Cloudflare is nixing Google’s reCAPTCHA tool and replacing it with what the network services company’s CEO calls “a better CAPTCHA” service, hCaptcha.
Google’s reCAPTCHA is a type of CAPTCHA (an acronym for “Completely Automated Public Turing Test to Tell Computers and Humans Apart”) that uses prompts to decipher humans from potentially malicious machines or bots. Cloudflare said the main driver for the swap was that Google is now charging for use of its reCAPTCHA tool – but customer privacy and availability were other factors. A Google spokesperson clarified to Threatpost that there is no charge for this service for under a 1M queries/month limit.
“We’re excited about this change because it helps address a privacy concern inherent to relying on a Google service that we’ve had for some time and also gives us more flexibility to customize the CAPTCHAs we show,” said Cloudflare CEO Matthew Prince, along with product manager Sergi Isasi, in a Wednesday post.
ReCAPTCHA started as a research project out of Carnegie Mellon University in 2007, and was later acquired by Google in 2009. Fast forward to today, Google’s reCAPTCHA service (v3) is utilized by over 1.5 million websites for rooting out bots. Cloudflare is one of those customers, utilizing Google’s reCAPTCHA service since “its earliest days.”
“When we were looking for a CAPTCHA for Cloudflare, we chose reCAPTCHA because it was effective, could scale, and was offered for free — which was important since so many of Cloudflare’s customers use our free service,” said Prince.
Google initially provided reCAPTCHA for free in exchange for data from the service, which was used to train its visual identification systems. But according to Prince, earlier this year Google said they plan to start charging for reCAPTCHA use. According to The Register, Google said there’s no charge for reCAPTCHA unless customers exceed one million queries per month (or 1,000 API calls per second).
While “it makes perfect sense for Google to ask for payment for the service they provide,” Prince said, “In our case, that would have added millions of dollars in annual costs just to continue to use reCAPTCHA for our free users. That was finally enough of an impetus for us to look for a better alternative.”
Another driving factor for the switch is privacy and availability, Prince said. Because the service was initially offered for free in exchange for data, Cloudflare customers expressed concerns over the years about Google’s business targeting them with ads (although Google has said in the past that its reCAPTCHA service is not used for ad targeting). In addition, Google’s services are blocked in some regions, including China (which accounts for 25 percent of all Internet users) – meaning that Google’s reCAPTCHA service was not available to Cloudflare customers.
“Over the years, the privacy and blocking concerns were enough to cause us to think about switching from reCAPTCHA,” said Prince. “But, like most technology companies, it was difficult to prioritize removing something that was largely working instead of brand new features and functionality for our customers.”
After evaluating a number of CAPTCHA vendors (and even pondering building their own system), Cloudflare chose hCaptcha as an alternative to reCAPTCHA. hCaptcha, a service from AI and machine learning company Intuition Machines Inc., bills itself as a free, “a drop-in replacement for reCAPTCHA: you can switch within minutes” on its website.
The standard hCaptcha business model is similar to the two-pronged model that reCAPTCHA first used when it began: hCaptcha charges customers that need image classification data, and on the other end pays publishers to install their CAPTCHA on their sites. However, because of Cloudflare’s massive scale, the company will be paying Intuition Machines Inc. (instead of being paid by the company) to use hCaptcha with a bigger amount of resources and more scalable infrastructure. While Cloudflare will be paying hCaptcha, the costs will still be “a fraction” of the price of Google’s reCAPTCHA.
On the privacy front, Prince contends hCaptcha doesn’t sell personal data, and only collects “minimum necessary personal data.” He also cited hCaptcha’s performance and expanded availability (to regions where Google was blocked) as other reasons why it was a good alternative to reCAPTCHA.
CAPTCHAs have long been used by websites and services to root out bots – but security researchers have expressed security concerns over the years about their abilities to bypass CAPTCHA systems. Researchers have proved time and time again that they are able to bypass Google’s reCAPTCHA, for instance.
Deepak Patel, security evangelist with PerimeterX, said the move from reCAPTCHA to hCaptcha underscores the imperfections with the verification system.
“hCaptcha is monetizing the CAPTCHA solving work performed by site visitors in a slightly different fashion from Google; it is allowing for companies other than the website owners to bid for the work performed by the site visitors,” he said via email. “Even as organizations attempt to make challenges [the prompts presented by CAPTCHAS] easier for humans and harder for bots, the reality is that challenges are easier for bots, and people are stuck choosing pictures from a collage and taking further time out of their shopping experience.”
Threatpost has reached out to Google for further clarification about the price changes for reCAPTCHA.
Worried about your cloud security in the work-from-home era? On April 23 at 2 p.m. ET, join DivvyCloud and Threatpost for a FREE webinar, A Practical Guide to Securing the Cloud in the Face of Crisis. Get exclusive research insights and critical, advanced takeaways on how to avoid cloud disruption and chaos in the face of COVID-19 – and during all times of crisis. Please register here for this sponsored webinar.
