There are a couple of bugs[0][1] in Privacy Pass that causes spending tokens during collecting, thereby preventing collecting tokens.

[0]: https://github.com/privacypass/challenge-bypass-extension/is...

[1]: https://github.com/privacypass/challenge-bypass-extension/is...

Perhaps it's only a matter of time before volunteers or well meaning organization [1] add captcha solving to bemyeyes-style solutions.

[1] https://en.wikipedia.org/wiki/LightHouse_for_the_Blind_and_V...

There's AIRA and it can do it, if you don't care that another person will see what site you're trying to access and if you're willing to go through a super complicated techy procedure to get a free american phone number, which not everyone knows about. Also, not everyone speaks english.

We also have a special accessibility mode https://www.hcaptcha.com/accessibility

This is such an out of touch dev response.

The problem is hcaptcha, the solution is stop using hcaptcha. Not placate and evade with work arounds you wouldn't even suggest to non blind people.

Also this ask a friend solution is like telling someone in a wheelchair to ask a friend to help them up those steps instead of just installing a ramp.

You don't get to take over half the internet and just ignore social responsibility.

> Also this ask a friend solution is like telling someone in a wheelchair to ask a friend to help them up those steps instead of just installing a ramp.

I agree, and I could’ve been clearer. The Privacy Pass workaround shouldn’t be necessary and we should demand Cloudflare do better.

(To avoid any doubt: I’m not affiliated with Cloudflare in any way, other than that I’m a customer on their free plan.)

I think you need to take a deep breathe.

You're responding to a rando on the internet, not the CTO of Cloudflare. Your parent is just trying to offer help to OP, and you're mad because you assume he is a Cloudflare dev? Even if he was, it's not like he has unilateral control over product decisions.

Yeah, and then... a few days later... The problem is reCaptcha, just stop using reCaptcha as Google is tracking all of us.

My personal opinion is that it's better to use hCaptcha. I wasn't aware that they don't support audio. I think a better approach would be requesting hCaptcha to implement the missing bit.

Giving less control to Google is better. Given the widespread tracking they have access to right now.

> and just ignore social responsibility.

...and they're ignoring the law in many place.

Solutions can’t be implemented instantly; a work around is needed until that ramp is installed. As much as the lack of audio solution sucks, you can’t expect half the internet to just give up on a piece of technology overnight

> you can’t expect half the internet to just give up on a piece of technology overnight

People call for this all the time when a major security vulnerability is discovered. The difference is in how the community views it.

Cloudflare should weigh harm of blocking access to the Deaf community warrant the harm of removing a captcha that doesn't support them. They should have done it when they chose a captcha that doesn't support the Deaf community.

As technology comes to mediate every avenue of life, we need to recognize that technology only has value in its positive effects on people's lives. A security vulnerability is bad because owners may lose control, property may be lost, crimes may be committed. Usability vulnerabilities can deny services essential to their users. You're totally correct that there is no magic solution, but to say that we know which imperfect solution is preferable is incorrect.

We can expect developers to think about accessibility during development. You would never see a building constructed today without a ramp or with insufficient handicapped parking. I realize that you can't change culture overnight either, but the fact is that technology like this, designed for use in large applications used by a huge portion of the population of the world, shouldn't need to be retrofitted to be accessible. It should have been baked in.

No. The ramp needs to be built when the thing is built. Accessibility is not an afterthought.

I mean, yes, in an ideal world that's true. Yet, here we are.

It's not possible for a dev to go back in time to before hcaptcha was created or when CF decided to switch to them to create said ramp, so until it's built, workarounds are the only real thing a community member can offer someone in the short term.

It's not like trying to find the Fountain of Youth or something. It's a company with billions of dollars making it impossible for certain people with disabilities to access the Internet. Let's not pretend that it just has to be this way. A world where half the Internet can't be broken by one company should be the baseline.

Nobody is saying it has to be this way. As I said, in an ideal world, accessibility happens when development happens and is not an afterthought. But we don't live in an ideal world, and it's clear here that it wasn't thought out when they did the switch, or other forces caused the switch to happen without this piece in place.

So, with that in mind, knowing where we currently are, not where we'd like to be in an ideal world, what, exactly, do you want to be done right now by members of the community?

It's not like we can all go in and change the Cloudflare code to stop using hCaptcha. The most we can all do is give alternatives and workarounds while pushing on Cloudflare and hCaptcha to support this scenario. Which is all being done in this thread already.

Why not?

When you move fast you tend to break things. When half the internet relies on you you want to avoid outages.

When things are already completely broken then it's acceptable to move fast because things are already completely broken. When things are only slightly broken you need to be careful you don't expand the breakage.

Are you sure CloudFlare isn't working on this right now? Captchas are very hard (if not impossible) to do right, and audio captchas are no exception. Check out http://uncaptcha.cs.umd.edu/ As far as I know CloudFlare might have a large team that's been working on this for a while but has been unable to create something solvable by a human but unsolvable by a bot.

Yes, there are limitations, and I'm sure hcaptcha will get there, but until then, a helpful person on the internet gave a helpful workaround.