Post #2731138

2026-05-18 19:55 UTC

@simon@procrastodon.net @pitermach@dragonscave.space I commend HCaptcha for protecting themselves legally, but I can't think of a way to do it worse than cookies. Plenty of libraries and modules (like shcaptcha) abuse it by just setting the cookie clientside, thereby letting bots blow past the check. Also, touting themselves as the privacy respecting alternative while collecting email addresses and requiring Google sign-in is quite the choice. I wonder why they removed the text challenges?

Replies (1)

@pitermach@dragonscave.space 2026-05-18 20:39

@cartertemm@az.social @simon@procrastodon.net Ha, I wish I had that cookie setting thing as a user lol. Regarding text captchas did they seriously remove them? If so that would be even worse. The last time I heard the text captchas were an opt-in for the website owners and not an opt out which in practice meant they were available basically nowhere. The one place I saw them implemented was Discord and that's about it. Second, when I did see that captcha it was seriously one of the trickiest things to parse. Their first version used to ask some nonsensical questions like "is the whale sitting on the toilet?" or something more or less like that. Then the one I got when verifying on Discord was something like "enter the word Captcha, but replace the letter in position 2 with I, change the 4th letter to be W, and in position 6 enter an H. This took me way too long to parse with speech. After I solved it, it gave me a second similar challenge which timed out shortly later probably because the first one took me so long. I seriously hope that if the text captchas are still available they're not this wordy. It felt like something designed more to confuse an LLM model than to verify if I was human.

Open ##2731139