whether talking about "looking at the javascript console" somehow made them think that this person cannot possibly be blind, since how could a blind person "see" the JavaScript console? (But "having my screen reader read the content of the JavaScript console to me" is a bit of a mouthful.)
- blindgeek 2y ago
  You know, that's a good point, and it hadn't occurred to me. For the overwhelming majority of blind people, language like "looked at" is just metaphorical. I mean, all language is symbolic anyway. The map is not the territory and the menu is not the dinner. Some of us are taught very young to use common terms like look in that kind of a metaphorical way. Partially so that we fit in and are comfortable with the rest of sighted culture. And then once in a great while, we get condescended to for it. There's a really good example of this in the second season episode of DS9, The Alternate. ``` ODO It was a dilemma for me. I'd never seen anything like these creatures either. MORA "Seen" isn't really an appropriate description. He had no eyes per se... ODO I was only trying to describe it in simple terms... MORA (ignoring that) He had never perceived anything like us before... go on... ``` I can pretty much guarantee that every blind person has had a condescending, patronizing douche canoe like Mora in their life at least once.
  - bluGill 2y ago
    Even as a sighted person, "look at" is often metamorphic - you can interview an expert over the phone and say you looked into the subject even though the only looking was around the phone number.
    - deleted 2y ago
      [deleted]
    - lagadu 2y ago
      When someone recommends me an album or artist I "take a look" at it: I listen to it. Though now that I think about it, I wouldn't say that in my other languages.
  - pbronez 2y ago
    I suppose one could say "observed" as a sense-neutral alternative to see / hear. Might be a worthwhile language shift, similar to using "they" as a gender-neutral alternative to "he" and "her". We usually talk about the inclusion benefits of neutral language. It can also be valuable by making specific terms more meaningful when used appropriately. If I know you usually say "they", then when you choose to say "he" I get more information -- there's a clear gender expression. Similarly, if you usually say "observe", then when you say "see" I know we're specifically talking about vision. Of course, it's an awkward transition. It's hard to get used to "they/them" and saying "I observed a delicious aroma" sounds like a robot impersonating a person.
    - blindgeek 2y ago
      It's notable that the majority of the people who would be "included" by the change to "more inclusive" language aren't offended in the first place. The sentence "I am watching TV" literally offended no blind person, evah. It is only sighted do-gooders who have the spoons to be offended by nothingburgers on our behalf. We're too busy dealing with stuff like, ... I dunno, landlords who refuse to rent to us because all they have is second story units and we might fall down the stairs. Yes this actually happened to me in 2000 or so, and I don't have enough faith in human intelligence to believe that it isn't happening today. We're too busy being oppressed by captchas and websites made by frontend devs who seem to care more about chasing JavaScript framework du jour than they care about accessibility. We're busy struggling against a built physical environment which has been designed for cars and not people. The supposedly non-inclusive language of "I watched TV" or "I looked at my browser's JS console" aren't even on our radar. I coined the term "Sapir-Whorf Stalinists" a few weeks ago to describe the sort of people who think that monkeying with language will magically make things better for marginalized groups. Here's Lee Atwater talking about the Southern Strategy: > You start out in 1954 by saying, “Nigger, nigger, > nigger.” By 1968 you can’t say “nigger”—that hurts you, backfires. > So you say stuff like, uh, forced busing, states’ rights, and all that stuff, > and you’re getting so abstract. Now, you’re talking about cutting taxes, > and all these things you’re talking about are totally economic things and a > byproduct of them is, blacks get hurt worse than whites.… “We want to cut > this,” is much more abstract than even the busing thing, uh, > and a hell of a lot more abstract than “Nigger, nigger.”
  - Lerc 2y ago
    This is how use of language concealed aphantasia for so long. When you use a word in a context similar to how another used it in that context there seems to be a presumption that the subjective experience is the same in that context. Given how we learn languages and words based upon encountering them in contexts, it makes sense that terms that we use in outwardly similar contexts reflect the subjective experience that each of us relate to those terms. We don't have access to another's subjective experience so I can see how it would encourage the assumption that we all perceive things the same way. There might be many undetected variances in perception akin to aphantasia lurking in us waiting to be discovered.
    - blindgeek 2y ago
      Here's the thing. We're talking about people who are the accessibility team for hCaptcha. They should at least have a figleaf of an understanding of life for blind people. The other problem we have is that online companies tend to be accountable to no one. Short of law suits, my friend who got banned from hCaptcha for "not being blind" has no recourse, because nobody is accountable.
      - rascul 2y ago
        Lawsuits are how that's solved in the physical world also.
  - webspinner 2y ago
    Yes that's my mother.
- RandallBrown 2y ago
  I'd bet that's exactly what happened.
jesterswilde 2y ago
Gwahahha, succinct. I run into this far too often. Being in places or doing things I (blind guy) "shouldn't be", thus, am not blind.
webspinner 2y ago
Yes because all of us are stupid according to hCAPTCHA!

soraminazuki 2y ago

The title kind of makes it appear far less of a problem than it actually is, because according to the article, hCaptcha made multiple rude and evidence-free accusations of lying despite the author actually being blind.

jerf 2y ago
Remember that from hCaptcha's point of view, by this point they've probably dealt with hundreds of other people claiming that they are blind when they really aren't, so their bots will work. This isn't a defense, just an explanation... but it is also an explanation of why the entire idea of "we'll not give blind people a way past the CAPTCHA but just give a pass to 'real' blind people so we can pass ADA", which is that it should have been transparently obvious that this approach is completely infeasible and unscalable. As big as Google, Facebook, or Amazon are, they would struggle under the load of trying to create a system for determining who is "truly" blind... and that's still true if we ignore questions like exactly what "blind" is anyhow. This shouldn't have gotten deployed and then become a problem; it should have been a 5 minute diversion in the meeting where it was proposed to analyze it's completely infeasible and never made it to so much as the design phase, let alone the deployment phase. If you had a system for completely accurately identifying characteristics like "who is blind" in the presence of extremely hostile attacks on the system, you'd have something far more valuable than the CAPTCHA system itself! The whole idea intrinsically depends on having a stronger solution to the problems CAPTCHAs are meant to solve than the CAPTCHA system itself provides... it's fundamentally a logically unsound idea.
- anotherhue 2y ago
  > If you had a system for completely accurately identifying characteristics like "who is blind" in the presence of extremely hostile attacks on the system, you'd have something far more valuable than the CAPTCHA system itself! You are unfortunately describing worldcoin.
  - KETHERCORTEX 2y ago
    Worldcoin? Government issued auth service is a viable option too. Just get some flag like "isBlind" in it. Disabled status is granted by the government after all.

garbanz0 2y ago

That smells illegal.

Spivak 2y ago

This has got to be an open-and-shut lawsuit if the author wants to pursue it. T&C doesn't shield you from the ADA.

lupusreal 2y ago

I hope AI stuff makes captchas completely obsolete soon. I am sick of them. The cure is worse than the disease.

edm0nd 2y ago
Captchas have been obsolete for the past decade plus. With solving services like DeathByCaptcha and AntiCaptcha, it takes seconds to solve them. It costs something like $1.90 per 1,000 successfully solved captchas using human typers and OCR. It can easily be rolled into your code with a few lines.
jeroenhd 2y ago
AI stuff is why CAPTCHAs exist. It's also why they've gotten so much worse the last few years. CAPTCHAs are going to get much worse before they're replaced by account paywalls or remote hardware attestation.
exe34 2y ago
AI are already much better at them than I am.
xdennis 2y ago
But surely, it's only going to get worse: it will force the de-anonymization of the internet. You already have to provide a phone number for many services. If websites can't trust that their users are authentic they will probably institute even more intrusive checks. I haven't been optimistic about the future of technology for a while now. :'(
- rvnx 2y ago
  In the future I think we will again go to "notarization"/"attestation" of the operating system / hardware. Essentially, the manufacturer of the device + operating system will generate a unique signature per each device, and web browsers will be able to access it. https://en.wikipedia.org/wiki/Web_Environment_Integrity https://en.wikipedia.org/wiki/Web_Environment_Integrity

Rastonbury 2y ago

Some captchas are getting pretty discriminatory, not everyone lives in the West and can identify the objects they are asking you to. Another recent one sticks out where they asked me to pick a shape as the same number of conoids on screen. If you ask people on a street what a conoids I bet a significant amount will give you blank looks Also at least now I know some people call those markings crosswalks

throwaway519 2y ago
[flagged]
ta1243 2y ago
Sorry I live in the west, what's a "crosswalk" Did you mean to say > not everyone lives in the USA Other things I don't have a clue about - a fire hydrant, yellow taxis, yellow buses (Obviously I do, because of American cultural imperialism through things like Captchas which mean the world has to understand American cultural touchstones)
- slater 2y ago
  Please enter your five-digit ZIP code
  - deleted 2y ago
    [deleted]
  - bux93 2y ago
    90210 (Cue theme music in mind's ear)
    - thebruce87m 2y ago
      That’s my zip code too, along with millions of others who live outside the US. Haven’t needed to use it for a while.
      - 2y ago

nerdponx 2y ago

Lesson 1 about competing with Google should be "don't be even more disrespectful to your users than Google is". Otherwise people will just use Google. Relying on the goodwill of a small number of "never-Googlers" to carry your business, in spite of the way you do business, is not a path to success. While hCaptcha trashes its reputation, the rest of the world will go on using reCaptcha and not giving the faintest whiff of a fart about hCaptcha's existence. (Side note: the spelling is "intentional", not "intensional". Think "intent" + "-tion" + "-al", not "in-" + "tension" + "-al").

isodev 2y ago

Why are captchas even a thing still? If folks want to scrape something or build an automation around something, then why not let them do it? They still have to respect the system they're logging in. Not to mention the privacy perk of not exposing your visitors to some captcha service with a dozen or more data subprocessors.

dewey 2y ago
Captchas are used for many things, and the reason they are still a thing is because they mostly work. Especially fingerprinting invisible captchas. Try having a login form without a captcha and you'll realize you are capturing 100s of users every day that require you to send out a "please confirm your email address" email for each of them for no good reason. > They still have to respect the system they're logging in. Your trust in people is admirable, but in my experience running anything on the internet you'll realize that intentionally or not people will bombard your system until it falls over.
- isodev 2y ago
  I think folks forget that we can add many of the safeguards a captchas provide as part of whatever "form serving app" is needed without torturing our visitors to prove they can count bicycles.
  - dewey 2y ago
    I think the times of the "count bicycles" type of captcha are already counted just because of the bad user experience. Now everything is about fingerprinting, as paying to get captchas solved by humans or AI is already used everywhere if it's worth it.
- nraynaud 2y ago
  they don't work, robots have a higher speed and success rate than humans.
  - dewey 2y ago

deleted 2y ago

[deleted]

devmor 2y ago

It's quite unpleasantly often that I hear stories about accessibility accommodations being removed by someone considering themselves the sole arbiter of disability.

jchw 2y ago

I hope we can end the CAPTCHA experiment soon. It didn't work. Phone verification isn't good either, but for as much as I hate phone verification at least it actually raises the cost of spamming somewhat. CAPTCHA does not. Almost all turnkey CAPTCHA services can be solved for pennies. Solving the problems of SPAM and malicious traffic will be challenging... I am worried it will come down to three possible things: - Anonymity of users: validating someone's real-life identity sufficiently would make it possible to permanently ban malicious individuals and filter out bots with good effectiveness, but it will destroy anonymity online. In my opinion, literally untenable. - Closing the platform: approaches like Web Environment Integrity and Private Access Tokens pave the way for how the web platform could be closed down. The vast majority of web users use Google Chrome or Safari on a device with Secure Boot, so the entire boot chain can be attested. The number of users that can viably do this will only increase over time. In this future, the web ceases to meaningfully be open: alternatives to this approach will continue to become less and less useful (e.g. machine learning may not achieve AGI but it's going to kick the ass of every CAPTCHA in sight) so it will become increasingly unlikely you'll be able to get into websites without it. - Accountability of network operators: Love it or hate it, the Internet benefits a lot from gray-area operators that operate with little oversight or transparency. However, another approach to getting rid of malicious traffic is to push more accountability to network operators, severing non-compliant providers off of the Internet. This would probably also suck, and would incentivize abusing this power. It's tricky, though. What else can you do? You can try to reduce the incentives to have malicious traffic, but it's hard to do this without decreasing the value that things offer. You can make malicious traffic harder by obfuscation, but it's hard to stop motivated parties. Either way, it feels like the era of the open web is basically over. The open web may continue to exist, but it will probably be overshadowed by a new and much more closed off web.

Telemakhos 2y ago
This doesn’t feel so much like the end of the “open web” as it does a rehash of USENET and email spam issues. Social media killed USENET, and email managed its spam issues thanks to filtering.
- 2y ago

RobMurray 2y ago

I am also blind. hCaptcha is the worst. Their stupid cookie expires so I have to go through their getting an email to set the cookie almost every time I encounter one. It's a horrendous UX, especially when using different devices and browsers. I imagine others just give up instead of dealing with the crap. They shouldn't use the word accessibility when their whole service is the exact opposite. The bots can probably solve them easier than blind people anyway, or they can outsource them to third world workers for next to nothing. E.G. Anticaptcha [0]: > Starting from 0.5USD per 1000 images, depending on your daily spending volume [0] https://anti-captcha.com/ https://anti-captcha.com/

rwmj 2y ago
Believe me, hCaptcha isn't much better even if you're not blind! They show me minuscule images which are barely distinguishable from each other. It manages to be much worse than reCaptcha, which is some achievement.
- tracker1 2y ago
  I'm not blind, but do have visibility issues. I can get by on my phone with maxed text size, etc. The pictures for hcaptcha are horrible... I keep having to zoom in and out. It's almost as bad as modals that flow off screen. It sucks more when you work in the space and take a lot of care to usability. It's not that hard most of the time.
nmarinov 2y ago
What's the best captcha regarding accessibility?
- burningChrome 2y ago
  None. There are no "best" version of captcha. I've worked on several large scale projects where captcha was floated and then quickly abandoned in favor of other methods like Honeypot or using other methods to weed out bots and other 3rd party agents. If you have to use captcha the least worst are probably reCaptcha V2 and hCaptcha for accessibility.

hyperman1 2y ago

I think, unfortunately, most accessibility options are not intended to actually be used. If you are a governement or bigco, accessibility is part of your baseline requirements. You must be able to say: Yes, we are accessible. Otherwise, the public will cause a stink. So you take your list of vendors, and remove any that don't say they enable accessibility. Vendors know this and make sure they say they are. Meanwhile, it is a hard to get right feature, only applicable to a small part of your userbase. Multiple disabilities require different affordances. No developer on the team really understands the actual requirement. The people requiring accessibility will go somewhere else, or grumble and make do. Neither will be detected on any metrics board. This combination promotes shelfware: Things you buy and put on a shelf somewhere but never really use.

miki123211 2y ago

As a blind person, I genuinely believe that hCaptcha, being as terrible as it is, is still the best solution among the ones that we can physically achieve in the world as it exists right now. Audio captchas don't work for people with hearing issues and/or who don't speak your n supported languages, where n is usually <10. I've had to help people out with these over the phone, it was not fun. Even for people for whom they do work, it's worth keeping in mind that bots can solve them by now, and so users whose activity looks too fraudulent, who are still given access to the visual captchas, have to be blocked from using the audio ones. I have also seen this happen. Text captchas are a non-option by now, they're very easy to solve with LLMs, and the way they have to be phrased makes it impossible to align LLMs not to solve them, like you can do with the visual ones. Google's ReCaptcha can get away with having no actual challenge for most users, blind or otherwise, but that's because they're Google, they do enough user tracking that they don't actually need a captcha. Google is the only company that can get away with this, and even for them, it doesn't work in all situations, even when the user fully trusts Google and has not adjusted any privacy preferences. Sure, you could stop using captchas entirely, if you're fine with receiving dozens of viagra ads on every single platform each day, abolishing all "contact us" and comment forms on the internet, having a significantly higher credit card fraud rate (which translates directly to higher prices and a much worse experience for consumers), and getting all your semi-public records and social media activity immediately scraped by shady companies and sold to anybody who expresses any interest. Unsurprisingly, most users are, in fact, not fine with this.

blindgeek 2y ago
> and getting all your semi-public records and social media activity immediately > scraped by shady companies and sold to anybody who expresses any interest. Public content on the Internet should be scrapable. That's what public means. The fact that my reddit posts were publicly available never bothered me. Even if they were going to be used to train some LMM. What does bother me is reddit locking up my posts and making exclusive deals with Google to train Google's LMM. Preventing scraping isn't good for the average user; it is good for the company that wants to take content created by said user, lock it up, and sell it to their buddies.

blindgeek 2y ago

And the very angry email that I (probably unwisely) just dashed off to support@hcaptcha.com: "So I've been trying to sign in repeatedly to set the accessibility cookie since last night. Every time I click the submit button, I get the useless error message "an error has occurred, please try again". My friend, who shares my roof and my static IP, got banned from hcaptcha's accessibility service last year for being too smart to be blind. And I suspect you all have banned our IP and not just his account. For the record, my static IP address is (redacted). See https://michaels.world/2023/11/i-was-banned-from-the-hcaptcha-accessibility-account-for-not-being-blind/ https://michaels.world/2023/11/i-was-banned-from-the-hcaptch... for his story. I have been broadcasting this to websites frequented by technically capable people: https://news.ycombinator.com/item?id=42171164 https://news.ycombinator.com/item?id=42171164 https://lobste.rs/s/qbkd0u/i_was_banned_from_hcaptcha_accessibility https://lobste.rs/s/qbkd0u/i_was_banned_from_hcaptcha_access... Please let your bosses know that I plan to pursue legal action against hCaptcha and/or amplify the truth to destroy its reputation in the public square. I will also be reaching out to websites who utilize hCaptcha, letting them know that the captcha provider they employ is refusing to provide reasonable accomodations to blind people. Whether it be with the force of law or the force of satyagraha, your bosses are going to get a message and we will win.

blindgeek 2y ago
And their thoroughly unhelpful reply: "Hi there, sorry to hear you're having difficulties! We have an alternative authentication scheme that you may prefer: https://www.hcaptcha.com/accessibility https://www.hcaptcha.com/accessibility You can sign up here: https://dashboard.hcaptcha.com/signup?type=accessibility https://dashboard.hcaptcha.com/signup?type=accessibility This lets you avoid the challenge altogether after registration. It is designed for users with any kind of difficulty solving the challenges. Thanks for reaching out, and hope this makes your experience better."
- mp3geek 2y ago
  Brave support here, tried to reach out to hcaptcha support and got the same auto response :|
2y ago

andrewaylett 2y ago

CAPTCHA: Completely Automated Public Turing test to tell Computers and Humans Apart. These things have one job. Any time they fail to identify a human, they have failed at their job. How they go about administering the test, and (to a large extent) what the human does in response, should be irrelevant. I know that's hard, no-one said the job was easy, and the companies developing them are the ones making claims about their efficacy. If you want to block 100% of bots, don't put your stuff on the Internet. If you want to block bots and allow humans then you're going to have false negatives. Failing to acknowledge them is dishonest. None of which stops me filling them out when I encounter them, but I don't have to like it.

throw_a_grenade 2y ago

If you're in Europe, consider filing GDPR complaint to your local data protection authority. One of the rights recognised in GDPR is right to rectify information about you, and it was clearly not afforded by the provider here.

mathfailure 2y ago

hCaptcha is worse, than reCaptcha. I pass the captcha (I am not blind and not using accessibility account) and get response like Your response to the CAPTCHA appears to be invalid. Please re-verify that you're not a robot below. (Reference ID: 4035128747213959) And you are given captcha again (passing which will have the same result). reCaptcha had similar issue, but choosing 'accessibility' would transform the captcha from visual to auditory one and passing it had no such problems. In the end I just gave up.

Pxtl 2y ago

Please just let my link some kind of government-backed ID to an email account and then clients can ask "hey government, is this email account a real human being in your country"? And government can say "yes" and they can go forward knowing that if I turn out to be a bot and they ban me it will be a huge pain in my ass because I've got to go through government enrollment process again.

neilv 2y ago

> I emailed back a day or so later, requesting an unban because, y'know, I actually* am blind, but they gave a pretty canned response of no, your account is remaining banned.* Do I understand correctly that hCaptcha has created an accessibility problem that's denying this blind person access to all sorts of Web sites? Is there an ADA angle here, for many customers of hCaptcha?

intunderflow 2y ago

reCaptcha is better than hCaptcha