Hacker News Reader

Comment by simongr3dal | Hacker News Reader

Cloudflare recently moved away from Google's reCAPTCHA to hCaptcha.

Announcement: https://blog.cloudflare.com/moving-from-recaptcha-to-hcaptch... Discussion on HN:https://news.ycombinator.com/item?id=22812509

View on HN

hCaptcha is the worst most buggy captcha service I have ever encountered. As a matter of fact digital ocean recently added that to their login screen and it made my life a complete nightmare. The fact I had to solve it everytime I wanted to login, I genuinely decided to leave their infrastructure and move to AWS regardless of the higher bill.

But I must give 100% points to DO support. Before leaving them I sent one last support ticket to DO with the recording my nightmare in a mp4 file and lo and behold they changed their entire login flow for me (1). I no longer see that and life is good again.

(1) https://imgur.com/a/GKJHhtT

Not sure how this is FOSS?

hCaptcha is annoying. I see it every time I open codepen and few other website.

hCaptcha is less annoying when using Tor than ReCAPTCHA at least.

Exactly my experience. And not just Tor, just about every datacenter IP address.

I found the tasks for alternatives (might be hCaptcha) hard to complete correctly even for a human.

Yes, and it made half the web unusable. Getting captchaed twice in 60 seconds is an immediate bounce from me.

What? The number of captchas is the same. And in my experience, hcaptcha is a heck of a lot nicer than recaptcha. It also works on Tor. This move from cloudflare will probably save me multiple hours of time per year, that I previously spent waiting for pictures of fire hydrants to load.

If I understood their blog posts correctly, the captcha rate should be the same - it's shown to you when Cloudflare detects that you need one, not when reCaptcha/hCaptcha decide. CF just has them show the captcha.

The amount of Captcha's you need to solve will likely go up if you previously got them but had a good enough ReCaptcha score to not need to solve their challenges every time. hCaptcha does not yet have something that makes one captcha solve bypass the following few captchas.

I get like 3-4 ReCaptchas literally every time I encounter one, so I have zero problems with them changing.

This. I chalked it up to aggressive Firefox settings.

I have not seen this at all. In my experience hCaptcha results in the same or equal experience that reCAPTCHA had. Anecdotally my pass rate on hCaptcha is actually higher (reCAPTCHA gets suspicious more quickly and often asks to solve more than one prompt).

Founder of HCaptcha here. Have you tried our privacy pass or accessibility features?

Can you please open source your frontend code? The net absolutely needs a captcha that has made a promise to not run tracking code, and sticks to that by providing transparency. Google is not doing it and has only increased the amount of tracking code. If you're doing things correctly the obfuscation of the data coming from the backend is what would be critical to keeping bots out, not the actual code administering the turing test on the frontend.

https://imgur.com/tyZnANQ

Firefox through a VPN and every site that uses hcaptcha throws this up and doesn't let me in.

You're the one who is responsible for this web cancer? You purposefully disable access to VPN users and then try to pass off a "privacy pass?"

Cloudflare is responsible for deciding you need a captcha...

This is exactly the position Google tried to put themselves in with reCAPTCHAv3, where they simply provide a “score” and websites now make the decision of blocking users themselves, absolving Google of any blame. If your captcha gives scores to real users that would cause everyone to block them, that’s on you.

Your privacy pass is useless. You ruined shopping for me and several others on niche e-commerce. So much that the e-commerce owners had to add my IP as a whitelist. I'm glad I buy a lot, otherwise me and them would be screwed.

Destroying people's businesses is not nice. That's why no one cares about security, "security engineers" don't test or measure the impact of their strict measures.

HCaptcha makes me do a lot more work to be considered a human, and I end up having to do it more often.

I absolutely love Cloudflares switch from Googles absolute shit of reCaptcha to the new hCaptcha. I still have to fill it out twice, but it takes like < 30 seconds to complete my action and get on with my life. With Googles reCaptcha I always wasted ~10 minutes (this is not an overstatement) and was sometimes still unable to do anything. I'm really grateful for hCaptcha as it somehow simply works.

Privacy pass (beta) has dubious privacy claims and does not work on (most?) mobile browsers because it requires a browser extension.

Why would I sign up for something from your service to get around your service? I'll just bounce and use one of your customers competitors.

I just close the tab when I see an reCaptcha checkbox. hCaptcha is fine, I can totally not see what everyones problem is with hCaptcha.

lol wut

Idem.

It's not FOSS though, is it?

I use hCaptcha on multiple sites and honestly, it does the job well. To those who claim it hurts business, yes it adds an extra step to the verification process but it also keeps you and the rest of my visitors safe.

It almost feels like that the inconvenience of using a multi-layered system equates to the people who want to get back to eating in restaurants while in the midst of a pandemic and will then complain if they catch Covid-19...

This comment was brought to you by Intuition Machines, Inc, Labeling the World.

Reply on news.ycombinator.com