←back to thread

1134 points mtlynch | 2 comments | | HN request time: 0.466s | source
1. abunner ◴[] No.22941269[source]
This is how other companies gather fraud signals as well. If you've ever clicked "I am not a robot", it also works on signals like mouse movements. Stripe is following industry best practices.
replies(1): >>22941380 #
2. mtlynch ◴[] No.22941380[source]
I haven't used reCAPTCHA, but based on my understanding from Google's documentation[0], there are a few differences:

1. reCAPTCHA doesn't send information until you explicitly call their library. Stripe's library immediately begins reporting to data as soon as the script is loaded.

2. reCAPTCHA is explicit in its documentation that it's collecting behavior about your users. Its sole purpose is to track user behavior, so implementers understand that it does this. Stripe's main purpose is to accept payment information, and it is currently not transparent about how it collects user behavior to achieve that. I don't believe that most implementers understand the nature of Stripe's data collection.

[0] https://developers.google.com/recaptcha/docs/v3