Hacker News Reader

Comment by mdip | Hacker News Reader

Impressive, yes, but I'm going to hazard a guess that they didn't route all of that traffic through Tor to experience the CAPTCHA with the bandwidth constraints imposed by using an exit node.

The CAPTCHAs are (mostly) easy to solve, but all of the ones I was presented with were "pick the right one out of 9 different images" and loading the entire CAPTCHA in Tor Browser took several seconds (and many revealed a new image after clicking one of the 9). This is then repeated at least once (I received three on one site, I'm guessing because I didn't know if the picture was a store front or just the front of some building). After completing the challenge I was given a connection error and had to repeat the entire thing again in one case.

There are much lower bandwidth CAPTCHAs out there and those should be favored over these large image-based ones for connections originating from the block of addresses represented by Tor exit nodes.

View on HN

The entire CloudFlare recaptcha page is < 100 KB, and that's including the images. If you're annoyed by the time it takes for that page to load, you won't be happy browsing any site via Tor - even Google is > 200 KB.

How much of each is cached?

Both requested with a clean cache using Tor Browser Bundle. Not sure if TBB does any caching at all anyway, seems like that would make fingerprinting easier, but I haven't checked. FWIW, the actual captcha image is ~20 KB.

You're right, they're not really that big. They load extraordinarily slowly. Each load one at a time from upper left to lower right and you can watch them download -- they don't just "appear", they show up like they would on a slow dial-up connection.

Once you get onto the site, it loads more slowly than in a non-Tor connection, but a news site I hit loaded everything at about the same speed as the little reCAPTCHA form, so I'm left wondering if it's something related to reCAPTCHA.

Probably just bad luck with your circuits and their latency to the image host. Tested this with a small number of circuits and didn't notice anything loading significantly faster or slower compared to other sites.

So your excuse to doubling the time it takes to get to a website is that someone's connection is already slow? People don't use tor because it's fast but that's no reason to punish them even more.

You're putting words in my mouth. I merely pointed out that the reCAPTCHA page is not in any way a bandwidth hog. Whether you think captchas are an appropriate tool to filter out abuse from Tor users is a different discussion altogether, my point is that if you're going to have any kind of captcha, then the one CloudFlare is using is probably smaller in size than most other pages you might visit.

But it is a bandwidth hog because it's purely overhead (in terms of bandwidth and latency) added to every page behind cloudflare that a TBB user visits.

It's not so much a bandwidth hog as a request hog.

this is a crucial point, new domains mean setting up new circuits, which is the real delay here.

Its like the http blocking load RTT problem magnified by 10.

AFAIK TBB doesn't create per-domain circuits for every subresource on a site (that would kill performance on many sites with 10s of third-party trackers, CDN hosts, etc.), but rather one circuit per "URL-bar domain". That domain doesn't change when a CloudFlare site renders reCAPTCHA.

Eugh, I hate the image based CAPTCHAs, they take way more mental power than the old text based ones did and often take me 2 or 3 tries to get right. Is there a way to permanently opt back to the text based ones?

disabling javascript goes back to the older "squiggly words" style in my experience. I have no idea if that happens with cloudflare though.

Unfortunately, it doesn't ... I wish it did.

You now get a page with images that have checkboxes next to them. When you submit the form, you get a Base64 key to paste into a text box.

Hmm, wonder if they're doing this to try to get around captcha solver services... this seems easy enough to construct into a single image with numbers that you could tell someone to enter via a solver service though.

Glad that I'm not the only one who dislikes the new style. They do have one advantage - they seem to be solvable 100% of the time (at least for now). In every other aspect though I find them to be way more annoying than the old ones. They're slower to load, take longer to solve, require much more concentration, and have extremely variable difficulty. The worst are the ones which replace each image you click with a new one, requiring another 5-10 seconds for loading.

I've gotten one or two wrong before. Sometimes the questions aren't well defined for a given picture.

For example, the question was "Does this have a river in it?" with a picture of the Grand Canyon, where you couldn't quite see down to the Colorado River.

I find them easier (and thus prefer them) than the gibberish "words" CAPTCHAs Google uses that deem me a machine time and time again.

I'm guessing you aren't talking about the ones displayed to Tor users before. The text-based ones presented to Tor users with Javascript disabled were almost impossible to answer correctly. The CAPTCHAs still irritate me, but the image-based ones are far superior to what I was being given previously.

Reply on news.ycombinator.com