Hacker News Reader

Comment by GrayShade | Hacker News Reader

I've recently started using their DNS service and I've been using 1.1.1.1 for a couple of years now. I think Cloudflare has done more for the Internet than a lot of other large companies, and I'm inclined to trust them regardless of what the sr.ht founder says.

Their CAPTCHAs are annoying, though, and I wouldn't miss them an ounce if they went away.

View on HN

I feel like I've single-handedly trained their AI to identify buses, boats, and planes at this point.

I've never gotten planes. Buses and boats are very rare (for me).

I mostly get crosswalks and traffic lights. I occasionally get mountains, motorcycles, and bicycles.

You don't get them because I've done them all!

The CAPTCHAs are a per-website setting that individual webmasters set (or, more likely, forget to set).

As an end user, I agree they are annoying. These two things may or may not help (hCaptcha is the engine used by Cloudflare*):

1) You can set an accessibility cookie that should be good for a while: https://www.hcaptcha.com/accessibility

2) There is also the Privacy Pass beta, which lets you redeem CAPTCHA solves for "tokens" that can be used for later CAPTCHAs https://www.hcaptcha.com/privacy-pass

But yeah, hCaptcha is really annoying, especially compared to the auto-solve of reCAPTCHA when you're logged in to a Google account.

* Cloudflare switched to hCaptcha in 2020: https://blog.cloudflare.com/moving-from-recaptcha-to-hcaptch...

The CAPTCHAs are probably over-applied by people who use the defaults, but they're absolutely necessary for some sites, especially e-commerce. The alternative would be flat-out blocking requests that trigger the CAPTCHAs. An absolute shitload of traffic on the Internet is the abusive sort, and lots of that's aimed at sites that accept CC payments. Used correctly, CAPTCHAs mean you don't have to blackhole as much traffic, so actually increase the fraction of people who can reach your site, versus some other world without them where you'd just be forced (by costs & risks of dealing with abuse) to drop those requests.

If your problem is credit card fraud you can simply enforce 3D Secure (which offloads liability) for requests that are considered risky. The customer can then choose to either use a 3DS-supported card or complete a captcha/etc.

Reply on news.ycombinator.com