Hacker News Reader

Comment by DrJosiah | Hacker News Reader

Hi! I work at hCaptcha (we handle the CF captchas), and to respond specifically: audio is inaccessible for those with visual and auditory processing issues, as well as being broken by ML techniques. Not to project, but we suspect this is why Google turns it off if your browser looks at all suspicious.

Another user mentioned the Privacy Pass solution: https://news.ycombinator.com/item?id=23902870

While Privacy Pass is not perfect, we are working towards getting better. I'm not in the product flow for accessibility, but if you have ideas outside of audio that you believe would be able to distinguish between yourself and a robot, I'd be happy to discuss via email to ensure that we can get a solution for you and anyone who can reasonably interact with a computer.

eta: you can email me directly at work via: josiah@intuitionmachines.com

eta2: http://hcaptcha.com/accessibility

View on HN

Audio captchas are considered broken completely (search for various papers over the past decade, including one from CMU), so it has limited usefulness only in a very narrow context in practice. I suspect this is a harbinger of things to come - as we close the gap on passing the Turing test, captchas are likely to get less effective, and we will need to transition to a very different solution for bot detection.

or, just let the bots be.

often it's easier to just use a website as api instead of using some broken xml nightmare that requires knowledge of the database tables.

If the concern is rate limiting then just rate limit the website. And if you don't like people operating websites with bots then I don't know, maybe stop making websites.

Easy proxying means rate limiting doesn’t really help all that much to defeat bots. And then if you do something like blocking or severely restricting something like Tor (the world's largest open proxy and hence, primary abusive traffic source; something which it would make sense to throw extra bot walls in front of), privacy and accessibility advocates jump down your throat.

This is a no-win situation. I’m not convinced it’s possible to have ones cake and eat it too, here. Someone upthread said “security, privacy, accessibility, pick any two”, and I have yet to see any evidence of a third option.

We offer privacy pass so that we don't force our users into the false dichotomy above. For our users it's a win/win situation

I think you do not understand why website owners use captcha. Website owners use captcha services, because doing so saves money for them.

Captcha will stop saving money, if the captcha becomes so ineffective that the short-term and the long-term downside (annoying users who are subjected to captcha) exceeds the cost saving ("cost" here is potentially many different things - it could be quality of service for normal users, it could be opportunity cost, it could be the cost of serving the traffic like network bandwidth or cpu or database capacity).

Yes there are subset of people with visual problems who also have auditory problems, that does not mean you should not support the ones with vision only problems.

Are there not "ML techniques" for visual captchas too ?

With more and more powerful models like GPT-3 coming along every few months, Even if the accuracy levels are less for visual over audio today how long do you think that is going to last ?

I believe they meant that audio captchas have become inaccessible to humans in general. Bots have gotten so good at audio captchas that the difficulty level has to be high enough that humans are also unable to complete them.

Visual captchas too can be quite very hard these days for the same reasons, there are many other ways to verify bot or human, many of them may not allow you to remain anonymous while doing so, pretty much any 2FA method could work for example.

I would say given the choice for a number of people the accessibility is more important than loss of privacy. At least it is choice they should have instead of shutting them off the internet.

Hi HCaptcha-er here. You don't lose all your privacy with our accessibility option. Also we always abide by DNT style protections even for accessibility. That being said our privacy pass solution is totally private and safe.

> Are there not "ML techniques" for visual captchas too?

There are.

> how long do you think that is going to last?

I don't know. So far it hasn't been difficult to recognize the garbage traffic when we take the time to look. And attackers always make it easier by releasing github source and / or announcing their results on Twitter.

Ugh. That accessibility login solution sounds awful, but at least it's available. I can definitely understand why you don't want to have an audio option, given that by all accounts they're next to useless.

Give it a try. It's so easy it feels like hacking.

Captcha submit requires two touches on iPhone 6S because the submit button will scroll out of view on first touch.

Do your devs or product people ever use your own product? That’s one of the first things I’d notice and fix.

I run android. Other devs run Android and recent iPhones. Someone may have an iPhone 6S to test and fix on, I'll check.

In the future, if you've got a bug that's preventing you from doing your thing, we have bug reporting instructions: https://www.hcaptcha.com/reporting-bugs

ETA: two different people have tested on Chrome and Safari on iPhone 6S locally, and can't reproduce. Please take a screenshot and provide more information to: https://www.hcaptcha.com/reporting-bugs if you want to get this fixed.

We test on iPhone 6s and it seems to work for us. Perhaps file a support ticket and we can take look?

Is this on safari?

Reply on news.ycombinator.com