eatbots

5 ms·

1.
Browser agents have virtually no guardrails(hcaptcha.com)
13 points by eatbots 11mo ago|1 comments
2.
how hCaptcha stayed up when Cloudflare and Google went down(hcaptcha.com)
28 points by eatbots 1y ago|4 comments
3.
by eatbots 2y ago
Reported this exact bug to Zendesk, Apple, and Slack in June 2024, both through HackerOne and by escalating directly to engs or PMs at each company. I doubt we were the first. That is presumably the reason they failed to pay out. The real i
4.
by eatbots 3y ago
If you report the website/sitekey to hCaptcha support it'll get banned pretty quickly.
5.
by eatbots 3y ago
hCaptcha tested popular detectors on confirmed LLM and human output. No public AI text detector scored better than random chance.
6.
How Well Do AI Text Detectors Work? (Benchmarks)(hcaptcha.com)
16 points by eatbots 3y ago|2 comments
7.
by eatbots 4y ago
hCaptcha has completely passive score-only modes. When to challenge and how hard is up to the site.
8.
by eatbots 4y ago
This is entirely configurable by the site owner. hCaptcha has entirely passive score-based detection, 99.9% passive mode, and more aggressive options as needed. (disclosure: work there)
9.
by eatbots 4y ago
No: enterprise customers like that pay hCaptcha. https://www.hcaptcha.com/enterprise
10.
by eatbots 4y ago
This is not what empirical measurements show. It is referring to a minimum internal benchmark, rather than what actually happens. (source: work there) If you're getting shadow banned somewhere, it is typically either the site itself or
11.
by eatbots 4y ago
Like any attestation scheme, it doesn't prove anything about the humanity of the button-presser, only that software, hardware, or flesh triggered an action in iOS. hCaptcha's announcement goes into a bit more detail on the tradeof
12.
Humanity Verification: The First 3k Years(hcaptcha.com)
8 points by eatbots 4y ago|0 comments
13.
by eatbots 4y ago
Reducing challenges to real people is everyone's goal, including the goal of everyone working on modern CAPTCHA / bot mitigation platforms.. And no one will ever succeed at bringing them to zero. Perennial favorite explainer on th
14.
by eatbots 5y ago
Vast majority of traffic from Tor IPs is abuse, which makes it challenging to deliver a good experience for the handful of normal users mixed in there. You might be interested in one approach we've been working on for this: https:&#x2
15.
by eatbots 5y ago
hCaptcha really doesn't care who you are, and has no incentive to do so. Pretty different economic model than an ad seller like Google. People who build their own generally end up switching to a service like hCaptcha once they start ge
16.
by eatbots 5y ago
hCaptcha is in fact tested this way, and has pretty consistent accuracy across hundreds of countries: https://www.hcaptcha.com/post/do-captchas-really-discriminat... (disclosure: work there)
17.
by eatbots 5y ago
Actually, no. hCaptcha has always been very privacy-focused, so in this case there are technical safeguards available: enterprise customers can pre-blind all data on their end, meaning hCaptcha gets no PII at all. (disclosure: work there)
18.
hCaptcha is not affected by log4shell (Analysis)(hcaptcha.com)
3 points by eatbots 5y ago|0 comments
19.
by eatbots 5y ago
As a fan of ProtonMail, will just add a few points: Every popular online service today is being continuously attacked. Bad actors get a lot of economic value from credential stuffing, account takeovers, and fake registrations, especially on
20.
by eatbots 5y ago
This is not actually true: every relevant aspect is different from a privacy perspective, both technical and legal. Looking only at the technical differences, hCaptcha lets enterprise users like Proton locally scrub any info like IPs prior
21.
by eatbots 5y ago
Yep. https://www.hcaptcha.com/why-captchas-will-be-with-us-always (disclosure: work there)
22.
by eatbots 5y ago
This is under the control of the site with hCaptcha, so you'll tend to see more variety in difficulty levels depending on their settings. There will always be some individual variance, but when we've tested this people always solv
23.
by eatbots 6y ago
Our system is indeed designed not to leak detections in real-time. By contrast, with reCAPTCHA you can simply sign up and get a bot score, which makes it trivial to break. This limits options for the free version they tested, as by design i
24.
by eatbots 6y ago
This was an implementation issue that bit them briefly at launch, and is now resolved. hCaptcha is quite a big supporter of privacy, and has been coordinating closely with ECI. (source: work on hCaptcha)
25.
by eatbots 6y ago
Works better at stopping bots, costs less than reCAPTCHA Enterprise since it doesn't need to store your browsing history for the last decade. (disclosure: work there)
26.
by eatbots 6y ago
We'd be happy to help, just drop us a line. The enterprise version is probably what you want: includes a "99.9% passive" mode where most people will never see a challenge unless they look like an attacker, meaning you can lea
27.
by eatbots 6y ago
This would be a reCAPTCHA: there were no parking meter questions running on hCaptcha yesterday, from a quick check.
28.
by eatbots 6y ago
hCaptcha engineer here: this is an issue with Google's approach, not all visual challenges. Our challenges have average solve accuracy within 1% when comparing users in major African countries vs US users in our user testing. Nigeria d
29.
by eatbots 6y ago
Please read the second line at the very top of that page: "Not Applicable to Third Party Websites. Please note that this Privacy Policy does not apply to any website, offering, product or service of any third party, even if it links to
30.
by eatbots 6y ago
Proof of work by itself is nearly useless, unfortunately. Compute is cheaper than people. This is one reason why CAPTCHA services will likely be with us always. As someone working in the field, I also doubt your claim "will prevent 99.

More ›