Why Captchas have gotten so difficult • Hacker News Board

Re: Why Captchas have gotten so difficult

#101

Post by johnisgood » Sun, Feb 03, 2019, 7:41 PM UTC

pmoriarty wrote: post #84

userbinator wrote: post #64

Earlier quoted context omitted.

Indeed, I definitely am not happy with how much control Google has over the Internet in general. Everything from how they present and rank search results, Google Analytics scripts everywhere, the sometimes vaguely-political messages on their homepage, the ostensibly-anti-bot checks including CAPTCHAs and just plain banning you if you want to do more "advanced" searches (like the ones Fravia would've taught...), etc.

There's other (mysterious to me) stuff that sites call to Google for, apart from captchas and analytics. As a uMatrix (and former NoScript) user, I've long noticed that many sites make calls to ajax.googleapis.com for I have no idea what. Quite often the site will refuse to work without that. To be fair, a lot of sites make use of javascript from a lot of other sites as well: cloudfront and amazon are common.

Yeah, or Akamai.

Re: Why Captchas have gotten so difficult

#102

Post by CM30 » Sun, Feb 03, 2019, 7:46 PM UTC

TorKlingberg wrote: post #81

I find it strange how all the comments here are blaming Google. Isn't it obvious that CAPTCHAs have gotten difficult because AI got better at solving them? Soon bots will be better than humans at solving CAPTCHAs, and the system will fail completely. I predict that then Google and Facebook will completely block new user signup from Tor, VPNs or browsers without cookines. Everyone else will require an existing Google,…

It's not even bots that are breaking them much of the time. The spammers just get people in third world countries/using mechanical turk type services to break them. Captchas like this cannot stop a human determined to break the rules.

Re: Why Captchas have gotten so difficult

#103

Post by dessant » Sun, Feb 03, 2019, 7:48 PM UTC

I've made a browser extension that solves CAPTCHAs using the audio challenge. Native user input simulation will come with the next release.

https://github.com/dessant/buster

On my part it is a direct reaction to developers and their employers cutting corners and adding these challenges to login forms and anything else you can imagine. It's entirely reasonable to show a challenge after a couple of failed login attempts, but they should never be part of the default login flow. These decisions hurt users.

If you work on a product that shows a CAPTCHA while logging in, please discuss this issue with your team and consider not challenging your users during their first login attempt.

Re: Why Captchas have gotten so difficult

#104

Post by tyingq » Sun, Feb 03, 2019, 7:52 PM UTC

dessant wrote: post #103

I've made a browser extension that solves CAPTCHAs using the audio challenge. Native user input simulation will come with the next release. https://github.com/dessant/buster On my part it is a direct reaction to developers and their employers cutting corners and adding these challenges to login forms and anything else you can imagine. It's entirely reasonable to show a challenge after a couple of failed login attempt…

I do use a CAPTCHA, but not on a login form. It's solely for a "contact us" form. We do try to encourage just regular email with a mailto: href, but unfortunately, customers expect a form.

And, if I don't use the captcha, we get flooded with spam. We are using Google's "nocaptcha", which is usually unintrusive, but is a pain for anyone not logged into some Google property.

Re: Why Captchas have gotten so difficult

#105

Post by dessant » Sun, Feb 03, 2019, 7:56 PM UTC

tyingq wrote: post #104

dessant wrote: post #103

I've made a browser extension that solves CAPTCHAs using the audio challenge. Native user input simulation will come with the next release. https://github.com/dessant/buster On my part it is a direct reaction to developers and their employers cutting corners and adding these challenges to login forms and anything else you can imagine. It's entirely reasonable to show a challenge after a couple of failed login attempt…

I do use a CAPTCHA, but not on a login form. It's solely for a "contact us" form. We do try to encourage just regular email with a mailto: href, but unfortunately, customers expect a form. And, if I don't use the captcha, we get flooded with spam. We are using Google's "nocaptcha", which is usually unintrusive, but is a pain for anyone not logged into some Google property.

For a contact form I think it's ok to show a challenge. It won't eliminate spam entirely or work against targeted attacks, but at least it keeps out the bulk of annoyances (at the cost of annoying some of your users :P).

EDIT: Have you considered putting the messages in a pending state instead? You could ask for their email in the contact form, and send a confirmation link that needs to be clicked for the message to be validated. Unvalidated messages could be deleted after a week, without any human interaction. I'd expect this to have comparable effectiveness against untargeted spam.

Re: Why Captchas have gotten so difficult

#106

Post by tokai » Sun, Feb 03, 2019, 7:57 PM UTC

outime wrote: post #24

Google reCAPTCHA is the absolute worst. It makes me solve several puzzles very often, usually when I use a mobile network and I’m not logged in with any Google account. It’s so frustrating that most of the times I find a reCAPTCHA I give up before trying and just go elsewhere e.g. when a site uses reCAPTCHA for sign up or after the first failed login, I’ll most likely skip if I don’t absolutely need to access such we…

In my experience if you just press next captcha without solving them, a bunch of times, it will stop with those and give you one of the "pick all storefronts" with multiple pictures, that can actually be solved.

Too me it seems that if you take your time and try to answer them properly they will try to get you annotate as much data as possible. While if just click though it fast it'll let you pass.

Re: Why Captchas have gotten so difficult

#107

Post by black_puppydog » Sun, Feb 03, 2019, 7:57 PM UTC

konschubert wrote: post #55

And I SUCK at these to the point where I think I’m not getting the rules of the game. For example, for the one with traffic lights: Am I supposed to just mark the light bulbs or also the poles and beams?

I'd guess they just make you solve an appropriate (TM) number of puzzles to absolutely certain you really are not a robot.

Of course, being logged in to your google account, preferably in chrome, and not blocking any of their scripts or cookies, would also go a long way for that. wink

Re: Why Captchas have gotten so difficult

#108

Post by fro0116 » Sun, Feb 03, 2019, 8:12 PM UTC

hombre_fatal wrote: post #97

webmobdev wrote: post #74

Earlier quoted context omitted.

I liked the idea when they just showed images of words that an OCR couldn't read accurately. But now all this damn clicking of hydrants, crossing, traffic lights, store fronts, vehicles etc. etc. is becoming really irritating. And no, I disagree that we have no option but to rely on "centralised" services like cloudfare or Google.

> I liked the idea when they just showed images of words that an OCR couldn't read accurately. Like I said, popular spamming software like Xrumer could crack those captchas ten years ago. > And no, I disagree that we have no option but to rely on "centralised" services like cloudfare or Google. Can you pitch alternatives, though? For example, an attacker can still spoof IP addresses in 2019 and create volumetric atta…

In my mind the answer is in building decentralized apps/services.

A DDoS on a static site cached on just about any CDN that runs logic exclusively on the client is much harder to pull off successfully because it's so much cheaper (practically free?) to mitigate, and doesn't affect any existing users who would already have the necessary resources cached locally.

Re: Why Captchas have gotten so difficult

#109

Post by robin_reala » Sun, Feb 03, 2019, 8:26 PM UTC

dessant wrote: post #105

tyingq wrote: post #104

Earlier quoted context omitted.

I do use a CAPTCHA, but not on a login form. It's solely for a "contact us" form. We do try to encourage just regular email with a mailto: href, but unfortunately, customers expect a form. And, if I don't use the captcha, we get flooded with spam. We are using Google's "nocaptcha", which is usually unintrusive, but is a pain for anyone not logged into some Google property.

For a contact form I think it's ok to show a challenge. It won't eliminate spam entirely or work against targeted attacks, but at least it keeps out the bulk of annoyances (at the cost of annoying some of your users :P). EDIT: Have you considered putting the messages in a pending state instead? You could ask for their email in the contact form, and send a confirmation link that needs to be clicked for the message to…

Not annoying; blocking. There are a reasonable percentage of people that cannot solve the current set of CAPTCHAs.

Re: Why Captchas have gotten so difficult

#110

Post by robin_reala » Sun, Feb 03, 2019, 8:28 PM UTC

Every time a CAPTCHA thread comes up I have to point this out. By using one you’re externalising your business costs onto your users. You can make that choice, but if you do you’re far more likely to negatively impact the section of society that already has problems online: those who need to use assistive technologies.