by blindgeek on 11/18/24, 10:13 AM with 269 comments
by RobMurray on 11/18/24, 3:43 PM
The bots can probably solve them easier than blind people anyway, or they can outsource them to third world workers for next to nothing. E.G. Anticaptcha [0]:
> Starting from 0.5USD per 1000 images, depending on your daily spending volume
by soraminazuki on 11/18/24, 1:01 PM
by Rastonbury on 11/18/24, 2:46 PM
Also at least now I know some people call those markings crosswalks
by nerdponx on 11/18/24, 2:51 PM
Relying on the goodwill of a small number of "never-Googlers" to carry your business, in spite of the way you do business, is not a path to success.
While hCaptcha trashes its reputation, the rest of the world will go on using reCaptcha and not giving the faintest whiff of a fart about hCaptcha's existence.
(Side note: the spelling is "intentional", not "intensional". Think "intent" + "-tion" + "-al", not "in-" + "tension" + "-al").
by blindgeek on 11/18/24, 10:14 AM
by jchw on 11/18/24, 3:17 PM
Phone verification isn't good either, but for as much as I hate phone verification at least it actually raises the cost of spamming somewhat. CAPTCHA does not. Almost all turnkey CAPTCHA services can be solved for pennies.
Solving the problems of SPAM and malicious traffic will be challenging... I am worried it will come down to three possible things:
- Anonymity of users: validating someone's real-life identity sufficiently would make it possible to permanently ban malicious individuals and filter out bots with good effectiveness, but it will destroy anonymity online. In my opinion, literally untenable.
- Closing the platform: approaches like Web Environment Integrity and Private Access Tokens pave the way for how the web platform could be closed down. The vast majority of web users use Google Chrome or Safari on a device with Secure Boot, so the entire boot chain can be attested. The number of users that can viably do this will only increase over time. In this future, the web ceases to meaningfully be open: alternatives to this approach will continue to become less and less useful (e.g. machine learning may not achieve AGI but it's going to kick the ass of every CAPTCHA in sight) so it will become increasingly unlikely you'll be able to get into websites without it.
- Accountability of network operators: Love it or hate it, the Internet benefits a lot from gray-area operators that operate with little oversight or transparency. However, another approach to getting rid of malicious traffic is to push more accountability to network operators, severing non-compliant providers off of the Internet. This would probably also suck, and would incentivize abusing this power.
It's tricky, though. What else can you do? You can try to reduce the incentives to have malicious traffic, but it's hard to do this without decreasing the value that things offer. You can make malicious traffic harder by obfuscation, but it's hard to stop motivated parties.
Either way, it feels like the era of the open web is basically over. The open web may continue to exist, but it will probably be overshadowed by a new and much more closed off web.
by hyperman1 on 11/18/24, 4:29 PM
If you are a governement or bigco, accessibility is part of your baseline requirements. You must be able to say: Yes, we are accessible. Otherwise, the public will cause a stink.
So you take your list of vendors, and remove any that don't say they enable accessibility. Vendors know this and make sure they say they are.
Meanwhile, it is a hard to get right feature, only applicable to a small part of your userbase. Multiple disabilities require different affordances. No developer on the team really understands the actual requirement.
The people requiring accessibility will go somewhere else, or grumble and make do. Neither will be detected on any metrics board.
This combination promotes shelfware: Things you buy and put on a shelf somewhere but never really use.
by neilv on 11/18/24, 10:18 PM
Do I understand correctly that hCaptcha has created an accessibility problem that's denying this blind person access to all sorts of Web sites?
Is there an ADA angle here, for many customers of hCaptcha?
by Spivak on 11/18/24, 2:20 PM
by isodev on 11/18/24, 2:57 PM
by lupusreal on 11/18/24, 2:33 PM
by miki123211 on 11/18/24, 7:11 PM
Audio captchas don't work for people with hearing issues and/or who don't speak your n supported languages, where n is usually <10. I've had to help people out with these over the phone, it was not fun.
Even for people for whom they do work, it's worth keeping in mind that bots can solve them by now, and so users whose activity looks too fraudulent, who are still given access to the visual captchas, have to be blocked from using the audio ones. I have also seen this happen.
Text captchas are a non-option by now, they're very easy to solve with LLMs, and the way they have to be phrased makes it impossible to align LLMs not to solve them, like you can do with the visual ones.
Google's ReCaptcha can get away with having no actual challenge for most users, blind or otherwise, but that's because they're Google, they do enough user tracking that they don't actually need a captcha. Google is the only company that can get away with this, and even for them, it doesn't work in all situations, even when the user fully trusts Google and has not adjusted any privacy preferences.
Sure, you could stop using captchas entirely, if you're fine with receiving dozens of viagra ads on every single platform each day, abolishing all "contact us" and comment forms on the internet, having a significantly higher credit card fraud rate (which translates directly to higher prices and a much worse experience for consumers), and getting all your semi-public records and social media activity immediately scraped by shady companies and sold to anybody who expresses any interest. Unsurprisingly, most users are, in fact, not fine with this.
by blindgeek on 11/18/24, 7:41 PM
"So I've been trying to sign in repeatedly to set the accessibility cookie since last night. Every time I click the submit button, I get the useless error message "an error has occurred, please try again".
My friend, who shares my roof and my static IP, got banned from hcaptcha's accessibility service last year for being too smart to be blind. And I suspect you all have banned our IP and not just his account.
For the record, my static IP address is (redacted).
See https://michaels.world/2023/11/i-was-banned-from-the-hcaptch... for his story. I have been broadcasting this to websites frequented by technically capable people: https://news.ycombinator.com/item?id=42171164 https://lobste.rs/s/qbkd0u/i_was_banned_from_hcaptcha_access...
Please let your bosses know that I plan to pursue legal action against hCaptcha and/or amplify the truth to destroy its reputation in the public square. I will also be reaching out to websites who utilize hCaptcha, letting them know that the captcha provider they employ is refusing to provide reasonable accomodations to blind people.
Whether it be with the force of law or the force of satyagraha, your bosses are going to get a message and we will win.
by devmor on 11/18/24, 3:00 PM
by garbanz0 on 11/18/24, 2:19 PM
by mathfailure on 11/18/24, 8:07 PM
I pass the captcha (I am not blind and not using accessibility account) and get response like
Your response to the CAPTCHA appears to be invalid. Please re-verify that you're not a robot below. (Reference ID: 4035128747213959)
And you are given captcha again (passing which will have the same result).
reCaptcha had similar issue, but choosing 'accessibility' would transform the captcha from visual to auditory one and passing it had no such problems.
In the end I just gave up.
by Pxtl on 11/18/24, 9:33 PM
by andrewaylett on 11/18/24, 7:44 PM
These things have one job. Any time they fail to identify a human, they have failed at their job. How they go about administering the test, and (to a large extent) what the human does in response, should be irrelevant. I know that's hard, no-one said the job was easy, and the companies developing them are the ones making claims about their efficacy.
If you want to block 100% of bots, don't put your stuff on the Internet. If you want to block bots and allow humans then you're going to have false negatives. Failing to acknowledge them is dishonest.
None of which stops me filling them out when I encounter them, but I don't have to like it.
by throw_a_grenade on 11/18/24, 7:55 PM
by intunderflow on 11/19/24, 12:45 PM