I've used vultr.com for years with no problems. Recently it wouldn't let me login without solving a Google captcha. I tried private windows, etc and ended up having to cancel my Vultr account and ask for a refund. Fortunately I only used them to spin up test VMs and didn't have any production stuff running there.
I refuse to pay a company for service and then be required to identify motorcycles and traffic lights every time I sign in. I went a few rounds with Vultr customer service and they said (paraphrasing) "It's not something we can fix, you have to talk to Google about it". Right... Google forced you to put their captcha on your web site.
I never got a response when I wrote to the FTC, requesting formal guidance as to whether having to disable NoScript (a browser security measure) to complete a CAPTCHA to unsubscribe from email spam satisfies 16 CFR § 316:
"Neither a sender nor any person acting on behalf of a sender may require that any recipient pay any fee, provide any information other than the recipient's electronic mail address and opt-out preferences, or take any other steps except sending a reply electronic mail message or visiting a single Internet Web page"
A few years ago a service for which we had just implemented a scraper for (they had no API, and the customer needed info from 1000s of accounts) added a captcha right after we had implemented the scraper.
We quickly figured out that the server didn't validate the captcha challenge code with Google. It worked for 3 years until they changed the system to send a code via email to validate your login, and limiting you to 1 session at-a-time. Now we have different problems to deal with...
>CAPTCHAs don't work anymore, at this point. AI can trivially solve them.
The point is to raise the cost, not to create some impenetrable barrier. A $5 vps can make hundreds of requests per second. IP bans and rate limiting forces people to use residential proxies, which are like $5/GB. That's much more expensive, but still cheap. Not sure about the token cost of AI is like, but captcha solving service used to charge around $0.002 per solve, which increases costs even more.
No, it's a numbers game on both sides. Attackers are after hundreds or thousands of accounts, not just one. Defenders knows that exactly 0 hacks are impossible to achieve, and they're just trying to limit losses from fraud, but also costs from anti-fraud.
I'm not giving up recovery codes, nor my ability to default to locking out people who physically have my device. I usually don't allow auto-login or biometrics login either.
If a website/app goes passkey only (or, even worse, if it starts relying only on one-time email codes), I won't use it.
I know plenty of others who feel the same, though I don't know if we're numerous enough to put a dent in a company's bottom line or not. I imagine it depends on the company and its target audience.
Please don't. I find such services obnoxious, especially when they aggressively log you back out. Chasing down a link in your email is much slower than having your password manager fill in the long unique random password and hitting "log in".
You can also randomly generate a password for the user on the form they'd normally type one in on registration. Add a "Regen" button to give users more visceral control over it before they submit the form.
That's essentially the same as magic links because most users won't remember/save that password and will have to rely on the usually email-based reset flow.
Passwordless and passkeys. There are no credentials to stuff. Login with magic link, email OTP, passkey, etc. Get rid of the password, rate limit what remains.
Email OTP is garbage without the option to also add a password. That just outsources the problem to the user's email service, and assures that compromising the email inbox alone is enough to immediately also compromise every service that uses passwordless, 2FA-less "magic link" or OTP login.
Email services don't even support true 2FA; many claim to, and ask for a 2FA code for web login, but connecting an email account to a client via POP or IMAP bypasses that.
I implement customer identity and access management for millions of users in financial services, based on requirements driven in part by US federal regulatory and cyber insurance requirements. What’s your experience?
> Email services don't even support true 2FA; many claim to, and ask for a 2FA code for web login, but connecting an email account to a client via POP or IMAP bypasses that.
"In less than a year, passkeys have been used to authenticate people more than 1 billion times across over 400 million Google Accounts. Passkeys are easy to use and phishing resistant, only relying on a fingerprint, face scan or a pin making them 50% faster than passwords. In fact, on a daily basis passkeys are already used for authentication on Google Accounts more often than legacy forms of 2SV, such as SMS one-time passwords (OTPs) and app based OTPs (such as Authenticator apps) combined."
(All major email providers support either passkeys, or in the case of Microsoft, passwordless ["strong authentication"]; we can consider the user creating an app specific secret for an external mail client minimal risk if performed after strong authentication has occurred, as the odds are low of that secret being phished or exfiltrated once configured in their mail client of choice, for the few folks interested in such a user experience with web based email services)
But passkeys are not supported natively (i.e. without a USB key or other shenanigans) by Firefox on Linux, as there is no place to store them. I do have a USB key, but it's annoying enough that I don't like passkeys if I can avoid them (instead using long randomly-generated passwords by Firefox's builtin-in password manager).
I admit this is a gap, but this use case is a rounding error at the scale of users and daily logins. If someone wants to fix this, drop a link to sponsor the time and tokens needed to enable native support. Does a Yubikey or secure authenticator work for your use cases currently?
Attacks have been distributed for quite some time if your service has any loot worth attacking. You have to handle the case where every request comes from a unique IP address.
Ok, debian forky, 155.0.1, successfully logged into vultr.com after a year inactive, added a credit card and a little credit. I do, however, still stupidly use google authenticator for 2FA. The captcha was just a checkbox.
That said I have run into a number of unsolvable captchas lately on firefox. Had to use chromium on a healthcorp insurer site.
I don't mind a checkbox. I don't even mind the "proof of work" types that take 10 seconds extra. But identifying traffic-y things over and over is way too much for me. I did do one screen, thinking it would let me in, but it just gave me another.
I do use Firefox. And I couldn't cancel my account myself: had to request it via email since I couldn't login. They were good about doing it right away and said they issued a refund for the balance.
They have nothing to do with Cloudflare. Their challenge page is only made to look like the one from Cloudflare. It's entirely their own page. Only the reCaptcha challenge is not theirs. And the reason why nobody gets redirected is because the have used up their free enterprise quota with reCaptcha, as you can read in the widget itself.
Captchas are often used as tarpits. They've already decided you're a bot based on other factors so you aren't getting in until you change those factors. I've seen this happen where I'm stuck in the loop and then change the VPN endpoint and get right in after one try.
I'm sure there exist examples where people maliciously give tasks (captchas) out that have no chance of getting the person anywhere, but it's definitely not common
Consider yourself lucky. I routinely run into tarpit Google reCAPTCHAs and I don't even use a VPN. I think it's because I run Linux and the site admins treat anything besides Windows, Mac, iOS, or Android Chrome as suspicious enough to blacklist. It has gotten to a point that I literally never even _try_ to do image-based CAPTCHAs anymore. If I can't access the site, oh well.
I also get infinite captchas but it's imo not a tarpit if it's not intentional but a bug
Edit: looked up the term, DDG shows a Wikipedia card saying "A tarpit is a service on a computer system that purposely delays incoming connections." (purposeful)
It may seem purposeful on Google's part but I bet that if we could get through to the developers for answers, it's probably not designed that way but we're running into a case where the system isn't designed to handle it
Which could be said to be intentional (excluding people with our FOSS setup), I guess
We were getting about few hundred spam registrations per day on one of our sites. With CF's captcha number drops to tens per day. I have no idea who and why make these registrations.
Constantly. It's made me stop using Google entirely because I can't run a single search without hitting reCAPTCHA. It's becoming problematic because some services I pay for, such as Bandcamp, also end up pestering me with boatloads of reCAPTCHAs. I enjoy Bandcamp, but I'm going to have to axe it if it keeps up.
Dunno, but is anyone else continuing to seem to get what feels like 3-4 minute reCaptcha challenges? I’m getting mentally exhausted having to try to solve the super blurry pick-the-streetlights they keep throwing at me in loops.
It feels like I have to go slowly through it only for it to eventually end in a “please try again” as I sit and wait ten seconds for each square to slowly fade in a new stupid bus for me to click.
This is a tarpit. They've decided you're almost certainly a bot. If you're willing to solve the captchas for three minutes straight, they eventually might relent and let you in, or maybe not.
I doubt any human would solve them for 3 minutes straight, but a bot might. So closing and reloading the page (something a human would do) might work. Of course bots that don't do this will quickly figure out that they should - just like every other attempt to figure out if this is a bot or not...
There is no good automated answer. Things bots do to abuse web pages should be made illegal and then jail (fine...) the people who set the abusive bots loose - but I suspect most abusive bots are foreign and so we can't do anything without sending in an army (obviously unacceptable)
> I doubt any human would solve them for 3 minutes straight
Cognitive overload. There's days I'm just straight up tired and don't realize it until I'm at least one "please try again", page refresh, and endless traffic light game later that I'm probably in the tarpit and wonder why.
The weird thing is that I don't KNOW why. I use good ol' consumer Chrome, good ol' consumer MacOS, a consumer ISP, and my IP isn't in any kind of reputational blacklists that I'm aware of.
reCAPTCHA actually works for me. The one that asks if it's a sidewalk or a motorcycle or whatever right?
cloudflare bot detection has convinced itself I am a bot however (I do a lot of automated web related stuff on my home IP) and that's been an eye opener for sure... I can't enjoy a good 20% of the internet it seems like now.
Doesn't matter how many times I click that cloudflare button, they don't believe me.
And I've been signed in to my cloudflare account (which I've held in good standing with a live credit card for years) the entire time :/
Same experience for me. I get endless Cloudflare loops for many sites due to using less common browsers. Given that the goal is is distinguishing bots from actual humans, it seems to be a rather high failure rate. At least I think I'm human...
One method that does seem to help is being sloppy when clicking the "I am a human" checkbox. I suspected that bots were more likely to perfectly click the center of the checkbox every time and decided to try clicking the padding around the checkbox instead (which still registers as a click). It seems to be more successful, but it could be my imagination.
Archive.today / Archive.is / Archive.ph issues the past few days. Safari Private w/iCloud Private Relay. See the enterprise free tier exceeded messaging:
This site is exceeding reCAPTCHA Enterprise free quota.
I do not think that this is Firefox specific, more likely is is something Linux specific.
For me, hCaptcha has stopped working immediately before last weekend, regardless of the site that uses it.
It goes in an infinite loop, despite solving correctly all challenges.
On Linux, I have tested with 2 browsers, Firefox and Vivaldi, and the browser did not make any difference. I do not use any ad blockers, nor any non-standard extension.
So I think that they deployed a version update last Friday, which for some reason is broken on Linux.
It would not be surprising if both hCaptcha and Google ReCAPCHA have made some similar changes, so now they are both broken on Linux.
Meanwhile, some other "Captcha" applications from other vendors, which are used on other sites, still work like before.
I get reCaptchaed-to-death all the time in iOS and MacOS using both Firefox and Brave. I use a big name VPN which probably makes it worse, since I'm routinely blocked outright by Cloudfare services, assuming cluelessly that I'm a bot.
It doesn't work in Chrome either (please complete CAPTCHA/yes you're valid/repeat), it might be a config issue on archive.is (Firefox latest windows, Chrome 151 windows - guest/null profile on both) rather than a war move.
I also have the same issue in Firefox, Chromium and Vivaldi on Linux.
I tried searching the interweb for a cause/fix, but couldn't find anything sensible in the flood of low-quality SEO hijacking webcrap returned by multiple search engines. So I asked AI.
The claim is that it could be caused by the blocking of some DNS providers (NextDNS, Quad9, ..), and it suggested using a VPN or phone tethering.
And lo and behold, both suggestions worked, without any browser setting changes.
You may want to use "Buster: Captcha Solver for Humans"[1], which uses the audio option to solve the CAPTCHA.
There are even several speech recognition methods, like wit.ai, which is basically from Facebook:
$ whois wit.ai | grep "Name Server"
Name Server: b.ns.facebook.com
Name Server: a.ns.facebook.com
Name Server: c.ns.facebook.com
Name Server: d.ns.facebook.com
Note I posted the comment only once a day ago. Thread ID seems the same, but old timestamp is visible in my profile. Important issue for information freedom, HN relevant, so it’s back new on the front page?
I made this post and it died on its arse initially, didn't even get an upvote. The second chance pool meant that it turned into a useful discussion about a pretty niche element of frontend development.
archive.today doesn't use a real recaptcha, the cloudflare page isn't real either. it serves that as a punishment for using 1.1.1.1 DNS because the owner doesn't like that 1.1.1.1 doesn't send EDNS client subnets.
I recall that the 1.1.1.1 block page doesn't serve the real one,, but the challenge page that they serve normally does. Maybe I'm misremembering? or maybe they changed it.
I just tested and it's the "real" recaptcha, with requests to google and everything. It still might be "fake" in the sense that the server rejects any response, even valid ones, which is probably what's actually happening.
What do you mean by "a real recaptcha"? I just went to an archive.is page, and it's trying to load a script from www.google.com. Doesn't Google still own reCAPTCHA?
> On 14 January 2026, it emerged that archive.today had silently modified its CAPTCHA page to send repeated requests to Gyrovague, thereby causing visitors to unwittingly contribute to a DDOS attack against the blog.
Better to just ignore the anti-Russian and hasbara spam. It's being posted opportunistically. The chance to attack archive.is in an organically posted thread is probably the only reason an intermittent outage (common) of archive.is was upvoted enough to make it to the front page. Look at the top comment.
That whole debacle is even specifically relevant to this thread because the operator of archive.today (aka archive.is) was caught using a script on its captcha page to make visitors' browsers connect to the blog they were mad at. That's how their DDOS attack worked. They used their own visitors, who naturally trusted the captcha page, to commit a crime.
For whatever reason, with the exception of Wikipedia (bless the editors), they seem to have gotten away with this, as well as with deliberately falsifying the content of "archived" pages (as described in the arstechnica article), without consequences.
So, call me crazy or a Russian bot if you want, but I think it's reasonable to be suspicious of any weird captcha behavior from this website in particular.
It tells us that the moderators of HN support copyright infringement and DDOS attacks. They are actively moderating this forum and choosing to do nothing.
They also choose to do nothing about uncharitable interpretations of their inactions. Should they act there too? Or do you prefer the hands-off approach when it suits you?
I don't think it's very interesting even if true. I'm not that fussed about copyright infringement myself and I don't consider using archive.is (infrequently) to be condoning their DDOS.
because of my privacy settings google search outright blocks me as a bot. the only way to search is through an intermediary like startpage. related because if it does give me the time of day i tend to then get endless captchas.
Im usually on Firefox and I haven't run into this. But I also spent the past 2 days building a Knitsail VM solver in Rust for pulling Google Search results. Works nicely, I gave chatgpt pro (6) a minified JS bundle, and some variables and entries into the VM and told it to reconstruct the VM in Rust. Only took a couple hours to get a zip with a solver I could plug into my crawler, made a few mistakes but codex fixed those up with minimal guidance. No more Google captchas for me :)
I just tried and it doesn't happen for me, maybe the problem has already been fixed?
Separately, if I were seeing a captcha that I can't get past, my first reaction would be to find a different site to see if it's a site specific issue, because some sites intentionally configure their captcha to work like that (e.g. you can't get in until you have been stuck solving captchas for at least a minute). I would see that more as a signal that the site operator is user hostile and not attribute it to a captcha provider.
One interesting thing I found recently was after enforcing geo-fencing, recaptcha intermittently started failing. They might be using global edge servers or something
Not sure about Firefox but lately, if I access Google from Safari on my Mac with Apple's private relay on and private mode Safari, I get an endless captcha loop.
Yes. And even after solving the recaptcha it just wont accept and after multiple attemots even if it accepts it just goes on to display it all over again
Since last month I've been CAPTCHAed in many Google searchs in Firefox. I assumed either a local device was spamming them or maybe Codex/Claude web search was flagging me as a bot.
So is this CAPTCHAing because I refuse to navigate the ad-infested way? How can I rule out a problem on my end if my router is ISP provided with limited functionality ?
I have been seeing this, but it depends on my originating IP. I switched my house from Spectrum to T-mobile and then started getting ReCAPTCHAs on Firefox. Going out through another Spectrum connection on the same machine doesn't trigger the ReCAPTCHAs. It happens far, far less with chrome but it does still happen.
I don't think it has anything to do with google, it's an intermittent issue on the archive sites that usually clears out within an hour or two. You're being successful, then being bounced back out again.
Also firefox from linux. Just leave the pages open and refresh them every 20 minutes or so.
If you're seeing an infinite CAPTCHA loop on archive.is, it's more likely that you're on the operator's shitlist than any technical issue. All Finnish IP addresses are on that shitlist already.
Yup. Before they just blackholed Finnish IP ranges instead, accessing the site from one would serve a fake Cloudflare page with a reCAPTCHA challenge and the DDoS script. (The tell of it being fake is y'know, that Cloudflare doesn't use reCAPTCHA)
I can only guess the goal was to keep users on that page longer to keep sending off more spam requests.
Interesting, saw reCAPTCHA infinite loop for the first time in a long time just yesterday, on Firefox, and it was when I tried to access an article on PMC. Disabling uBlock and Enhanced Tracking Protection did not help. It looked like several automatic reloads, then one real reCAPTCHA showed, and infinite reload loop after I solved it.
Does not reproduce today though, and I never had issues with PMC/NIH before that.
> Advertisers on Google should be paying a lot less than they were a year ago.
I wonder how the Google Search page traffic has been affected by the recent AI surge.
Very anecdotally, of course, but in my social circle (middle-class urban Romanians in their late 30s and early 40s) almost everyone I know has replaced a phrase like "I googled it and I found this and this and this" to "I chatGPT-ed and I found this and this and this" (where "chatGPT" can also be sometimes replaced by Claude and, not that often, by Gemini).
Anyone fighting for the removal of CAPCHA's or complaining about picking motorcycles or bridges is a bot and should be removed from this website. As a human, I have no problem solving these. I don't think I'm particularly clever but I am human. Bot psyop?!
The open secret: the CAPTCHA wasn’t actually being checked against Google’s servers; any answer was accepted as correct – until yesterday, when someone armed with this knowledge launched an AI crawler. Now it’s being checked, so you’ll have to solve it.
I'm not sure why this is downvoted. It approximately checks out. An "assessment" only counts if your server tries to verify it, so you could conceivably use recaptcha for "free" if you don't bother validating the results. It also explains why other people have started seeing "This site is exceeding reCAPTCHA Enterprise free quota" message.
Strict mode has always been broken for me. Firefox replaces some of Google's tracking scripts with no-ops but that usually breaks Google's reCAPTCHA on my end. I have to disable tracking protection to make reCAPTCHA sites work.
I think it's fair for Google not to fix Firefox's shims, so I don't know who to blame for this. I doubt it's part of some big conspiracy against Firefox, though. I don't think Google cares enough about Firefox to bother annoying Firefox users.
Archive.is has had downtime this weekend when I tried to use it. They also regularly pull shady stuff, so I wouldn't be surprised if they did something stupid again and got themselves banned from reCAPTCHA.
Can we just get rid of reCaptcha? It was fun when it was new, but now it's just pointless busywork to let Google know who we are. Does it do anything other than that? I don't for a minute believe bots can't solve that anymore.
It still works, bots can solve it but it probably increases the cost of that web call by 10x or 100x for that bot, so it won't bother. Had a recent bad experience with removing recaptcha.
I've used vultr.com for years with no problems. Recently it wouldn't let me login without solving a Google captcha. I tried private windows, etc and ended up having to cancel my Vultr account and ask for a refund. Fortunately I only used them to spin up test VMs and didn't have any production stuff running there.
I refuse to pay a company for service and then be required to identify motorcycles and traffic lights every time I sign in. I went a few rounds with Vultr customer service and they said (paraphrasing) "It's not something we can fix, you have to talk to Google about it". Right... Google forced you to put their captcha on your web site.
CAPTCHA for login should just be outright illegal, especially if it blocks important functionality like closing your account.
I never got a response when I wrote to the FTC, requesting formal guidance as to whether having to disable NoScript (a browser security measure) to complete a CAPTCHA to unsubscribe from email spam satisfies 16 CFR § 316:
"Neither a sender nor any person acting on behalf of a sender may require that any recipient pay any fee, provide any information other than the recipient's electronic mail address and opt-out preferences, or take any other steps except sending a reply electronic mail message or visiting a single Internet Web page"
https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C...
A simple reading says, no. But I guess they don't want to put that in writing.
A few years ago a service for which we had just implemented a scraper for (they had no API, and the customer needed info from 1000s of accounts) added a captcha right after we had implemented the scraper.
We quickly figured out that the server didn't validate the captcha challenge code with Google. It worked for 3 years until they changed the system to send a code via email to validate your login, and limiting you to 1 session at-a-time. Now we have different problems to deal with...
>CAPTCHA for login should just be outright illegal
How do you prevent credential stuffing attacks?
>especially if it blocks important functionality like closing your account.
That just falls under standard tort law, not to mention recent "click to cancel" legislation some states have been introducing.
> How do you prevent credential stuffing attacks?
CAPTCHAs don't work anymore, at this point. AI can trivially solve them.
Rate-limit the number of attempts, test accounts against known-password lists like HIBP, and support 2FA.
>CAPTCHAs don't work anymore, at this point. AI can trivially solve them.
The point is to raise the cost, not to create some impenetrable barrier. A $5 vps can make hundreds of requests per second. IP bans and rate limiting forces people to use residential proxies, which are like $5/GB. That's much more expensive, but still cheap. Not sure about the token cost of AI is like, but captcha solving service used to charge around $0.002 per solve, which increases costs even more.
There is no raised cost anymore. Every professional doing this work has perfect alignment with regular consumer heuristics.
OS, browser, fingerprinting, networked bytes, residential address spaces.
All of it is done.
For credential stuffing you need only one attempt.
No, it's a numbers game on both sides. Attackers are after hundreds or thousands of accounts, not just one. Defenders knows that exactly 0 hacks are impossible to achieve, and they're just trying to limit losses from fraud, but also costs from anti-fraud.
They have so many accounts broken daily? Then credential stuffing attacks are not prevented.
Then you don't need to automate it, and you can just manually solve the captcha and log in.
Passkey only. No passwords no usernames just passkey
I'm not giving up recovery codes, nor my ability to default to locking out people who physically have my device. I usually don't allow auto-login or biometrics login either.
If a website/app goes passkey only (or, even worse, if it starts relying only on one-time email codes), I won't use it.
I know plenty of others who feel the same, though I don't know if we're numerous enough to put a dent in a company's bottom line or not. I imagine it depends on the company and its target audience.
Two passkeys. If you lose two then yeah, you are boned don't do that. They are absolutely the superior solution
At the minimum, stop using goddamn email addresses for the login.
>How do you prevent credential stuffing attacks?
Passkeys or magic links seem like the way forward here.
Please don't. I find such services obnoxious, especially when they aggressively log you back out. Chasing down a link in your email is much slower than having your password manager fill in the long unique random password and hitting "log in".
>Chasing down a link in your email is much slower than having your password manager fill in the long unique random password and hitting "log in".
That's basically a passkey without its special API.
You can also randomly generate a password for the user on the form they'd normally type one in on registration. Add a "Regen" button to give users more visceral control over it before they submit the form.
That's essentially the same as magic links because most users won't remember/save that password and will have to rely on the usually email-based reset flow.
Sure, but this subset of user was going to otherwise reuse their password and be susceptible to cred-stuffing.
The point is to stop the attack and prevent users from accidentally hosing themselves.
Isn't that essentially a manual passkey?
Passwordless and passkeys. There are no credentials to stuff. Login with magic link, email OTP, passkey, etc. Get rid of the password, rate limit what remains.
Email OTP is garbage without the option to also add a password. That just outsources the problem to the user's email service, and assures that compromising the email inbox alone is enough to immediately also compromise every service that uses passwordless, 2FA-less "magic link" or OTP login.
Email services don't even support true 2FA; many claim to, and ask for a 2FA code for web login, but connecting an email account to a client via POP or IMAP bypasses that.
I implement customer identity and access management for millions of users in financial services, based on requirements driven in part by US federal regulatory and cyber insurance requirements. What’s your experience?
> Email services don't even support true 2FA; many claim to, and ask for a 2FA code for web login, but connecting an email account to a client via POP or IMAP bypasses that.
"In less than a year, passkeys have been used to authenticate people more than 1 billion times across over 400 million Google Accounts. Passkeys are easy to use and phishing resistant, only relying on a fingerprint, face scan or a pin making them 50% faster than passwords. In fact, on a daily basis passkeys are already used for authentication on Google Accounts more often than legacy forms of 2SV, such as SMS one-time passwords (OTPs) and app based OTPs (such as Authenticator apps) combined."
https://blog.google/innovation-and-ai/technology/safety-secu... (April 2024)
Don't forget: Microsoft is killing passwords. How to set up a Microsoft passkey before August deadline. - https://mashable.com/article/microsoft-passkey-how-to-passwo... - June 20th, 2025
(All major email providers support either passkeys, or in the case of Microsoft, passwordless ["strong authentication"]; we can consider the user creating an app specific secret for an external mail client minimal risk if performed after strong authentication has occurred, as the odds are low of that secret being phished or exfiltrated once configured in their mail client of choice, for the few folks interested in such a user experience with web based email services)
But passkeys are not supported natively (i.e. without a USB key or other shenanigans) by Firefox on Linux, as there is no place to store them. I do have a USB key, but it's annoying enough that I don't like passkeys if I can avoid them (instead using long randomly-generated passwords by Firefox's builtin-in password manager).
Maybe Lennart needs to write systemd-passkeyd .
I admit this is a gap, but this use case is a rounding error at the scale of users and daily logins. If someone wants to fix this, drop a link to sponsor the time and tokens needed to enable native support. Does a Yubikey or secure authenticator work for your use cases currently?
Yes, a yubikey works for when I really need it, but it's enough friction to take out out and plug in that it's just annoying enough.
I'll talk to some industry folks and see what we can do.
Rate limiting
Attacks have been distributed for quite some time if your service has any loot worth attacking. You have to handle the case where every request comes from a unique IP address.
Maybe if the number of failed logins per hour grows by 10000%
Ok, debian forky, 155.0.1, successfully logged into vultr.com after a year inactive, added a credit card and a little credit. I do, however, still stupidly use google authenticator for 2FA. The captcha was just a checkbox.
That said I have run into a number of unsolvable captchas lately on firefox. Had to use chromium on a healthcorp insurer site.
I don't mind a checkbox. I don't even mind the "proof of work" types that take 10 seconds extra. But identifying traffic-y things over and over is way too much for me. I did do one screen, thinking it would let me in, but it just gave me another.
I do use Firefox. And I couldn't cancel my account myself: had to request it via email since I couldn't login. They were good about doing it right away and said they issued a refund for the balance.
The captcha is not just a checkbox, it's recaptcha.
I've had this for a few months trying to log into https://console.vultr.com/...
It does it for me if I use a VPN (Mullvad) - if I don't use a VPN then I haven't noticed I get them.
But yeah, very annoying.
Most captchas are invisible as long as they like your IP and device. But they still do the fingerprinting in the background.
It's an archive.is issue:
https://en.wikipedia.org/wiki/Archive.today#2026_attack_on_G...
It's not that. Archive.today have simply used up their free quota.
What does this link have to do with anything?
They have some spat with cloudflare, so they "punish" cloudflare users by sending them into infinite captcha loops
They have nothing to do with Cloudflare. Their challenge page is only made to look like the one from Cloudflare. It's entirely their own page. Only the reCaptcha challenge is not theirs. And the reason why nobody gets redirected is because the have used up their free enterprise quota with reCaptcha, as you can read in the widget itself.
I've seen weird situations where I'm objectively solving the captcha correctly yet it still doesn't recognize it as correct.
At this point captchas need to be completely removed everywhere. They aren't effective and just waste time.
Captchas are often used as tarpits. They've already decided you're a bot based on other factors so you aren't getting in until you change those factors. I've seen this happen where I'm stuck in the loop and then change the VPN endpoint and get right in after one try.
I'm sure there exist examples where people maliciously give tasks (captchas) out that have no chance of getting the person anywhere, but it's definitely not common
Consider yourself lucky. I routinely run into tarpit Google reCAPTCHAs and I don't even use a VPN. I think it's because I run Linux and the site admins treat anything besides Windows, Mac, iOS, or Android Chrome as suspicious enough to blacklist. It has gotten to a point that I literally never even _try_ to do image-based CAPTCHAs anymore. If I can't access the site, oh well.
I also get infinite captchas but it's imo not a tarpit if it's not intentional but a bug
Edit: looked up the term, DDG shows a Wikipedia card saying "A tarpit is a service on a computer system that purposely delays incoming connections." (purposeful)
It may seem purposeful on Google's part but I bet that if we could get through to the developers for answers, it's probably not designed that way but we're running into a case where the system isn't designed to handle it
Which could be said to be intentional (excluding people with our FOSS setup), I guess
We were getting about few hundred spam registrations per day on one of our sites. With CF's captcha number drops to tens per day. I have no idea who and why make these registrations.
How do you know they are spam? I use disposable emails for registration wherever I can, and if there's too much friction I'll just drop it.
This might not solve the problem for you, when I get stuck in a captcha loop, I click the Audio option. I usually get past in 1 try.
The audio option will be blocked if you use it too much.
If you can reliably use it, you are not at the "deepest" bot detection level.
What does "use it too much" even mean for someone who is sight-impaired and who needs to use it every time?
Bernard from Westworld failing CAPTCHAs: Doesn't look like anything to me?
Constantly. It's made me stop using Google entirely because I can't run a single search without hitting reCAPTCHA. It's becoming problematic because some services I pay for, such as Bandcamp, also end up pestering me with boatloads of reCAPTCHAs. I enjoy Bandcamp, but I'm going to have to axe it if it keeps up.
Dunno, but is anyone else continuing to seem to get what feels like 3-4 minute reCaptcha challenges? I’m getting mentally exhausted having to try to solve the super blurry pick-the-streetlights they keep throwing at me in loops.
It feels like I have to go slowly through it only for it to eventually end in a “please try again” as I sit and wait ten seconds for each square to slowly fade in a new stupid bus for me to click.
How is this fair to the humans?
This is a tarpit. They've decided you're almost certainly a bot. If you're willing to solve the captchas for three minutes straight, they eventually might relent and let you in, or maybe not.
I doubt any human would solve them for 3 minutes straight, but a bot might. So closing and reloading the page (something a human would do) might work. Of course bots that don't do this will quickly figure out that they should - just like every other attempt to figure out if this is a bot or not...
There is no good automated answer. Things bots do to abuse web pages should be made illegal and then jail (fine...) the people who set the abusive bots loose - but I suspect most abusive bots are foreign and so we can't do anything without sending in an army (obviously unacceptable)
> I doubt any human would solve them for 3 minutes straight
Cognitive overload. There's days I'm just straight up tired and don't realize it until I'm at least one "please try again", page refresh, and endless traffic light game later that I'm probably in the tarpit and wonder why.
The weird thing is that I don't KNOW why. I use good ol' consumer Chrome, good ol' consumer MacOS, a consumer ISP, and my IP isn't in any kind of reputational blacklists that I'm aware of.
LG TV in your network scraping for AI companies? :P
In that case I'll stand corrected.
reCAPTCHA actually works for me. The one that asks if it's a sidewalk or a motorcycle or whatever right?
cloudflare bot detection has convinced itself I am a bot however (I do a lot of automated web related stuff on my home IP) and that's been an eye opener for sure... I can't enjoy a good 20% of the internet it seems like now.
Doesn't matter how many times I click that cloudflare button, they don't believe me.
And I've been signed in to my cloudflare account (which I've held in good standing with a live credit card for years) the entire time :/
Same experience for me. I get endless Cloudflare loops for many sites due to using less common browsers. Given that the goal is is distinguishing bots from actual humans, it seems to be a rather high failure rate. At least I think I'm human...
One method that does seem to help is being sloppy when clicking the "I am a human" checkbox. I suspected that bots were more likely to perfectly click the center of the checkbox every time and decided to try clicking the padding around the checkbox instead (which still registers as a click). It seems to be more successful, but it could be my imagination.
They are using every trick in the book, so I suspect your suspicions may be true.
Archive.today / Archive.is / Archive.ph issues the past few days. Safari Private w/iCloud Private Relay. See the enterprise free tier exceeded messaging:
That’s new, but problems/loops aren’t.I do not think that this is Firefox specific, more likely is is something Linux specific.
For me, hCaptcha has stopped working immediately before last weekend, regardless of the site that uses it.
It goes in an infinite loop, despite solving correctly all challenges.
On Linux, I have tested with 2 browsers, Firefox and Vivaldi, and the browser did not make any difference. I do not use any ad blockers, nor any non-standard extension.
So I think that they deployed a version update last Friday, which for some reason is broken on Linux.
It would not be surprising if both hCaptcha and Google ReCAPCHA have made some similar changes, so now they are both broken on Linux.
Meanwhile, some other "Captcha" applications from other vendors, which are used on other sites, still work like before.
I get this pretty frequently on windows Firefox after switching to it, note this is my work computer, Firefox works fine at home on more open network
I get reCaptchaed-to-death all the time in iOS and MacOS using both Firefox and Brave. I use a big name VPN which probably makes it worse, since I'm routinely blocked outright by Cloudfare services, assuming cluelessly that I'm a bot.
It doesn't work in Chrome either (please complete CAPTCHA/yes you're valid/repeat), it might be a config issue on archive.is (Firefox latest windows, Chrome 151 windows - guest/null profile on both) rather than a war move.
I also have the same issue in Firefox, Chromium and Vivaldi on Linux.
I tried searching the interweb for a cause/fix, but couldn't find anything sensible in the flood of low-quality SEO hijacking webcrap returned by multiple search engines. So I asked AI.
The claim is that it could be caused by the blocking of some DNS providers (NextDNS, Quad9, ..), and it suggested using a VPN or phone tethering.
And lo and behold, both suggestions worked, without any browser setting changes.
It's very annoying and inconvenient.
Yup, I get stuck in a loop.
Sometimes the audio recaptcha works. But, most of the time I can't understand the garbled audio.
Closing the tab always resolves the problem.
Google does this for a long time already.
You may want to use "Buster: Captcha Solver for Humans"[1], which uses the audio option to solve the CAPTCHA.
There are even several speech recognition methods, like wit.ai, which is basically from Facebook:
[1] https://github.com/dessant/busterNeat, threads and comments can be reposted [by admins/mods?]:
https://i.ibb.co/Q7qTtK16/Image.jpg
Note I posted the comment only once a day ago. Thread ID seems the same, but old timestamp is visible in my profile. Important issue for information freedom, HN relevant, so it’s back new on the front page?
Edit: good job Social-Protocols, its graph accommodates this unexpected (to me) scenario: https://news.social-protocols.org/stats?id=49555592
Yes, it's the Second-Chance Pool.[0]
[0] https://news.ycombinator.com/item?id=26998308
This is a good institution, helped prompt a discussion which was very useful to me about designing for e-ink.
Really, how so?
https://news.ycombinator.com/item?id=49213660
I made this post and it died on its arse initially, didn't even get an upvote. The second chance pool meant that it turned into a useful discussion about a pretty niche element of frontend development.
Ohhh I see thanks!
Ahh! Thanks
I've found that I can often stuck in tarpits on Safari for iOS with Wipr and iCloud Private Relay.
The worst trigger is searching Google from the address bar.
Loading the homepage first makes the problem notably less common. Or getting a couple wrong.
archive.today doesn't use a real recaptcha, the cloudflare page isn't real either. it serves that as a punishment for using 1.1.1.1 DNS because the owner doesn't like that 1.1.1.1 doesn't send EDNS client subnets.
They're definitely trying to mimic the cloudflare captcha page, but...
>archive.today doesn't use a real recaptcha
How? It's loading the script from google, and the images/responses are from google to.
I recall that the 1.1.1.1 block page doesn't serve the real one,, but the challenge page that they serve normally does. Maybe I'm misremembering? or maybe they changed it.
I just tested and it's the "real" recaptcha, with requests to google and everything. It still might be "fake" in the sense that the server rejects any response, even valid ones, which is probably what's actually happening.
What do you mean by "a real recaptcha"? I just went to an archive.is page, and it's trying to load a script from www.google.com. Doesn't Google still own reCAPTCHA?
> On 14 January 2026, it emerged that archive.today had silently modified its CAPTCHA page to send repeated requests to Gyrovague, thereby causing visitors to unwittingly contribute to a DDOS attack against the blog.
https://en.wikipedia.org/wiki/Archive.today#2026_attack_on_G...
It is telling that HN moderators allow links to archive.is/today
Rather than telling us that it is telling, perhaps you should tell us what it tells you and why?
Better to just ignore the anti-Russian and hasbara spam. It's being posted opportunistically. The chance to attack archive.is in an organically posted thread is probably the only reason an intermittent outage (common) of archive.is was upvoted enough to make it to the front page. Look at the top comment.
Why does it feel like everyone has just ignored/memory-holed this?
https://arstechnica.com/tech-policy/2026/02/wikipedia-bans-a...
That whole debacle is even specifically relevant to this thread because the operator of archive.today (aka archive.is) was caught using a script on its captcha page to make visitors' browsers connect to the blog they were mad at. That's how their DDOS attack worked. They used their own visitors, who naturally trusted the captcha page, to commit a crime.
For whatever reason, with the exception of Wikipedia (bless the editors), they seem to have gotten away with this, as well as with deliberately falsifying the content of "archived" pages (as described in the arstechnica article), without consequences.
So, call me crazy or a Russian bot if you want, but I think it's reasonable to be suspicious of any weird captcha behavior from this website in particular.
And HN users are being used as part of these attacks?
It tells us that the moderators of HN support copyright infringement and DDOS attacks. They are actively moderating this forum and choosing to do nothing.
They also choose to do nothing about uncharitable interpretations of their inactions. Should they act there too? Or do you prefer the hands-off approach when it suits you?
I can't control their behavior nor can you. But if you don't want to respond to the substance of my comment then perhaps you shouldn't respond?
I don't think it's very interesting even if true. I'm not that fussed about copyright infringement myself and I don't consider using archive.is (infrequently) to be condoning their DDOS.
Presumably you are and do. We differ.
This isn't about you personally. There is a public interest here.
I frequently have this issue with Safari in private browsing.
I've found two things that sometimes allow me through
either change the user-agent to the newest version for WINDOWS
and/or use cloudflare warp which is technically a free non-privatizing VPN
on linux you can use warp via wireguard + WGCF
* reddit.com/r/CloudFlare/comments/ty9hke
because of my privacy settings google search outright blocks me as a bot. the only way to search is through an intermediary like startpage. related because if it does give me the time of day i tend to then get endless captchas.
[dead]
Im usually on Firefox and I haven't run into this. But I also spent the past 2 days building a Knitsail VM solver in Rust for pulling Google Search results. Works nicely, I gave chatgpt pro (6) a minified JS bundle, and some variables and entries into the VM and told it to reconstruct the VM in Rust. Only took a couple hours to get a zip with a solver I could plug into my crawler, made a few mistakes but codex fixed those up with minimal guidance. No more Google captchas for me :)
I just tried and it doesn't happen for me, maybe the problem has already been fixed?
Separately, if I were seeing a captcha that I can't get past, my first reaction would be to find a different site to see if it's a site specific issue, because some sites intentionally configure their captcha to work like that (e.g. you can't get in until you have been stuck solving captchas for at least a minute). I would see that more as a signal that the site operator is user hostile and not attribute it to a captcha provider.
One interesting thing I found recently was after enforcing geo-fencing, recaptcha intermittently started failing. They might be using global edge servers or something
Not sure about Firefox but lately, if I access Google from Safari on my Mac with Apple's private relay on and private mode Safari, I get an endless captcha loop.
Yes. And even after solving the recaptcha it just wont accept and after multiple attemots even if it accepts it just goes on to display it all over again
Since last month I've been CAPTCHAed in many Google searchs in Firefox. I assumed either a local device was spamming them or maybe Codex/Claude web search was flagging me as a bot.
So is this CAPTCHAing because I refuse to navigate the ad-infested way? How can I rule out a problem on my end if my router is ISP provided with limited functionality ?
I have been seeing this, but it depends on my originating IP. I switched my house from Spectrum to T-mobile and then started getting ReCAPTCHAs on Firefox. Going out through another Spectrum connection on the same machine doesn't trigger the ReCAPTCHAs. It happens far, far less with chrome but it does still happen.
I don't think it has anything to do with google, it's an intermittent issue on the archive sites that usually clears out within an hour or two. You're being successful, then being bounced back out again.
Also firefox from linux. Just leave the pages open and refresh them every 20 minutes or so.
Yes , it (somehow) worked for me when I used VPN for a few days before not working again
If you're seeing an infinite CAPTCHA loop on archive.is, it's more likely that you're on the operator's shitlist than any technical issue. All Finnish IP addresses are on that shitlist already.
Yup. Before they just blackholed Finnish IP ranges instead, accessing the site from one would serve a fake Cloudflare page with a reCAPTCHA challenge and the DDoS script. (The tell of it being fake is y'know, that Cloudflare doesn't use reCAPTCHA)
I can only guess the goal was to keep users on that page longer to keep sending off more spam requests.
Total pain in the ass.
Half the time "Sign in with Google" doesn't work from Firefox either.
https://imgur.com/a/L5E5JgC
Anyone else getting this?
Ich bin kein Roboter. Diese Website überschreitet das kostenlose reCAPTCHA Enterprise-Kontingent.
I am not a robot. This website has exceeded the free reCAPTCHA Enterprise quota.
Is anybody aware of any ad-block lists (for Pi-Hole or Adguard) that block all of Google's IP addresses? And Meta while I'm at it?
PubMed and PMC use Recaptcha and it's atrocious. It never works with Firefox. It keeps looping even when filled correctly.
NIH support staff is even worse as they refuse to acknowledge the issue and reply with a scripted useless response.
If I remember correctly, Recaptcha doesn't work on GrapheneOS either which is a separate issue.
Interesting, saw reCAPTCHA infinite loop for the first time in a long time just yesterday, on Firefox, and it was when I tried to access an article on PMC. Disabling uBlock and Enhanced Tracking Protection did not help. It looked like several automatic reloads, then one real reCAPTCHA showed, and infinite reload loop after I solved it.
Does not reproduce today though, and I never had issues with PMC/NIH before that.
I've seen it on PMC. Strangely fixed by switching to a different firefox container ("container" in this context: https://support.mozilla.org/en-US/kb/how-use-firefox-contain...)
Yes. For months it ocurres every time when I opened Google in private mode, then it stopped and recently appeared even on phone
This has been happening since many months.
It's garbage all over the place.
Advertisers on Google should be paying a lot less than they were a year ago.
> Advertisers on Google should be paying a lot less than they were a year ago.
I wonder how the Google Search page traffic has been affected by the recent AI surge.
Very anecdotally, of course, but in my social circle (middle-class urban Romanians in their late 30s and early 40s) almost everyone I know has replaced a phrase like "I googled it and I found this and this and this" to "I chatGPT-ed and I found this and this and this" (where "chatGPT" can also be sometimes replaced by Claude and, not that often, by Gemini).
Yeah, I am also a firefox user for years. I think, i will indead switch to Chrome in the next weeks...
Yes. I use Firefox in Linux, with or without private window. Switch to Chrome to test and voilà, all good.
I have the issue in Firefox and in Chromium.
Anyone fighting for the removal of CAPCHA's or complaining about picking motorcycles or bridges is a bot and should be removed from this website. As a human, I have no problem solving these. I don't think I'm particularly clever but I am human. Bot psyop?!
works for me, with uBlock Origin enabled, one captcha solve was enough
but .... my user agent is way more finger printable then it should (e.g. has the Linux x86_64 part) so that might make the difference.
The open secret: the CAPTCHA wasn’t actually being checked against Google’s servers; any answer was accepted as correct – until yesterday, when someone armed with this knowledge launched an AI crawler. Now it’s being checked, so you’ll have to solve it.
I'm not sure why this is downvoted. It approximately checks out. An "assessment" only counts if your server tries to verify it, so you could conceivably use recaptcha for "free" if you don't bother validating the results. It also explains why other people have started seeing "This site is exceeding reCAPTCHA Enterprise free quota" message.
It's not possible to downvote comments on this website lol
If you're not seeing a downvote button your account is probably in some hole :p
Strict mode has always been broken for me. Firefox replaces some of Google's tracking scripts with no-ops but that usually breaks Google's reCAPTCHA on my end. I have to disable tracking protection to make reCAPTCHA sites work.
I think it's fair for Google not to fix Firefox's shims, so I don't know who to blame for this. I doubt it's part of some big conspiracy against Firefox, though. I don't think Google cares enough about Firefox to bother annoying Firefox users.
Archive.is has had downtime this weekend when I tried to use it. They also regularly pull shady stuff, so I wouldn't be surprised if they did something stupid again and got themselves banned from reCAPTCHA.
Can we just get rid of reCaptcha? It was fun when it was new, but now it's just pointless busywork to let Google know who we are. Does it do anything other than that? I don't for a minute believe bots can't solve that anymore.
It still works, bots can solve it but it probably increases the cost of that web call by 10x or 100x for that bot, so it won't bother. Had a recent bad experience with removing recaptcha.
I have bad experiences with recaptcha. It also increases user effort, and they might not bother either. AI doesn't get annoyed as easily.
https://youtu.be/4VrLQXR7mKU
“Um, I know this may be a very personal question, but is it possible that you…could we say…may be…a Robot?”
[flagged]
[dead]
[dead]
[flagged]
67
Yes, recaphca's become far more intrusive to this ff user