This is not actually true: every relevant aspect is different from a privacy perspective, both technical and legal.

Looking only at the technical differences, hCaptcha lets enterprise users like Proton locally scrub any info like IPs prior to sending to hCaptcha. It can be set up so that the user makes no direct connection at all to the service, and the code runs inside of a sandboxed IFRAME.

As for false positive vs false negative rates, not sure what you consider too high. We've been able to demonstrate FP rates under 0.005% when measured against known-good/bad signals from customers, which is as good as it gets.

(disclosure: work there)

those things can be true and still not negate the issues mentioned, since not enough information is provided to make a fair assessment. it can be set up a certain way, but the incentives are against that, so is it actually set up that way? iframes aren’t perfectly isolated either. and without a curve of false positive vs. false negative rates, no conclusion can be made of the optimality. even 0.005% is still likely hundreds of thousands a day for larger sites, and being only a demonstration means it’s an ideal measure, not a practical one.

And yet I ge t stuck endless captcha. Without disclosing what a known good/bad signal is, you are essentially trust a black box and a random account on the internet

Do you have any suggestions for alternatives?

write your own? many personal tech blogs do this for comment forms and the like. any kind of ambiguity that’s natural for a human to parse accurately but not obvious for a machine is fair game. most bots won’t one-off a solution for smaller sites, so it doesn’t need to be too fancy. for larger ones where one-off customizations might be more likely, lots of engineering resources go toward security and fraud prevention already, so they can afford more sophistication.

but more importantly, in the long term, it needs policy and legal progress. it needs to be costly and international (via treaties/sanctions).

> write your own? many personal tech blogs do this for comment forms and the like.

Until they get broken by botnets and we are back to where we started by using Google ReCaptcha.

hcaptcha is so much harder than recaptcha. You actually have to spend a couple seconds per photo sometimes. Not ideal for users.

Really not sure about it, Google lets you do it quickly but if you do it, they'll just throw more problems at you it seems.