Hacker News

I'm not blind, but do have visibility issues. I can get by on my phone with maxed text size, etc. The pictures for hcaptcha are horrible... I keep having to zoom in and out. It's almost as bad as modals that flow off screen.

It sucks more when you work in the space and take a lot of care to usability. It's not that hard most of the time.

None.

There are no "best" version of captcha. I've worked on several large scale projects where captcha was floated and then quickly abandoned in favor of other methods like Honeypot or using other methods to weed out bots and other 3rd party agents.

If you have to use captcha the least worst are probably reCaptcha V2 and hCaptcha for accessibility.

Brave PoW captcha maybe? Because it requires no input/interaction from the user.

This is a problem so chronic across so many fields that I wish there was single term to describe it.

User POV :"Wow, provider is a really shitty entity and had no respect for my legitimate problem."

Provider POV: "We get a huge number of illegitimate claims identical to legitimate ones regularly, the system would collapse if we didn't do heavy triage, the problem is the level of abuse, not a moral bankruptcy on our part."

I suppose "this is why we can't have nice things" captures some of it.

> As big as Google, Facebook, or Amazon are, they would struggle under the load of trying to create a system for determining who is "truly" blind... and that's still true if we ignore questions like exactly what "blind" is anyhow.

In several countries, the government issues certificates of blindness [1] which grant access to certain extra types of support. We don't want severely vision-impaired people being forced to drive, after all!

So there are legal standards for what exactly blind is, and certificates.

The question is whether tech companies are inclined to hire enough people to wrangle the paperwork involved in checking such certificates, worldwide.

[1] https://www.mass.gov/info-details/benefits-for-people-who-ar...

> something far more valuable than the CAPTCHA system itsel

In terms of CAPTCHAs being valuable – the other day I couldn’t for the life of me solve a captcha. It was one of those “Solve the implicit question in the picture” kind where it can be hard to tell what it’s even asking you to do.

So I took a screenshot and put it in chatgpt. Got it right immediately.

The real detection mechanism is that you’re moving your mouse, thinking, and generally being slower than a bot anyway. The captcha itself is just a pointless annoyance.

I am perfectly happy with having to prove that I am blind to get my bus pass, but if It was necessary to access a website I would just not use that site. Lets hope it never gets that bad. There's always Anticaptcha to fall back on, but I hate their business model.

What is your suggested alternative?

Audio captchas are inherently discriminatory to those with hearing issues or those that don't speak the 5 supported languages. They're also somewhat easy to solve with ASR models now. Text captchas are incredibly easy to solve with LLMs.

The only other alternative I see is some incredible tracking / surveillance machine (think an actual non-browser app that you have to run on your computer), but is that really what we want?

> If you had a system for completely accurately identifying characteristics like "who is blind" in the presence of extremely hostile attacks on the system, you'd have something far more valuable than the CAPTCHA system itself!

You are unfortunately describing worldcoin.

I distinctly remember a captcha which asked me to identify fire hydrants. Some of the pictures were hydrants, while others were standpipes. These are different things, and I answered accordingly.

The service refused to acknowledge my humanity until I relented that a standpipe was a hydrant. If at some future date any of us burn to death due to an automated fire truck that misbehaved due to this, we’ll know why.

Unfortunately, even understanding these things, on a shared connection it might take you literally two or three minutes of captcha work before Google recognizes your personhood.

Am I identifying the boxes wrong? Am I doing it too fast? Where do "Stairs" begin and end? Does a motorcycle include its rider? Or is Google just fucking with me and failing me on purpose?

My workplace had a period this year where captcha was put into the cashier checkout process.

And audio Captchas are in English. I suppose blind people who don't speak English or have any kind of hearing difficulty don't deserve accessibility.

Other things I don't have a clue about - a fire hydrant

Even within the United States, fire hydrants vary greatly from city to city.

I remember the first time I moved to a city that had those little squatty dark blue ones. I thought they were water main access points.

It's interesting to see so many people on HN assessing that captchas are biased toward American culture. Very frequently I get captchas that include things I don't know, and when I look them up, they turn out to be Indian in origin.

Maybe the standard international signs are more easily recognised by machines anyway, but if not it will be interesting when Google and others start needing Captcha help.

Americans will need to learn what speed limit, parking prohibition and pedestrian crossing signs look like in the rest of the world, as well as realizing buses and taxis come in more colours.

You don't think you could identify yellow buses without cultural knowledge?

I think simply knowing "yellow" and "buses" would suffice.

This can't be right, I have been told over and over again that America does not have any culture.

Now it's being used to push imperialism through captchas of all things?!

I feel like all the non-US or non-Western or however you want to categorize the 'rest of the world' should be striving to use free-range local culturally-appropriate captcha services if this is true.

It's easy to blame the colonizers, but what about the local artisanal websites who give the colonizers/invaders a voice by integrating their captcha services?

We really need an 'international-divorce' to put these issues to bed once and for all.

Please enter your five-digit ZIP code

Is a coach a bus? Honestly, I'm not sure what makes them different, if you pressed me I think I'd say a coach has luggage compartments underneath. A UK coach is not a bus... although Megabus run mostly coaches, and Stagecoach run mostly buses.

Is a scooter a motorcycle, what about a pedal-and-pop, an ebike? Is the backbox (rear carrier) part of the motorcycle?

Is a single light at a junction, ahem intersection, a traffic light? Is the outer-container part of the "light"? What about the lights for pedestrians, are they part of the traffic light?

Are house steps, that don't carry you to a different storey, still stairs? Is a single step also stairs?

Are fire hydrants always red?

So, yeah, usually I just leave the website and come back to HN.

[flagged]

[flagged]

> To this day I don't know how much of the object I should be selecting? Also what is a traffic light? Is the pole part of it or not? Motorcycles seem to be hard too.

I have always assumed this was purposefully ambiguous. The right answer is whatever a majority of humans will answer when presented with the same picture.

If you think you're failing the captchas because you're doing them wrong, think again. Google captcha intentionally fails you a couple times if they don't have enough tracking info to determine that you're legit. So you solve the captcha correctly but are still lied to that "you've failed to solve the captcha, try again".

That and the "fading images slowly to pretend like you have bad internet" thing. Disgusting behaviour

I'm never that consistent and usually get through. I think they are looking at things like mouse acceleration, smoothness, etc. rather than the actual answer to the questions.

Sure, but you can imagine pretty easily what a ‘conoid’ would be, right? ‘Sphereoid’ would be something sphere-like, ‘mongoloid’ is something mongol-like, ‘freakazoid’ is something freaky…

it’s pretty clear from context that ‘conoid’ means ‘like a cone’ isn’t it?

Using the touch pad to long-press on the text "conoid" in my browser brought up the built-in dictionary definition on macOS:

> conoid | ˈkəʊnɔɪd | mainly Zoology adjective (also conoidal | kəʊˈnɔɪd(ə)l | ) approximately conical in shape.

> noun a conoid object: her hull was a conoid, tapering towards the bow.

In the UK some crosswalks have cones on the bottom of the box where the button to wait to cross is, and OP mentioned crosswalks in the final sentence. Maybe it's just too late for me right now, but that's what my brain assumed, but the "same number of shapes as" thing was not enough context!

the cone on the bottom spins when you have the right of way.

> A conoid is a ruled surface whose rulings are parallel to a plane (called the directrix plane) and intersect a fixed line (called the axis of the conoid) (Gellert et al. 1989, p. 202). Examples include the circular conoid, helicoid, hyperbolic paraboloid, parabolic conoid, Plücker conoid, right circular conoid, Wallis's conical edge, Whitney umbrella, and Zindler conoid. If the axis is perpendicular to the directrix plane, the conoid is called a right conoid (Gray et al. 2006, p. 436).

https://mathworld.wolfram.com/Conoid.html

so, a surface with stripes - example https://pxhere.com/en/photo/1366651

I live in the US, English is my only language. I could probably guess what a conoid is, but I don't actually know (until reading these comments).

recaptcha audio challenge is just a few words (in English) that you have to enter. Might be easier in some circumstances? You can press CTRL to repeat the audio.

Things that look like a con?

>But on the internet the answer to „what is a conoid“ is just a web search away.

When I search, the whole first page of google is essentially "things that are shaped like cones", I have no idea what that would be in response to one of those image captchas that show traffic and buildings.

> But on the internet the answer to „what is a conoid“ is just a web search away.

Not when it's your search engine that's asking you to identify conoids.

I got mathematical surfaces like https://en.wikipedia.org/wiki/Conoid To get the correct image I had to search conoid street. Anyway, I guessed they were those red cone shaped things that people put on the street and I'm not sure how they are call even is Spanish (probably conos or balizas).

Google "conoid" and you'll get a bunch of pictures of shapes that are curved in different ways. I assume the captcha was talking about things that have a similar shape to a cone, but I don't think you'd get much of a clue from Google.

> A conoid is a ruled surface whose rulings are parallel to a plane (called the directrix plane) and intersect a fixed line (called the axis of the conoid) (Gellert et al. 1989, p. 202). Examples include the circular conoid, helicoid, hyperbolic paraboloid, parabolic conoid, Plücker conoid, right circular conoid, Wallis's conical edge, Whitney umbrella, and Zindler conoid. If the axis is perpendicular to the directrix plane, the conoid is called a right conoid (Gray et al. 2006, p. 436).

https://mathworld.wolfram.com/Conoid.html

You know, that's a good point, and it hadn't occurred to me. For the overwhelming majority of blind people, language like "looked at" is just metaphorical. I mean, all language is symbolic anyway. The map is not the territory and the menu is not the dinner. Some of us are taught very young to use common terms like look in that kind of a metaphorical way. Partially so that we fit in and are comfortable with the rest of sighted culture. And then once in a great while, we get condescended to for it. There's a really good example of this in the second season episode of DS9, The Alternate.

``` ODO It was a dilemma for me. I'd never seen anything like these creatures either.

     MORA
   "Seen" isn't really an appropriate 
   description.  He had no eyes per 
   se...

     ODO
   I was only trying to describe it in 
   simple terms...

     MORA
    (ignoring that)
   He had never perceived anything like 
   us before... go on...

I can pretty much guarantee that every blind person has had a condescending, patronizing douche canoe like Mora in their life at least once.

I'd bet that's exactly what happened.

I believe that 0 will be a higher number next year. And an even higher the following year.

Cryptocurrency micropayments have been proposed and even attempted as a solution to various problems. Hell, there's also Hashcash, an early proposed anti-SPAM measure for e-mail using just proof-of-work. (Since this is just burning CPU though, it probably isn't effective in the modern world of most people using low-power mobile computers and many SPAMers having access to cheap very high power computers. Might serve as a good hurdle for people trying to implement malicious bots, but it will eventually become useless if it is shown to be effective IMO.)

I'm skeptical though. It puts a literal price on abusing a service, but how do you set that price? Is there a guarantee that there's a value high enough to meaningfully disincentivize SPAM but low enough that users, especially users in areas that may have an economic disadvantage, are able to pay it?

That's on top of the other practical problems, such as actually implementing it. I mean, if someone implements it and tries to solve the usability issues involved I would be open to this future, but as it is now, cryptocurrency has disappointed me. In a world with increasing scrutiny towards credit card processors, I was hoping that the silver lining would be that cryptocurrency could at least help mitigate some of the concerns, but there are just too many hurdles right now. (Some of them may be caused by regulation, but to be fair, I think at this point it's hard to blame governments for trying to regulate cryptocurrency exchanges. I'm not happy about silly KYC policies or anything like that, but I am not surprised at all.)

This sounds like the same argument that was made for about 10 years (2000 to 2010) that micropayments would save traditional (print) media in a digital world. It didn't work due to market fragmentation and friction to make a payment.

And, the reality of your fancy idea is that normie users would turn away if they made a mistake on the CAPTCHA and were suddenly presented with a screen "charging" them one pence.

Although solving a captcha can be translated into a monetary cost (often the cost of labour for a human in a clickfarm to solve it for you), the nice thing is that it's still "free" to solve normally.

If you switch to direct payments that are still affordable for routine use by your poorest users, then your rich adversaries can afford to generate orders of magnitude more spam (until we solve unequal wealth distribution globally).

Also, the cost of using a postal service nominally covers its operating costs. The cost of actually transferring a spammy HTTP request over the internet is negligible, but the costs imposed on its receiver are less so (i.e. the cost of responding to it (cpu/ram/disk/bandwidth), second-order costs of lowering the quality of the service for everyone else, etc.).

> The postal service also has costs

I don't know about you but even with this cost about 90% of the physical mail I receive is junk mail.

> Sensible ones, if every spam email or login guess costs even 1 penny it becomes prohibitive for most fully automated spam applications.

Do you have a solution for transaction costs? How do you pay a penny without having to pay more than that for the transfer of funds?

If you expect 99% of normal internet users to maintain a crypto wallet of any kind just to access certain websites—even leaving aside the actual cost—you're going to be sorely disappointed.

Snail mail is a hilarious example, given that spammers are the only ones willing to pay the fees.

Email kind of solved its SPAM issues, but it came at great costs. It's possible but quite hard to run your own e-mail server; if you're not on a major provider, the possibility is high that a major provider will at some point have deliverability issues to or from you due to automated anti-SPAM measures. The degree of difficulty with participating in the network does somewhat degrade its openness in my opinion.

If anything works in the favor of email it is that email is not published. It is not necessary very private inherently, but it is at least not a system where things get broadcasted publicly. IMO this limits the value of spamming people over e-mail: you have to send a very high volume of e-mail to SPAM effectively over e-mail, and this high volume use pattern is not something that ordinary users will ever engage in, so it's easy to at least separate out "possible SPAM operation" versus "guy sending email to a friend". (I'm not saying that systems are necessarily perfect at distinguishing one from the other, but at the very least it would be hard to mistake the average Gmail account for being part of a massive SPAM operation. The volume is just too low.)

I hope the open web survives, but if e-mail is any kind of sign, it's not a great one in my opinion.

Email hasn't actually fixed spam issues, it's just mitigated a big chunk of them. But I know for a fact that I still mark emails in my inbox as spam on a regular basis, and still dig legitimate emails out of my spam once in a while.

Define modern? I worked adjacent to the web-scraping tech at Jet.com and they managed to beat a lot of the CAPTCHAs even in 2016.

Yeah but filtering out mindless bots is even easier than loading a bloated mess of JS: a simple form question that you believe 100% of the valid users will be able to answer should be good enough to stop almost all of those low-level bots. I use that approach all the time.

Some day this luck will run out, but for larger entities that experience targeted malicious traffic it's never really been a viable approach.

That I think is just to try to prevent scraping, probably mostly from people training AI models. I don't really think anti-scraping mitigations are a good idea and I'm hoping that problem some day solves itself.

Actually, I oversimplified. In most cases you don't have to pay $.01 per CAPTCHA. It's usually a fraction of a penny per CAPTCHA.

So basically it's good enough to protect something that is arguably barely worth protecting. I don't find this compelling. Protecting things that barely need it is already easy using existing techniques.

The endorsement and verification would need to be continuous, or else the anonymous users will sell their accounts for the value of the accrued positive reputation. I.e. what people already do with Reddit accounts that accrue a lot of karma.

> Are there any highly developed nations that allow complete strangers with any nationality to buy and use a mobile phone without showing a national ID? I don't know any, or they will all soon be gone.

I regularly (1-2x per year) buy prepaid SIMs in Canada, USA, and Japan. None of them require an ID and I often even pay cash.

I'm sure you are right that they'll eventually be requiring ID, but you are wrong to imply that these countries aren't highly developed.

It's not the average person's job to make sure that the world isn't fucking them raw. People have limited attention and limited time, not everyone can care about everything.

Nobody else is going to step in and hold the line when it comes to digital privacy rights. It's on people like us who care. This is why organizations like EFF need to exist.

No, you're describing what the California tech echo chamber wishes an "average normie" was, i.e., stupid and compliant, and what they're always aggrieved never really exists in practice, having managed to inculcate only some moderate learned helplessness over time, and with "stupid normies" constantly attempting to fight back via law and politics.

> Are there any highly developed nations that allow complete strangers with any nationality to buy and use a mobile phone without showing a national ID?

Canada maybe? [I'm 80% sure that] Public Mobile will sell you a prepaid sim card at the counter. You could pay cash, and set your caller ID to a fake name.

If we're talking about mobility plans, the identity requirement is more about the credit check they might want to do than anything else.

> why don't we see HN crying about the need to show a national ID ... when buying a mobile phone?

Mmm, very possibly because there are at least a few ways to get a phone without using any ID. I picked up a used phone about a year ago, and use Tello. Tello had 0 info on me for years, only an old UPS box that I got the card delivered to. I eventually gave them my first name so Caller ID was correct, but short of that or putting in a correct address if you want 911 support, there's no reason to need any valid info with them. They don't do credit checks, just prepay.

> The solution is secure boot plus attestation That's the second option they presented "Closing the platform". The issue with all these options is that it consolidates power, and thanks to already partially consolidated power, any option selected will, by necessity, obligate everyone to partake, whether or not they are ok with it.

> The average normie user does not care about anonymity, nor privacy, on the Internet.

It's true that often "normies" don't care (or at least think they don't care, but that's a completely different point I don't feel like trying to make), and it's also true that often "normies" don't want the status quo changed. But often "normies" also ignore when people are kidnapped due to their heritage being revealed. Is it acceptable to actively create a hostile environment for people already disadvantaged? Do we gain something worth their safety? Who gains from this higher level of scrutiny?

If we look at the smaller web, most sites never get enough traffic to be under active threat, and passive threat is easy enough to quell using honeypot forms and questions. Maybe the "normie" internet is the problem. Passive people passively consuming. "Normies" love watching stolen content, and praise thieves for harassing anyone who points out that what their doing is wrong. "Normies" enjoy watching someone livestream themselves flying down a highway at 100 mph over the speed limit.

I think maybe we should acknowledge that what we're defending with things like hCaptcha is not actually worth defending. Maybe the "normal" internet does need to be deprecated over "small" internet? We did pretty good before with things like Wikipedia. The "small" internet from before had a lot of chaff, but good things have grown from it, and a lot of it still exists as a "small" internet. Maybe it's ok that we have a lot of "crap content", so long as the internet can keep changing?

Two things:

- I don't believe there is a general solution to this problem, but that won't stop people with lots of money and influence from trying to find a general solution. Especially one that is cheap. I still hope for the least user- and ecosystem-hostile approach among the flawed approaches to win. (I guess of the ones I listed, the one that bothers me the least is having more policing of the service providers.)

- CAPTCHAs from static content are almost assuredly for anti-scraping measures. I think anti-scraping measures are mostly pointless and antithetical to an open web in the first place, but, an effective anti-scraping measure kind of has to work off of reputation, because getting access to a very large number of IP addresses isn't free, but it doesn't cost that much (especially if IPv6 is on the table.) I personally doubt it has much to do with server load in most cases, but maybe I am wrong.

What's is the play by the spammers here? Is it a direct attack on your website, perhaps because they were competitors? Or are they hoping that 1% of spammed email addresses will accidentally verify their email?

I hope the other lesson was the good email verification hygiene of making the user take an affirmative action and click a "verify email" button rather then send it unsolicited.

You essentially had an open public unauthed form that would send an email to any address you typed in it. Surely that alone raises some eyebrows.

I guess I just wouldn't have an open unauthed form and require a CC to use the free-tier. The contact-me form can just be a mailto: link and let the spammers go through the spam filter like everyone else. There are places where captchas is all you can really do but it's not like common use-cases don't have other options.

There are less annoying alternatives. Things like honeypot fields are worked for me so far. There are more dynamic variations on your maths question.

There're also more good faith use cases like stopping credit card testing, ticket reselling and forum spam.

I feel folks forget that whatever captchas do (or a large portion of), can be a library without the need for a strange, inaccessible 3rd party service call.

I think folks forget that we can add many of the safeguards a captchas provide as part of whatever "form serving app" is needed without torturing our visitors to prove they can count bicycles.

they don't work, robots have a higher speed and success rate than humans.

Indeed… and if it's really problematic, a client-side script can run some expensive calculations as well (the same way captchas do it), to make it extra uninteresting to target unless someone is really motivated and has the budget for it.

In the future I think we will again go to "notarization"/"attestation" of the operating system / hardware.

Essentially, the manufacturer of the device + operating system will generate a unique signature per each device, and web browsers will be able to access it.

https://en.wikipedia.org/wiki/Web_Environment_Integrity

> Public content on the Internet should be scrapable. That's what public means.

Not necessarily, especially if you want to expose some relationships in one direction while hiding the other.

Imagine your government creates a CNAM-like[1][2] system that lets you enter a phone number and see their owner, to see who is calling you and whether a number you're given is legit. However, they do not want to let you see a person's phone number just by entering their name.

If there's no captcha, an unscrupulous actor, registered in the Seychelles and unconcerned with your country's laws, can just scrape all possible phone numbers and offer a "reverse lookup" service.

In a way, the number/name records are public information, after all, the government lets you query them without authentication, but in a way they aren't, because you're only permitted to query them in a certain way.

Variations of this problem have appeared many times, particularly across Europe, usually with company numbers, property deeds and such.

Brave support here, tried to reach out to hcaptcha support and got the same auto response :|