Post #2731134

2026-05-18 18:33 UTC

@pitermach@dragonscave.space @sparksexist@dragonscave.space If it helps, I do have a way of contacting the HCaptcha team and I had a pretty encouraging conversation with them. The mainline support are pretty useless but writing them a very strongly-worded email that detailed exactly how fed up we all are with the service and how they keep ignoring suggestions to change (and accidentally sending it from my work email, which maps to an org that does accessibility work) actually seemed to do the trick. It may be time to follow up with them.

Replies (3)

@serrebi@serrebiradio.com 2026-05-18 18:34

@simon@procrastodon.net @pitermach@dragonscave.space @sparksexist@dragonscave.space That's probably why you got a response. They probably prioritize that domain for the reasons you stated.

Open ##2731135
@Tamasg@mindly.social 2026-05-18 18:39

@simon@procrastodon.net @pitermach@dragonscave.space @sparksexist@dragonscave.space you're definitely making me wonder with that last point. Does contacting some of these hard-to-reach companies (or ones super dismissive of their A11Y practices being important) from a corporately-owned or nonprofit e-mail change their tune of importance? It might be why also Atlassian and Slack get back to me in 24-48 hours with clearly read responses to the feedback, though I'd like to think they both also have stronger practices internally which is more likely. However, you never know, I guess.

Open ##2731136
@cartertemm@az.social 2026-05-18 19:55

@simon@procrastodon.net @pitermach@dragonscave.space I commend HCaptcha for protecting themselves legally, but I can't think of a way to do it worse than cookies. Plenty of libraries and modules (like shcaptcha) abuse it by just setting the cookie clientside, thereby letting bots blow past the check. Also, touting themselves as the privacy respecting alternative while collecting email addresses and requiring Google sign-in is quite the choice. I wonder why they removed the text challenges?

Open ##2731138