back to article Cloudflare dumps Google's reCAPTCHA, moves to hCaptcha as free ride ends (and something about privacy)

Cloudflare on Wednesday said it is ditching Google's reCAPTCHA bot detector for a similar service called hCaptcha out of concerns about privacy and availability, but mostly cost. The network services biz said it initially adopted reCAPTCHA because it was free, effective, and worked at scale. Some Cloudflare customers, however …

  1. Jamie Jones Silver badge

    Get rid of all javascript tests....

    ..... they stop be visiting any site that has them enabled.

    1. Anonymous Coward
      Anonymous Coward

      Re: Get rid of all javascript tests....

      I think the register should adopt a more modern javascript based comment submission system to help filter out non-sentient entities that execute random behavioural routines without the comprehension level of the humans who normally frequent the comment section of articles aimed at a technically cluefull audience.

      Or they could just change their attack settings in the cloudflare control panel to always challenge every user, should be easier but probably won't be as effective at the secondary goal of also wanting to block spam bots.

      1. Intractable Potsherd

        Re: Get rid of all javascript tests....

        Hey - AManfromMars1 is as entitled to post here as anyone else - plus he/she/it causes no harm.

        1. sev.monster Silver badge
          Coat

          Re: Get rid of all javascript tests....

          On the rare instance amanfromMars1 makes sense, I feel like I reach Nirvana. Not the band.

          The Smells Like Teen Spirit branded hoodie from 20 years ago and hasn't been washed in as long to retain the authentic scent, thanks.

  2. John Robson Silver badge

    Audio versions

    may be imperfect, but you need some other way of verifying people who have a visual impairment.

    The real challenge of course is that you are only as strong as the weakest captcha option.

    1. Anonymous Coward
      Anonymous Coward

      Re: Audio versions

      Another problem is the US-centric nature of some of the questions. For instance, what the f*ck is a "sidewalk"?

      1. King Jack
        Facepalm

        Re: what the f*ck is a "sidewalk"?

        I think it's what crabs do.

        1. Displacement Activity

          Re: what the f*ck is a "sidewalk"?

          Weird. I was going to post with title "WTF is a sidewalk", or possibly crosswalk. Any Why TF do I always have to do it more than once??

          Anyway, fixed it in my current website. The contact form justs asks the user to answer a very simple (technical) question, and there are several valid one-word answers. Anyone who's on the website and wants to contact me will know the answers, and I don't want to speak to anyone else.

          1. Anonymous Coward
            Anonymous Coward

            Re: what the f*ck is a "sidewalk"?

            A crosswalk is what was done on the way to Calvary. I'm always puzzled by the reCAPTCHA images but maybe they'll get it right for the upcoming holiday.

      2. Version 1.0 Silver badge

        Re: Audio versions

        A "sidewalk" is what you do when you see someone walking towards you with a very "crosswalk" and shouting at everyone.

        1. Dave559

          Re: en-US != en-*

          And, similarly, when it asks you to select images of taxis, why can't I see a black cab in any of them?

          (Unless some of them are hidden behind those yellow cars that often seem to get in the way?)

          PS: I had to re-read "botherders" as I couldn't work out what a "bother-der" was...

          1. stuartnz
            Happy

            You're NEVAH alone on Da Interweb Tubes

            "PS: I had to re-read "botherders" as I couldn't work out what a "bother-der" was" So VERY relived to learn I wasn't the only one!

          2. Irongut Silver badge

            Re: en-US != en-*

            Same, it should have been written as "bot herders."

            1. sev.monster Silver badge
              Facepalm

              Re: en-US != en-*

              ...OHHHHHHHHHHH

          3. Aussie Doc
            Pint

            Re: en-US != en-*

            I read it as 'botherers', like as in my religious friends - god botherers. Still beer O' clock so that could explain it.

      3. Andy Non Silver badge

        Sidewalk

        It's what I do at the moment if someone is walking directly towards me and coughing.

      4. katrinab Silver badge
        Meh

        Re: Audio versions

        "Sidewalk" is American for a pavement

        "Pavement" is American for a road surface

        1. johnfbw

          Re: Audio versions

          "Pavement" is American for a road surface - whether it is paved or not

          1. CAPS LOCK

            Let's not go into...

            ... 'fanny'

            1. Mike007 Silver badge

              Re: Let's not go into...

              Sorry to interrupt, but can I bum a fag?

              1. Irongut Silver badge

                Re: Let's not go into...

                You certainly can round my house.

            2. eamonn_gaffey

              Re: Let's not go into...

              I think we ought to......

            3. Pen-y-gors

              Re: Let's not go into...

              Or the popular fenland sport of Dyke-jumping.

          2. Michael Wojcik Silver badge

            Re: Audio versions

            whether it is paved or not

            Not in any part of the US I've ever lived in, it isn't. That includes various regions on the East Coast, the Midwest, the Plains, and the Southwest.

          3. holmegm

            Re: Audio versions

            Er, no - I've never heard anyone call the surface of a dirt road "pavement".

        2. richdin

          Re: Audio versions

          A Milky Way is a Mars Bar, a 3 Musketeers is a Milky Way, etc.

          This is why we kicked you out of the colonies.

        3. The Nazz

          Re: Audio versions

          Neil Young : " I was walking down Main Street, not the sidewalk but Main Street......that's how good i felt"

      5. IGotOut Silver badge
        Megaphone

        Re: Audio versions

        Don't even start me on the totally incorrect question.

        "Select the images with stairs"

        Error there are none.

        Oh you mean STEPS not stairs, you fucking idiots.

        Stairs inside,steps outside.

        1. Anonymous Coward
          Anonymous Coward

          Re: Audio versions

          "Steps" and "stairs" mean essentially the same thing in the US. Doesn't make it "totally incorrect", though the wording could definitely use work.

      6. a_yank_lurker

        Re: Audio versions

        The problem with any CAPTCHA system is they will need a default dialect. That is inherent in the method. For English it could any of a number dialects depending on where the developers are from. And everyone who does not speak that dialect will have problems with the system.

      7. heyrick Silver badge

        Re: Audio versions

        And yellow school buses. And some really weird word (I forget) that basically meant the pedestrian crossings.

        My all time favourite, though, was the earlier type of test that gave too words to type in. One was Cyrillic, the other Hebrew. Uh....?

      8. Irongut Silver badge

        Re: Audio versions

        I refuse to answer any reCPTCHA that asks about sidewalks or taxis with no black cabs in the pictures and demand another question in a language I can understand, like English.

      9. holmegm

        Re: Audio versions

        It's a strip made of "pavement" that runs alongside a road, for pedestrians to walk on ;)

    2. Version 1.0 Silver badge

      Re: Audio versions

      Audio has it's problems too - I love Burnistoun but my wife needs the subtitles.

  3. Anonymous Coward
    Anonymous Coward

    Google has never been known for attentive customer support

    I love such MEGAunderstatements :)

    1. Anonymous Coward
      Anonymous Coward

      Re: Google has never been known for attentive customer support

      We have been trying to export 43 million emails from G Suite. We've had our email backups/eDiscovery in Google's systems since Postini, so pre Google Apps. That means they've made a huge, huge amount of money off of us.

      So get this. Google Vault, their current eDiscovery system, stores your generated email export files for 15 days... from the time of starting it. That means if you happen to export more in one batch than Google can handle, it will delete it mid-export after 15 days. We spent weeks arguing with underpaid Indian support reps and never once spoke to anyone from their internal IT—not even anyone above Tier 1.

      End result was that we had to run multiple exports until we found the magical filesize that would complete and allow us to download it before the 15 day cutoff, and had to do this countless times for the TB's of emails we had.

      Google Support is atrocious, and I'm glad we will be rid of them soon.

  4. Mage Silver badge
    Thumb Up

    Good

    This is good.

    The less people using thieving, parasitical Google services the better.

    1. Anonymous Coward
      Anonymous Coward

      I agree!

      I don't want to provide free training to Google's AI. Unless I'm in a hurry I make a point of getting a lot of wrong answers and only passing after 30-60 seconds, to poison their dataset.

  5. Anonymous Coward
    Anonymous Coward

    Is Cloudflare learning from Google?

    First, they started serving files for many websites from their CDN, then they started a DNS-over-https service, now they add a Captcha service (with added tulip-bubble blockchain compliance, yaay!), what next....?

    Say, that's a lot of potentially identifying data you're gathering in a single organisation there, wouldn't it perhaps be nice for the financials if there were, say, some kind of way to, you know, monetize it...? (Or maybe a couple of people in smart suits and dark glasses might also come and knock at the door?)

    (If Cloudflare are, and will remain, genuinely better and less shifty than that, then my apologies, but I can't help but be a little suspicious as to what sort of empire-building is going on here...)

    1. IGotOut Silver badge

      Re: Is Cloudflare learning from Google?

      Their privacy policy is pretty clear (as privacy policies go)

      https://www.cloudflare.com/privacypolicy/

      They make money by charging for their commercial offerings, unlike Google who sell your soul in return for shiney.

      1. Anonymous Coward
        Anonymous Coward

        Re: Is Cloudflare learning from Google?

        That cloudflare policy is not as good as that company who had the policy of "don't be evil", who was that again?

        1. sev.monster Silver badge

          Re: Is Cloudflare learning from Google?

          Also keep in mind that anyone that uses Cloudflare DDOS protection voluntarily MITM's their entire Internet presence; Cloudflare gets your HTTPS certs too. That's too much power, no matter the benefit.

  6. Anonymous Coward
    Anonymous Coward

    HCaptcha absolutely sucks

    There is a site I need to access for work. Every time I go there, from the same computer, I am presented with as many as ten puzzles one after the other.

    Cloudflare has some very smart people, I am surprised they don't build their own solution versus foist HCraptcha on people

    1. IamStillIan

      Re: HCaptcha absolutely sucks

      It does seem to be somewhat tedious.

    2. NeilPost

      Re: HCaptcha absolutely sucks

      Several of the many 2FA apps seem like a reasonable way out if this - even one with an anonymous Capcha style mode.

      “CAPTCHAs (completely automated public Turing test to tell computers and humans apart)” .... Alan Turing will be spinning in his grave his legacy has been attached to this usability fail bag’o’shite.

  7. Doctor Syntax Silver badge

    "The biz held a bake-off to pick a new provider"

    Without show-stoppers, I hope.

    1. Giovani Tapini
      Trollface

      No show stopper, they stopped at the soggy bottom

  8. Pascal Monett Silver badge

    Wait a minute

    "it plans to begin charging for reCAPTCHA, a service it has previously offered for free because the answers people provide improve its services and machine learning systems"

    So, Google is making people pay for a free service that improves its own learning systems ? You're already getting a benefit, so now you want money too ?

    God it must be great to be at the top.

    Oh, and for the bot herders : send their complaints (and IP addresses) to the FBI. I'm sure the feds would love to have a chat and listen to their woes.

    1. NeilPost

      Re: Wait a minute

      Free under 1,000 API calls per second.

      So you want to facilitate the hosting costs ???

  9. John Brown (no body) Silver badge

    "improve its services and machine learning systems.

    ...there's no charge for reCAPTCHA unless you exceed one million queries per month or 1,000 API calls per second."

    Surely those sites generating so much "learning" for Googles systems should be getting paid by Google for providing such a huge service?

  10. A random security guy

    First honest statement about blockchain

    "company only uses blockchain technology when it's appropriate. "If there is no multi-party transaction there's less benefit to it, although having an immutable audit log can be nice in some scenarios,"

  11. Anonymous Coward
    Thumb Down

    Google Not Using Their Own Products?

    I cannot recall seeing a reCAPTCHA when registering on the Play store on an Android phone.

    I see apps on the Play store with hundreds of fake 5-star reviews, with dozens new being added daily. Like this beauty which charges you around USD 90 per week for wallpapers - after a 3 day free trial: https://play.google.com/store/apps/details?id=com.wallpaper.photon

    Reporting the reviews as spam or unhelpful does not help. Google just ignores the reports. Same goes if you report the app itself. I imagine the people at Google receiving the reports laughing really hard and loud before clicking on Delete.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like