Skip to main content

The Mastodon development team currently suggest enabling #hCaptcha in order to combat the current spam wave in the fediverse.

However, hCaptcha discriminates genuine users with disabilities from accessing your instance. So if people and inclusion are important to you, please just don't. Consider closing your public registrations instead, for the time being.

Additional info is on the thread 🧵 #MastoAdmin

#mastoadmin #hcaptcha

reshared this

in reply to Casey

David Goldfield
David Goldfield
• •
I generally despise HCaptcha and rarely defend it. However, some versions do have a text alternative but I believe it's up to the Web site to enable it.
in reply to David Goldfield

Casey
Casey
• •
@DavidGoldfield A text alternative will still discriminate towards users with cognitive disabilities, as the questions asked there often rely on directional understanding or knowledge of world facts.
@David Goldfield
in reply to Casey

Casey
Casey
• •

Even though hCaptcha provides "accessibility", they do it by utilising a so-called "accessibility cookie" that screen reader users can apply for and set it on their browser.

This will allow them to bypass any hCaptcha challenges - but of course only in that specific browser.

Many users with disabilities rely on third-party apps to which the cookie does not carry over without major technical troubles, so even if they have the cookie set up, they might not be able to access an instance.

This entry was edited (2 months ago)
in reply to Casey

Casey
Casey
• •
Even when hCaptcha is only required for registration, there is no guarantee that the "accessibility cookie" actually works as intended. There are countless instances in which it hasn't, and the hCaptcha support is also known for revoking disabled users' access for "unsupported uses of the service" after they have asked for usage support.
in reply to Casey

destructatron
destructatron
• •
There's also the text challenge which comes up if A, the site has allowed it and B, if you select more options or something to that effect once you tick the box to trigger the challenge. The site shouldn't have a say if it's allowed or not. The text challenge should always exist for these frequent instances where the cookie breaks.
in reply to destructatron

Casey
Casey
• •
The text challenge still discriminates towards users with cognitive disabilities, as the questions rely heavily on directional understanding and knowledge of world facts. And also, they are easily solvable by AI language models, making the Captcha practically useless anyway.
This entry was edited (2 months ago)
in reply to Casey

destructatron
destructatron
• •
No captcha solution is going to solve all the issues though. Google's approach is good unless you're deaf. There's no real way to tell if someone isn't a robot on the internet or stop spam that isn't excluding some group or another, unless we do something really, really bad like web environment integrity which opens the door for websites to exclude basically anyone they want. We could make it so that if a screen reader is detected to be running or other assistive software, it bypasses the challenge. But how long will it be until spammers are able to fake that?
⇧