Is this part of Google's war against ad-blocking and non-Chrome browsers?
Ask HN: Are others seeing Google's reCAPTCHA rejecting Firefox users? (self)
248 pointsby Animats6 days ago122 comments
Infinite Google ReCAPCHA loop trying to access archive.is using current Firefox from Linux. Just started today. Firefox is in "strict" mode. Disabled Privacy Badger for that site, and it didn't help. Tried private browsing, and it didn't help.
prirun 5 days ago
I've used vultr.com for years with no problems. Recently it wouldn't let me login without solving a Google captcha. I tried private windows, etc and ended up having to cancel my Vultr account and ask for a refund. Fortunately I only used them to spin up test VMs and didn't have any production stuff running there.
I refuse to pay a company for service and then be required to identify motorcycles and traffic lights every time I sign in. I went a few rounds with Vultr customer service and they said (paraphrasing) "It's not something we can fix, you have to talk to Google about it". Right... Google forced you to put their captcha on your web site.
pixelesque 21 hours ago
I've had this for a few months trying to log into https://console.vultr.com/...
It does it for me if I use a VPN (Mullvad) - if I don't use a VPN then I haven't noticed I get them.
But yeah, very annoying.
basilikum 20 hours ago
Most captchas are invisible as long as they like your IP and device. But they still do the fingerprinting in the background.
account42 20 hours ago
CAPTCHA for login should just be outright illegal, especially if it blocks important functionality like closing your account.
PaoloBarbolini 20 hours ago
A few years ago a service for which we had just implemented a scraper for (they had no API, and the customer needed info from 1000s of accounts) added a captcha right after we had implemented the scraper.
We quickly figured out that the server didn't validate the captcha challenge code with Google. It worked for 3 years until they changed the system to send a code via email to validate your login, and limiting you to 1 session at-a-time. Now we have different problems to deal with...
econ 20 hours ago
Maybe if the number of failed logins per hour grows by 10000%
gruez 19 hours ago
>CAPTCHA for login should just be outright illegal
How do you prevent credential stuffing attacks?
>especially if it blocks important functionality like closing your account.
That just falls under standard tort law, not to mention recent "click to cancel" legislation some states have been introducing.
JoshTriplett 18 hours ago
> How do you prevent credential stuffing attacks?
CAPTCHAs don't work anymore, at this point. AI can trivially solve them.
Rate-limit the number of attempts, test accounts against known-password lists like HIBP, and support 2FA.
gruez 18 hours ago
>CAPTCHAs don't work anymore, at this point. AI can trivially solve them.
The point is to raise the cost, not to create some impenetrable barrier. A $5 vps can make hundreds of requests per second. IP bans and rate limiting forces people to use residential proxies, which are like $5/GB. That's much more expensive, but still cheap. Not sure about the token cost of AI is like, but captcha solving service used to charge around $0.002 per solve, which increases costs even more.
GoblinSlayer 17 hours ago
For credential stuffing you need only one attempt.
gruez 17 hours ago
No, it's a numbers game on both sides. Attackers are after hundreds or thousands of accounts, not just one. Defenders knows that exactly 0 hacks are impossible to achieve, and they're just trying to limit losses from fraud, but also costs from anti-fraud.
GoblinSlayer 17 hours ago
They have so many accounts broken daily? Then credential stuffing attacks are not prevented.
olyjohn 14 hours ago
Then you don't need to automate it, and you can just manually solve the captcha and log in.
bellowsgulch 17 hours ago
There is no raised cost anymore. Every professional doing this work has perfect alignment with regular consumer heuristics.
OS, browser, fingerprinting, networked bytes, residential address spaces.
All of it is done.
nisegami 17 hours ago
>How do you prevent credential stuffing attacks?
Passkeys or magic links seem like the way forward here.
hombre_fatal 17 hours ago
You can also randomly generate a password for the user on the form they'd normally type one in on registration. Add a "Regen" button to give users more visceral control over it before they submit the form.
account42 2 hours ago
That's essentially the same as magic links because most users won't remember/save that password and will have to rely on the usually email-based reset flow.
JoshTriplett 12 hours ago
Please don't. I find such services obnoxious, especially when they aggressively log you back out. Chasing down a link in your email is much slower than having your password manager fill in the long unique random password and hitting "log in".
vablings 16 hours ago
Passkey only. No passwords no usernames just passkey
olyjohn 14 hours ago
At the minimum, stop using goddamn email addresses for the login.
Plont 13 hours ago
I'm not giving up recovery codes, nor my ability to default to locking out people who physically have my device. I usually don't allow auto-login or biometrics login either.
If a website/app goes passkey only (or, even worse, if it starts relying only on one-time email codes), I won't use it.
I know plenty of others who feel the same, though I don't know if we're numerous enough to put a dent in a company's bottom line or not. I imagine it depends on the company and its target audience.
iambenm 18 hours ago
Rate limiting
hombre_fatal 17 hours ago
Attacks have been distributed for quite some time if your service has any loot worth attacking. You have to handle the case where every request comes from a unique IP address.
toomuchtodo 14 hours ago
Passwordless and passkeys. There are no credentials to stuff. Login with magic link, email OTP, passkey, etc. Get rid of the password, rate limit what remains.
Plont 13 hours ago
Email OTP is garbage without the option to also add a password. That just outsources the problem to the user's email service, and assures that compromising the email inbox alone is enough to immediately also compromise every service that uses passwordless, 2FA-less "magic link" or OTP login.
Email services don't even support true 2FA; many claim to, and ask for a 2FA code for web login, but connecting an email account to a client via POP or IMAP bypasses that.
toomuchtodo 13 hours ago
I implement customer identity and access management for millions of users in financial services, based on requirements driven in part by US federal regulatory and cyber insurance requirements. What’s your experience?
> Email services don't even support true 2FA; many claim to, and ask for a 2FA code for web login, but connecting an email account to a client via POP or IMAP bypasses that.
"In less than a year, passkeys have been used to authenticate people more than 1 billion times across over 400 million Google Accounts. Passkeys are easy to use and phishing resistant, only relying on a fingerprint, face scan or a pin making them 50% faster than passwords. In fact, on a daily basis passkeys are already used for authentication on Google Accounts more often than legacy forms of 2SV, such as SMS one-time passwords (OTPs) and app based OTPs (such as Authenticator apps) combined."
https://blog.google/innovation-and-ai/technology/safety-secu... (April 2024)
Don't forget: Microsoft is killing passwords. How to set up a Microsoft passkey before August deadline. - https://mashable.com/article/microsoft-passkey-how-to-passwo... - June 20th, 2025
(All major email providers support either passkeys, or in the case of Microsoft, passwordless ["strong authentication"]; we can consider the user creating an app specific secret for an external mail client minimal risk if performed after strong authentication has occurred, as the odds are low of that secret being phished or exfiltrated once configured in their mail client of choice, for the few folks interested in such a user experience with web based email services)
dpifke 12 hours ago
I never got a response when I wrote to the FTC, requesting formal guidance as to whether having to disable NoScript (a browser security measure) to complete a CAPTCHA to unsubscribe from email spam satisfies 16 CFR § 316:
"Neither a sender nor any person acting on behalf of a sender may require that any recipient pay any fee, provide any information other than the recipient's electronic mail address and opt-out preferences, or take any other steps except sending a reply electronic mail message or visiting a single Internet Web page"
https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C...
A simple reading says, no. But I guess they don't want to put that in writing.
downut 19 hours ago
Ok, debian forky, 155.0.1, successfully logged into vultr.com after a year inactive, added a credit card and a little credit. I do, however, still stupidly use google authenticator for 2FA. The captcha was just a checkbox.
That said I have run into a number of unsolvable captchas lately on firefox. Had to use chromium on a healthcorp insurer site.
GoblinSlayer 17 hours ago
The captcha is not just a checkbox, it's recaptcha.
prirun 16 hours ago
I don't mind a checkbox. I don't even mind the "proof of work" types that take 10 seconds extra. But identifying traffic-y things over and over is way too much for me. I did do one screen, thinking it would let me in, but it just gave me another.
I do use Firefox. And I couldn't cancel my account myself: had to request it via email since I couldn't login. They were good about doing it right away and said they issued a refund for the balance.
selcuka 5 days ago
It's an archive.is issue:
https://en.wikipedia.org/wiki/Archive.today#2026_attack_on_G...
pessimizer 20 hours ago
What does this link have to do with anything?
gruez 19 hours ago
They have some spat with cloudflare, so they "punish" cloudflare users by sending them into infinite captcha loops
emsign 16 hours ago
They have nothing to do with Cloudflare. Their challenge page is only made to look like the one from Cloudflare. It's entirely their own page. Only the reCaptcha challenge is not theirs. And the reason why nobody gets redirected is because the have used up their free enterprise quota with reCaptcha, as you can read in the widget itself.
emsign 20 hours ago
It's not that. Archive.today have simply used up their free quota.
VCFundedGenYer 5 days ago
I've seen weird situations where I'm objectively solving the captcha correctly yet it still doesn't recognize it as correct.
At this point captchas need to be completely removed everywhere. They aren't effective and just waste time.
deltoidmaximus 5 days ago
Captchas are often used as tarpits. They've already decided you're a bot based on other factors so you aren't getting in until you change those factors. I've seen this happen where I'm stuck in the loop and then change the VPN endpoint and get right in after one try.
Aachen 20 hours ago
I'm sure there exist examples where people maliciously give tasks (captchas) out that have no chance of getting the person anywhere, but it's definitely not common
bityard 18 hours ago
Consider yourself lucky. I routinely run into tarpit Google reCAPTCHAs and I don't even use a VPN. I think it's because I run Linux and the site admins treat anything besides Windows, Mac, iOS, or Android Chrome as suspicious enough to blacklist. It has gotten to a point that I literally never even _try_ to do image-based CAPTCHAs anymore. If I can't access the site, oh well.
radiorental 20 hours ago
This might not solve the problem for you, when I get stuck in a captcha loop, I click the Audio option. I usually get past in 1 try.
anticrymactic 18 hours ago
The audio option will be blocked if you use it too much.
If you can reliably use it, you are not at the "deepest" bot detection level.
steelframe 16 hours ago
What does "use it too much" even mean for someone who is sight-impaired and who needs to use it every time?
mac-attack 18 hours ago
Bernard from Westworld failing CAPTCHAs: Doesn't look like anything to me?
xenator 18 hours ago
We were getting about few hundred spam registrations per day on one of our sites. With CF's captcha number drops to tens per day. I have no idea who and why make these registrations.
elric 20 hours ago
Constantly. It's made me stop using Google entirely because I can't run a single search without hitting reCAPTCHA. It's becoming problematic because some services I pay for, such as Bandcamp, also end up pestering me with boatloads of reCAPTCHAs. I enjoy Bandcamp, but I'm going to have to axe it if it keeps up.
kotaKat 5 days ago
Dunno, but is anyone else continuing to seem to get what feels like 3-4 minute reCaptcha challenges? I’m getting mentally exhausted having to try to solve the super blurry pick-the-streetlights they keep throwing at me in loops.
It feels like I have to go slowly through it only for it to eventually end in a “please try again” as I sit and wait ten seconds for each square to slowly fade in a new stupid bus for me to click.
How is this fair to the humans?
StilesCrisis 21 hours ago
This is a tarpit. They've decided you're almost certainly a bot. If you're willing to solve the captchas for three minutes straight, they eventually might relent and let you in, or maybe not.
bluGill 20 hours ago
I doubt any human would solve them for 3 minutes straight, but a bot might. So closing and reloading the page (something a human would do) might work. Of course bots that don't do this will quickly figure out that they should - just like every other attempt to figure out if this is a bot or not...
There is no good automated answer. Things bots do to abuse web pages should be made illegal and then jail (fine...) the people who set the abusive bots loose - but I suspect most abusive bots are foreign and so we can't do anything without sending in an army (obviously unacceptable)
kotaKat 19 hours ago
> I doubt any human would solve them for 3 minutes straight
Cognitive overload. There's days I'm just straight up tired and don't realize it until I'm at least one "please try again", page refresh, and endless traffic light game later that I'm probably in the tarpit and wonder why.
The weird thing is that I don't KNOW why. I use good ol' consumer Chrome, good ol' consumer MacOS, a consumer ISP, and my IP isn't in any kind of reputational blacklists that I'm aware of.
bluGill 19 hours ago
In that case I'll stand corrected.
nullc 2 minutes ago
LG TV in your network scraping for AI companies? :P
johnnyApplePRNG 19 hours ago
reCAPTCHA actually works for me. The one that asks if it's a sidewalk or a motorcycle or whatever right?
cloudflare bot detection has convinced itself I am a bot however (I do a lot of automated web related stuff on my home IP) and that's been an eye opener for sure... I can't enjoy a good 20% of the internet it seems like now.
Doesn't matter how many times I click that cloudflare button, they don't believe me.
And I've been signed in to my cloudflare account (which I've held in good standing with a live credit card for years) the entire time :/
sourweasel 15 hours ago
Same experience for me. I get endless Cloudflare loops for many sites due to using less common browsers. Given that the goal is is distinguishing bots from actual humans, it seems to be a rather high failure rate. At least I think I'm human...
One method that does seem to help is being sloppy when clicking the "I am a human" checkbox. I suspected that bots were more likely to perfectly click the center of the checkbox every time and decided to try clicking the padding around the checkbox instead (which still registers as a click). It seems to be more successful, but it could be my imagination.
johnnyApplePRNG 14 hours ago
They are using every trick in the book, so I suspect your suspicions may be true.
adrian_b 5 days ago
I do not think that this is Firefox specific, more likely is is something Linux specific.
For me, hCaptcha has stopped working immediately before last weekend, regardless of the site that uses it.
It goes in an infinite loop, despite solving correctly all challenges.
On Linux, I have tested with 2 browsers, Firefox and Vivaldi, and the browser did not make any difference. I do not use any ad blockers, nor any non-standard extension.
So I think that they deployed a version update last Friday, which for some reason is broken on Linux.
It would not be surprising if both hCaptcha and Google ReCAPCHA have made some similar changes, so now they are both broken on Linux.
Meanwhile, some other "Captcha" applications from other vendors, which are used on other sites, still work like before.
oh_no 20 hours ago
I get this pretty frequently on windows Firefox after switching to it, note this is my work computer, Firefox works fine at home on more open network
randcraw 18 hours ago
I get reCaptchaed-to-death all the time in iOS and MacOS using both Firefox and Brave. I use a big name VPN which probably makes it worse, since I'm routinely blocked outright by Cloudfare services, assuming cluelessly that I'm a bot.
fransje26 20 hours ago
I also have the same issue in Firefox, Chromium and Vivaldi on Linux.
I tried searching the interweb for a cause/fix, but couldn't find anything sensible in the flood of low-quality SEO hijacking webcrap returned by multiple search engines. So I asked AI.
The claim is that it could be caused by the blocking of some DNS providers (NextDNS, Quad9, ..), and it suggested using a VPN or phone tethering.
And lo and behold, both suggestions worked, without any browser setting changes.
It's very annoying and inconvenient.
Barbing 2 days ago
Archive.today / Archive.is / Archive.ph issues the past few days. Safari Private w/iCloud Private Relay. See the enterprise free tier exceeded messaging:
This site is exceeding reCAPTCHA Enterprise free quota.
gnabgib 5 days ago
It doesn't work in Chrome either (please complete CAPTCHA/yes you're valid/repeat), it might be a config issue on archive.is (Firefox latest windows, Chrome 151 windows - guest/null profile on both) rather than a war move.
Barbing 20 hours ago
Neat, threads and comments can be reposted [by admins/mods?]:
https://i.ibb.co/Q7qTtK16/Image.jpg
Note I posted the comment only once a day ago. Thread ID seems the same, but old timestamp is visible in my profile. Important issue for information freedom, HN relevant, so it’s back new on the front page?
Edit: good job Social-Protocols, its graph accommodates this unexpected (to me) scenario: https://news.social-protocols.org/stats?id=49555592
PyWoody 19 hours ago
Yes, it's the Second-Chance Pool.[0]
BoxOfRain 18 hours ago
This is a good institution, helped prompt a discussion which was very useful to me about designing for e-ink.
Barbing 7 hours ago
Really, how so?
Barbing 7 hours ago
Ahh! Thanks
weedfroglozenge 6 hours ago
Anyone fighting for the removal of CAPCHA's or complaining about picking motorcycles or bridges is a bot and should be removed from this website. As a human, I have no problem solving these. I don't think I'm particularly clever but I am human. Bot psyop?!
nosioptar 6 days ago
Yup, I get stuck in a loop.
Sometimes the audio recaptcha works. But, most of the time I can't understand the garbled audio.
Closing the tab always resolves the problem.
KomoD 5 days ago
archive.today doesn't use a real recaptcha, the cloudflare page isn't real either. it serves that as a punishment for using 1.1.1.1 DNS because the owner doesn't like that 1.1.1.1 doesn't send EDNS client subnets.
foresto 5 days ago
What do you mean by "a real recaptcha"? I just went to an archive.is page, and it's trying to load a script from www.google.com. Doesn't Google still own reCAPTCHA?
selcuka 5 days ago
> On 14 January 2026, it emerged that archive.today had silently modified its CAPTCHA page to send repeated requests to Gyrovague, thereby causing visitors to unwittingly contribute to a DDOS attack against the blog.
https://en.wikipedia.org/wiki/Archive.today#2026_attack_on_G...
cactusplant7374 5 days ago
It is telling that HN moderators allow links to archive.is/today
dcminter 20 hours ago
Rather than telling us that it is telling, perhaps you should tell us what it tells you and why?
pessimizer 20 hours ago
Better to just ignore the anti-Russian and hasbara spam. It's being posted opportunistically. The chance to attack archive.is in an organically posted thread is probably the only reason an intermittent outage (common) of archive.is was upvoted enough to make it to the front page. Look at the top comment.
Plont 13 hours ago
Why does it feel like everyone has just ignored/memory-holed this?
https://arstechnica.com/tech-policy/2026/02/wikipedia-bans-a...
That whole debacle is even specifically relevant to this thread because the operator of archive.today (aka archive.is) was caught using a script on its captcha page to make visitors' browsers connect to the blog they were mad at. That's how their DDOS attack worked. They used their own visitors, who naturally trusted the captcha page, to commit a crime.
For whatever reason, with the exception of Wikipedia (bless the editors), they seem to have gotten away with this, as well as with deliberately falsifying the content of "archived" pages (as described in the arstechnica article), without consequences.
So, call me crazy or a Russian bot if you want, but I think it's reasonable to be suspicious of any weird captcha behavior from this website in particular.
cactusplant7374 10 hours ago
And HN users are being used as part of these attacks?
cactusplant7374 19 hours ago
It tells us that the moderators of HN support copyright infringement and DDOS attacks. They are actively moderating this forum and choosing to do nothing.
dcminter 18 hours ago
They also choose to do nothing about uncharitable interpretations of their inactions. Should they act there too? Or do you prefer the hands-off approach when it suits you?
cactusplant7374 16 hours ago
I can't control their behavior nor can you. But if you don't want to respond to the substance of my comment then perhaps you shouldn't respond?
dcminter 12 hours ago
I don't think it's very interesting even if true. I'm not that fussed about copyright infringement myself and I don't consider using archive.is (infrequently) to be condoning their DDOS.
Presumably you are and do. We differ.
cactusplant7374 10 hours ago
This isn't about you personally. There is a public interest here.
gruez 5 days ago
They're definitely trying to mimic the cloudflare captcha page, but...
>archive.today doesn't use a real recaptcha
How? It's loading the script from google, and the images/responses are from google to.
KomoD 5 days ago
I recall that the 1.1.1.1 block page doesn't serve the real one,, but the challenge page that they serve normally does. Maybe I'm misremembering? or maybe they changed it.
gruez 19 hours ago
I just tested and it's the "real" recaptcha, with requests to google and everything. It still might be "fake" in the sense that the server rejects any response, even valid ones, which is probably what's actually happening.
realslimjd 5 days ago
I frequently have this issue with Safari in private browsing.
omoikane 17 hours ago
I just tried and it doesn't happen for me, maybe the problem has already been fixed?
Separately, if I were seeing a captcha that I can't get past, my first reaction would be to find a different site to see if it's a site specific issue, because some sites intentionally configure their captcha to work like that (e.g. you can't get in until you have been stuck solving captchas for at least a minute). I would see that more as a signal that the site operator is user hostile and not attribute it to a captcha provider.
ectoloph 20 hours ago
I've found that I can often stuck in tarpits on Safari for iOS with Wipr and iCloud Private Relay.
The worst trigger is searching Google from the address bar.
Loading the homepage first makes the problem notably less common. Or getting a couple wrong.
globalnode 5 days ago
because of my privacy settings google search outright blocks me as a bot. the only way to search is through an intermediary like startpage. related because if it does give me the time of day i tend to then get endless captchas.
n4pw01f 19 hours ago
One interesting thing I found recently was after enforcing geo-fencing, recaptcha intermittently started failing. They might be using global edge servers or something
WaasilaAsif 20 hours ago
Yes. And even after solving the recaptcha it just wont accept and after multiple attemots even if it accepts it just goes on to display it all over again
busymom0 5 days ago
Not sure about Firefox but lately, if I access Google from Safari on my Mac with Apple's private relay on and private mode Safari, I get an endless captcha loop.
wastedpotencial 19 hours ago
Since last month I've been CAPTCHAed in many Google searchs in Firefox. I assumed either a local device was spamming them or maybe Codex/Claude web search was flagging me as a bot.
So is this CAPTCHAing because I refuse to navigate the ad-infested way? How can I rule out a problem on my end if my router is ISP provided with limited functionality ?
unbolted3032 11 hours ago
Is anybody aware of any ad-block lists (for Pi-Hole or Adguard) that block all of Google's IP addresses? And Meta while I'm at it?
eMpHaSe 10 hours ago
Yeah, I am also a firefox user for years. I think, i will indead switch to Chrome in the next weeks...
KinetiNode 5 days ago
Yes , it (somehow) worked for me when I used VPN for a few days before not working again