HellCaptcha: Accessibility Theater at Its Worst
a year ago
- #web-development
- #accessibility
- #CAPTCHA
- hCaptcha's 'Accessibility' mode is non-functional and relies on a broken cookie system.
- The cookie bypass feature fails silently, requires a U.S. phone number, and offers no transparency.
- The text-based challenge is only available if the website enables it, leaving many users without an accessible option.
- hCaptcha's failures exclude disabled users from basic online activities like logging in or submitting forms.
- Alternatives to hCaptcha include Cloudflare Turnstile, honeypots, behavioral analysis, and progressive challenge escalation.
- Many sites don't need CAPTCHA at all and can rely on simpler methods like CSRF tokens and rate limits.