Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It's a start. reCAPTCHA is a notorious pain in the arse for anyone whose browser isn't Chrome and for anyone who doesn't keep cookies. I'm not sure if hCaptcha will be better, but it's hard to imagine it being any worse.


By now, I almost immediately close a page with a reCAPTCHA, because the stream of buses, traffic lights, and cycles never seems to end when you're using Firefox. And then it says "too many requests from this computer" and refuses to continue.


I'm amazed Mozilla hasn't sued Google for discriminating against their browser - I also use Firefox and suffer endlessly using privacy tools. I can prove there are no more busses and I'm 100% right, but I can predict 100% of the time it'll say "please try again".

The pattern seems to be 2/3 'right' guesses. on sites like eBay, the captcha is broke on firefox. I complete it, and it says "you need to resubmit this form again", and reloads the entire page.

That's the cost of privacy; broken pages and refused access because Google says "NO!".

And businesses are okay with Google denying them money. I wonder if they did a cost/ben analysis if they find it worthwhile.

Thanks to Google, I've actually saved quite a bit of money, they lost out hundreds recently when their automated systems decided to refuse my transaction. Their loss and my gain.


>I can prove there are no more busses and I'm 100% right, but I can predict 100% of the time it'll say "please try again".

I frequently run into the same issue of having correct answers rejected, and have read posts from many others who experience the same. At some point I started intentionally picking random squares for the first couple image sets. Interestingly, it doesn't seem to end up taking any more submissions overall than when I try to pick the right answers from the start.

Plus, polluting Google's free work data set ever so slightly gives me a small amount of pleasure.


Google pays Mozilla to be the default search engine in firefox. This is Mozilla's main source of revenue, so I doubt they will sue.


I wonder why they don’t negotiate with Msft to use Bing or even DDG instead. Seems... incredibly odd... to put oneself in a position where a third party is directly antagonizing your users, reducing your user satisfaction and likely dramatically increasing churn, but you can’t do anything about it because that same party is your main source of funding.

(Disclaimer, I work at msft. Nowhere near this though).


I'm not sure why you think they don't negotiate with other search providers.


The fact that they’re still on google even though google is screwing over their userbase? I don’t use Firefox because of how difficult it makes captcha. There are others like me.

If they are negotiating with other providers, they certainly aren’t doing a very good job of it.


Yahoo was the default from around 2014-2017 in the United States.


If I recall correctly, the last time I checked Google's support for Mozilla was in the hundreds of millions per year. I would be shocked if DDG could afford even 10% of that, even as an investment they expected to recoup through additional advertising revenue.


> And businesses are okay with Google denying them money

Make sure they know. I write to sites and tell them they just lost a customer because Google doesn't give a shit. I've gotten replies from smaller outfits that had no idea what was going on.


I think their cost analysis would mark you as a bot that got stumped by the captcha and thus a bet benefits. (Sales to bots are worse than not selling, else they wouldn’t implement this at all)


I have managed to successfully solve the audio CAPTCHA before (even though the pictures are impossible to solve), although now they must have disabled it because it doesn't work.


Well said, could not have expressed it any better. I do the same and refuse to use a website or service, that tries to put me through this garbage.


Does it help if you change your user agent?


On the other hand, their new HCAPTCHA is a notorious PITA for anyone, including those whose browser is Chrome and keep cookies.

Browsing an "I'm under attack"-mode website behind Cloudflare has been super annoying for me since last week. To the point that I usually close the page when I see a HCAPTCHA. Their visual challenge is harder to navigate than reCAPTCHA, and because this is their business model I suspect they have incentive to make it easier.


Why do you assume that a good CAPTCHA should positively discriminate Chrome users?


I don't. I assume a good CAPTCHA should reduce the size of the subset of users who must solve hard challenges as possible. The old reCAPTCHA usually requires only one click, no visual challenge for me. I don't like the fact this is because I use Chrome and logged in my Google account, but with HCAPTCHA I'm just not seeing any chance they make the experience better, no matter what browser I use, they just don't want to make my experience better, their business model is based on me suffering.


I know this is a common complaint, but I personally have no issues on both macOS and iOS Safari.


Perhaps the privacy problem for you is then one of the following:

- Ad blocking extension not installed or rules too lax - Script blocking not enabled - no VPN used - stores tracking Cookies

If all of those do not apply to you, I would feel discriminated against by Google, even more so, than usual.


To address each of your points:

1. I do have an ad blocker installed, but it's not very aggressive.

2. All scripts are enabled. I already have trouble with some sites due to my fairly lax ad blocker.

3. I do not use a VPN (since it just transfers who is able to see my traffic from one party to another). Additionally, virtually every service provider penalizes VPN IPs to the point where it's probably not worth the hassle.

4. Not sure what you mean by "stores tracking Cookies".

---

> If all of those do not apply to you, I would feel discriminated against by Google

I do not agree with that (mostly because of point 3). The reality is that VPN traffic is significantly more "spammy"/bot-filled than non-VPN traffic. It's a perfectly rational and justifiable way to protect sites (albeit ReCAPTCHA is of dubious effectiveness).


I will not arguing against protecting ones website from bots, nor am I saying, that VPN traffic is not spammy in practice. Up until that point I am with you. However, making use of ReCaptcha is certainly not an ethical and therefore not a justifiable way of doing it.

Doing all of the stated things these days has become a minimum for protecting your privacy online. The current situation is a quite bad for privacy conscious people. Even if we only trust first party scripts and do not allow them being loaded from a subdomain, which actually has all the third party scripts again, we still face issues, for example fingerprinting.

I can only laud websites, which can be used completely without third party scripts or perhaps even without scripts at all, making sure it all works with REST, offering alternatives, when scripts are blocked.

It's good to see some "competition" in this area, even, if I do not trust cloudflare either. More competition means less Google monopoly. Hopefully in the long run it will lead to better solutions for casual users.


You probably browse while logged in to your Google account. Right?


Yes.


The hCaptcha website states that whoever publishes it will get paid for the data labeling work users do.

Not to wax cynical, this seems like it might not encourage better behavior in every possible scenario.


I doubt it's enough money to tank peoples' traffic over it.


I'm quite sure you're correct. When stacked against however much Google was going to charge (I assume more than zero), Cloudflare's incentives seem pretty clear to me.


Yeah....In the article, it says that Google wanted to charge millions of dollars and that Cloudflare did not think hCaptcha trying to pay them was sustainable, so they agreed to pay hCaptcha a large amount, but only a fraction of what Google would charge.


How can someone demonstrate this claim?

reCaptcha is wildly sophisticated under the hood[1]. I use it on all three major browsers and find the number of challenges varies from 0 to 4: sometimes it says I'm verified without doing anything, other times I need to go through 4 screens.

I would love to see someone put some numbers behind this claim, because I think it is false.

[1] https://www.blackhat.com/docs/asia-16/materials/asia-16-Siva...

EDIT: Are you downvoting because you don't like reCaptcha, or because you can't (or won't) set up an experiment to demonstrate this claim and prefer to just jump on the bandwagon?


I've experienced reCaptcha simply looping forever. After solving 5 or so screens, I give up and hope that reloading the page works. If not I usually switch to Chromium, which doesn't even get a single puzzle, just verified.

That is my repeatable experience as the end user.


Same here. It seems to randomly freak out and block firefox.

I get why Firefox won’t sue Google. I wish end users would.


My heavily adblocked FF has a lot of trouble with recaptcha, while the Chrome instance that I only use for logged-in Google and LinkedIn doesn't. It seems like there are enough moving parts that it would be hard to figure out why our anecdotes are so different.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: