<story><title>Moving from reCAPTCHA to hCaptcha</title><url>https://blog.cloudflare.com/moving-from-recaptcha-to-hcaptcha/</url></story><parent_chain><item><author>zachware</author><text>One of the more insidious elements of ReCAPTCHA is its propensity to challenge users who have robust cookie blocking in place. So as we encourage people to be more privacy-aware, the web gets harder and harder to use.&lt;p&gt;We&amp;#x27;ve seen ReCAPTCHA pop all over ecommerce, all over benign websites with little to no need to challenge use almost completely because of the increase in privacy-aware users.&lt;p&gt;ReCAPTCHA essentially flies in the face of the recent blocking features rolling into Safari and Firefox and more privacy-aware users...growing by the day.&lt;p&gt;In many ways it&amp;#x27;s a genius structure from Google.
1. Convince people to use your privacy challenge.
2. Serve it when you don&amp;#x27;t see Google tracking cookies.
3. Offer a way around that with the least privacy-aware browser available (Chrome use is growing steadily month over month.&lt;p&gt;So good on Cloudflare.</text></item></parent_chain><comment><author>jjoonathan</author><text>That, and ReCAPTCHA had hellbans.&lt;p&gt;If you blocked cookies or were otherwise problematic, it would sometimes lock you out of all ReCAPTCHA-gated resources not by giving you a message describing what was happening, why, and how to fix it, but rather by simply pretending that your every attempt to solve the captcha failed. Obviously this is extremely frustrating, by design, but it gets even more so with compounding factors like &amp;quot;the library is closed at this hour, so I can&amp;#x27;t get a fresh connection.&amp;quot;&lt;p&gt;The worst I&amp;#x27;ve seen has been when it happens to people who aren&amp;#x27;t well equipped to guess what&amp;#x27;s happening. When my friend&amp;#x27;s younger brother got hellbanned from his PlayStation account, he spent 30 minutes trying to identify traffic lights (or whatever) and then retreated crying to his room, because he wasn&amp;#x27;t able to deduce that Google was gaslighting him. He trusted Google. They had him convinced that he was such a failure he couldn&amp;#x27;t even identify traffic lights correctly, and he was -- quite reasonably -- inconsolable for a while.&lt;p&gt;Thanks a lot, Google.</text></comment>
<story><title>Moving from reCAPTCHA to hCaptcha</title><url>https://blog.cloudflare.com/moving-from-recaptcha-to-hcaptcha/</url></story><parent_chain><item><author>zachware</author><text>One of the more insidious elements of ReCAPTCHA is its propensity to challenge users who have robust cookie blocking in place. So as we encourage people to be more privacy-aware, the web gets harder and harder to use.&lt;p&gt;We&amp;#x27;ve seen ReCAPTCHA pop all over ecommerce, all over benign websites with little to no need to challenge use almost completely because of the increase in privacy-aware users.&lt;p&gt;ReCAPTCHA essentially flies in the face of the recent blocking features rolling into Safari and Firefox and more privacy-aware users...growing by the day.&lt;p&gt;In many ways it&amp;#x27;s a genius structure from Google.
1. Convince people to use your privacy challenge.
2. Serve it when you don&amp;#x27;t see Google tracking cookies.
3. Offer a way around that with the least privacy-aware browser available (Chrome use is growing steadily month over month.&lt;p&gt;So good on Cloudflare.</text></item></parent_chain><comment><author>Kalium</author><text>One of the non-obvious consequences is that any system designed to use technical measures to distinguish between humans and computers will wind up very sensitive. There&amp;#x27;s an arms race, and us real users are caught in the middle.&lt;p&gt;There&amp;#x27;s a &lt;i&gt;vast&lt;/i&gt; army of computers doing their best to pretend to be human. The whole point of any kind of CAPTCHA is to try to catch them out - and every measure gets worse over time. So companies like Google look at everything they can see that helps them distinguish typical humans from robots.&lt;p&gt;This has a nasty side-effect. A lot of measures intended to preserve privacy have the incidental effect of making the privacy-sensitive user look more like a computer and less like a human. Not saving cookies and not executing JS are classic bot moves. This plays directly into the sensitivity that has been engineered over time in order to catch more computers posing as humans.&lt;p&gt;I don&amp;#x27;t know any easy resolution to this tension. Maybe you do? I really hope so. The internet is overrun with abusive behavior and the amount of work that goes into keeping it at bay is staggering.</text></comment>