this post was submitted on 29 May 2024
33 points (97.1% liked)

Privacy

32442 readers
837 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
 

basically what the title says

the ones i'm aware of:

  • google's recaptcha
  • ~~cloudflare's~~ hcaptcha

cloudflare being better for privacy compared to google, but still not great afaik

all 19 comments
sorted by: hot top controversial new old
[–] RobotToaster@mander.xyz 21 points 6 months ago

mCaptcha can be self hosted https://mcaptcha.org/

It's technically not a CAPTCHA, for the pedantic, but it serves teh same purpose.

[–] OneCupFOSS@reddthat.com 14 points 6 months ago

Not sure about captchas but the honeypot filter works fine.

Its open source so there probably is a good level of privacy.

https://github.com/spatie/laravel-honeypot

[–] swooosh@lemmy.world 12 points 6 months ago (1 children)
[–] grant@toast.ooo 13 points 6 months ago (1 children)

It appears that proton's is only for them and they don't offer it to other websites unfortunately

https://proton.me/blog/proton-captcha

[–] Dark_Arc@social.packetloss.gg 6 points 6 months ago

Yeah... Probably eventually knowing them, sadly not yet

[–] mox@lemmy.sdf.org 10 points 6 months ago* (last edited 6 months ago) (1 children)

The only privacy-friendly CAPTCHA is a self-hosted one.

The only user-friendly kind is none at all.

Depending on the web site, an alternative bot-filtering strategy might make sense, such as:

  • Allowing signup without a CAPTCHA, but requiring one before the first post/upload is allowed.
  • Allowing signup without a CAPTCHA, but deleting accounts that behave like bots.
  • Allowing signup without a CAPTCHA, but deleting accounts that don't purchase something.
  • Allowing login without a CAPTCHA, but restricting retry rates and/or temporarily locking accounts after 10+ failures.
[–] retro@infosec.pub 2 points 6 months ago (2 children)

Cloudflare's Turnstile has an invisible mode that you're probably using in a lot of places and aren't aware of it. It provides an invisible challenge to the browser and requires no interaction. I would say no input require in quite user-friendly.

[–] Zerush@lemmy.ml 2 points 6 months ago

Yes, the Honeypot system, an invisible part, only visible for bots, they use it and get blocked. easy.

[–] mox@lemmy.sdf.org 2 points 6 months ago

I would argue that's not a CAPTCHA at all, since it's not a Turing test, but rather a browser inspection.

In any case, Cloudflare services like these are not remotely privacy-friendly.

[–] Zak@lemmy.world 7 points 6 months ago

Whatever you pick, please be thoughtful about your use of captchas and try to avoid subjecting people to them frequently.

[–] Andromxda@lemmy.dbzer0.com 4 points 6 months ago
[–] BynaD@lemm.ee 2 points 6 months ago (1 children)
[–] Scolding0513@sh.itjust.works 1 points 6 months ago

that's awesome

[–] retro@infosec.pub 2 points 6 months ago* (last edited 6 months ago)

Cloudflare's CAPTCHA is Turnstile. I've found it very useful. It doesn't use pick the image or type the text, it's just tick the box. You can even set it to invisible, then the user doesn't need to even do that, the challenge is sent to the browser and is completed automatically.

https://developers.cloudflare.com/turnstile/

In terms of privacy, it's is still Cloudflare, but at least it's not intrusive to the user experience.

[–] Zerush@lemmy.ml 2 points 6 months ago* (last edited 6 months ago)

Captchas are obsolete novadays, current AI and even bots solve them better than any human. To avoid spam they are useless more and more, better as done by some forums, they simply wait 30-45 minutes before sending the activation mail, no spambot with an 15 minute mail will recieve it. Another one is the honeypot system to block bots.

[–] far_university1990@feddit.de 1 points 6 months ago

Heard of POW captcha before, maybe worth a search

[–] tsonfeir@lemmy.world 1 points 6 months ago

Roll your own

[–] cerement@slrpnk.net 1 points 6 months ago