Member Avatar for PureManurea

Hit upon this thing recently. Seems like a good alternative to Google's reCaptcha. Website users solve the captcha, website owners get paid and AI companies get their data labeled.

What do you think guys?

  • 3 Contributors
  • 3 Replies
  • 516 Views
  • 2 Hours Discussion Span
  • Latest Post Latest Post by rproffitt

Dani AI

Generated

Good points from the thread. spotted the publisher-paid captcha model, laid out the publisher tradeoff, and raised the sensible privacy/security flags. Below is a compact, practical checklist and a small integration pattern to help decide whether to adopt a paid captcha widget without repeating the examples already linked in the thread.

Checklist before you deploy

  • Run a privacy audit in dev: load the widget, capture network traffic and note exactly what is sent (tokens, cookies, full page HTML, referrer, headers).
  • Check legal/terms: data retention, downstream buyers, whether you need user consent under relevant laws.
  • Accessibility: confirm keyboard, aria, and audio options; test with a screen reader.
  • Performance: async load, defer verification to server, and measure added latency.
  • Security: require server-side verification of the challenge token, rotate keys, and prefer fail-safe behavior (challenge again or block) rather than silently accepting.
  • Monetization checks: verify payout proof, thresholds, and the provider’s abuse-fighting policies.

Integration and testing tips

  • Instrument logging: record challenge results, scores, IPs, and timestamps so you can spot false positives and abuse patterns.
  • Staging tests: simulate low-bandwidth, no-JS, and automation scenarios. Use an intercepting proxy to inspect payloads.
  • Fallbacks: implement a progressive flow—if the widget fails or score is low, fall back to a server-side step such as a one-time email token or a simple honeypot field.

Example server-side verification pattern (generic)

<?php
$token = $_POST['captcha_token'] ?? '';
if (!$token) { http_response_code(400); exit('captcha required'); }

// implement provider POST in verify_with_provider()
$result = verify_with_provider($token, SECRET_KEY);

if (!empty($result['success']) && ($result['score'] ?? 1) >= 0.5) {
    // accept request
} else {
    // log, increase suspicion counter, present fallback (email OTP, captcha retry)
    http_response_code(403);
    exit('failed captcha');
}
?>

Bottom line: treat any third-party captcha like a tracker you must audit. If the revenue is attractive, verify the payout mechanics and legal implications, test thoroughly in staging, and monitor after launch.

Recommended Answers

All 3 Replies

Member Avatar for Dani

rproffitt,

The idea of using captcha to classify photos has been around. The twist here is that website owners earn money each time the captcha is used. This benefits the website owner because they need a captcha, so they might as well make money from having one at the same time.

Let's be honest: Just about every CAPTCHA service nowadays crowdsources and crunches data. Google's reCAPTCHA service crowdsources data for the benefits of their self-driving cars and other Google initiative. That's why you're always clicking on images of roads and street signs. This service, however, seems to be an agency between publishers and third-party companies that need their image data crowdsourced.

From a publisher's perspective, you need a CAPTCHA service, and have two choices:

  • Use the de-factor standard, reCAPTCHA, and essentially allow Google to data mine your visitors in exchange for them protecting your site from bots. In other words, Google utilizes the data directly for their own needs and doesn't compensate you directly for the benefit of it.
  • Use this service, allow third-party clients of hCaptcha to data mine your visitors, get protection from bots, and earn cash money as well. This service compensates you with a portion of the proceeds they receive from their clients for crunching their clients' data.
Edited by Dani
Member Avatar for rproffitt

Let's not forget the dark side of Captcha where it was used as a game to automate site hacking. Folk were playing a game and unknowingly helping bypass legitimate Captha systems.

Also https://anti-captcha.com/mainpage

I'm sure it was a great idea and folk want some way to monetize and not feed the beast but stepping back to view how broken this is, any re-do is just that. But hey, it's not nearly as scary as the SIM SWAP exploit.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.