Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Captchas have gotten so difficult

theverge.com

Post reply on HN
Print view View original

111–120 of 218 posts

Re: Why Captchas have gotten so difficult

#111

Post by dessant »

robin_reala wrote: post #109
dessant wrote: post #105

Earlier quoted context omitted.

For a contact form I think it's ok to show a challenge. It won't eliminate spam entirely or work against targeted attacks, but at least it keeps out the bulk of annoyances (at the cost of annoying some of your users :P). EDIT: Have you considered putting the messages in a pending state instead? You could ask for their email in the contact form, and send a confirmation link that needs to be clicked for the message to…

Not annoying; blocking. There are a reasonable percentage of people that cannot solve the current set of CAPTCHAs.

Yes, and Google also blocks the audio challenge sometimes, so people with impaired vision or with neurological issues that affect object recognition are effectively denied access to a large portion of the web.

Re: Why Captchas have gotten so difficult

#112

Post by lucb1e »

webmobdev wrote: post #46

What many commentors here don't realise is that Google also uses reCaptcha to make you do free work for them.

Proving one is human takes human effort. Given that, I'd rather do something marginally useful than something completely pointless.

It would be cool if they released the gained data as open source, but that might compromise the service, and I guess someone has to develop and host this thing, so keeping it to themselves is fair enough.

The only issue is the conflict of interest (they benefit from giving me more captchas), but they don't seem to be abusing it for that end. They sure abuse their position of power by hellbanning you when they suspect foul play, but I doubt that it's because they want you to do more work.

Re: Why Captchas have gotten so difficult

#113

Post by hombre_fatal »

fro0116 wrote: post #108
hombre_fatal wrote: post #97

Earlier quoted context omitted.

> I liked the idea when they just showed images of words that an OCR couldn't read accurately. Like I said, popular spamming software like Xrumer could crack those captchas ten years ago. > And no, I disagree that we have no option but to rely on "centralised" services like cloudfare or Google. Can you pitch alternatives, though? For example, an attacker can still spoof IP addresses in 2019 and create volumetric atta…

In my mind the answer is in building decentralized apps/services. A DDoS on a static site cached on just about any CDN that runs logic exclusively on the client is much harder to pull off successfully because it's so much cheaper (practically free?) to mitigate, and doesn't affect any existing users who would already have the necessary resources cached locally.

I thought that until my sites behind AWS' CloudFront were repeatedly DDoSed and I saw my bill.

AWS did let me report these DDoSes and they would reimburse me, but it felt wayyy too precarious and I ended up switching to Cloudflare (free).

And I think that should worry us all.

Also, only the most trivial sites can be 100% cached. And those are the sites who need Recaptcha the least (or need a server to get a challenge from). Abuse is not a simple issue to solve.

Re: Why Captchas have gotten so difficult

#114

Post by StudentStuff »

harshreality wrote: post #77
johnisgood wrote: post #53

Earlier quoted context omitted.

It is almost impossible to pass those CAPTCHAs behind Tor. Personally I am not sure if it is possible, I could never pass. It would just give me more and more CAPTCHAs to solve. I gave up after the 6th one.

I think there's a logic bug/feature where if the rate of attempted captcha solutions from your IP is too high, it won't tell you you've failed (it knows you didn't) but it'll keep giving you more and more captchas. Sometimes I eventually get through after 4, 6, 8 attempts. Maybe because the automated attempts slowed down, or maybe just by chance. Sometimes I end up getting the dreaded "too many automated requests fro…

Having Captchas fail to load in TBB is very frustrating, especially when trying to browse static websites that are totally unrelated to Google.

Re: Why Captchas have gotten so difficult

#115

Post by hyperman1 »

lowkeyokay wrote: post #33

Well google’s traffic CAPTCHA’s main purpose is to label a huge data set for Waze. At least it must be a huge beneficial (to google) side effect. Am I wrong?

So if it asks to click on traffic lights, and a large enough group of people click on, say, red cars, can we make their their self-driving cars stop if they see red cars on the road?

  Come on HN, lets all do this for a few days, you know we can do it ;-)

Re: Why Captchas have gotten so difficult

#116

Post by yesenadam »

bogomipz wrote: post #78
webmobdev wrote: post #46

What many commentors here don't realise is that Google also uses reCaptcha to make you do free work for them.

Can you elaborate on this? What work are people actually doing for Google when they complete these awful captchas?

I believe the "read this hard-to-read text" ones are helping machines read text, the "is this a street sign" ones are helping machines drive cars.

Re: Why Captchas have gotten so difficult

#117

Post by simple_phrases »

dessant wrote: post #103

I've made a browser extension that solves CAPTCHAs using the audio challenge. Native user input simulation will come with the next release. https://github.com/dessant/buster On my part it is a direct reaction to developers and their employers cutting corners and adding these challenges to login forms and anything else you can imagine. It's entirely reasonable to show a challenge after a couple of failed login attempt…

The reason websites are CAPTCHA laden is because they want to make it harder for people to legally scrape their sites. For this reason, you'll be hard pressed to convince the owner of a site with a login CAPTCHA to remove it.

Re: Why Captchas have gotten so difficult

#118

Post by Pharmakon »

TorKlingberg wrote: post #81

I find it strange how all the comments here are blaming Google. Isn't it obvious that CAPTCHAs have gotten difficult because AI got better at solving them? Soon bots will be better than humans at solving CAPTCHAs, and the system will fail completely. I predict that then Google and Facebook will completely block new user signup from Tor, VPNs or browsers without cookines. Everyone else will require an existing Google,…

We hate them for the same reason we hate airport security theater; they do not work and have a high burden on the people being subjected to them. Plus, as it’s Google doing it, you can hardly escape the goddamned things. So yeah, we blame Google for using us as data classifiers and adding hoops and hurdles to the open net, while accomplishing precisely dick.

I for one hope that AI gets to the point that it can effortlessly beat them, so we can stop dealing with them.

Re: Why Captchas have gotten so difficult

#119

Post by dessant »

simple_phrases wrote: post #117
dessant wrote: post #103

I've made a browser extension that solves CAPTCHAs using the audio challenge. Native user input simulation will come with the next release. https://github.com/dessant/buster On my part it is a direct reaction to developers and their employers cutting corners and adding these challenges to login forms and anything else you can imagine. It's entirely reasonable to show a challenge after a couple of failed login attempt…

The reason websites are CAPTCHA laden is because they want to make it harder for people to legally scrape their sites. For this reason, you'll be hard pressed to convince the owner of a site with a login CAPTCHA to remove it.

I think that stems from flawed security models. CAPTCHAs are trivial to bypass, and scrapers can keep their session cookies to never see the login challenge again. Regular users are the ones suffering from CAPTCHAs on login forms, not scrapers.

Re: Why Captchas have gotten so difficult

#120

Post by hombre_fatal »

dessant wrote: post #103

I've made a browser extension that solves CAPTCHAs using the audio challenge. Native user input simulation will come with the next release. https://github.com/dessant/buster On my part it is a direct reaction to developers and their employers cutting corners and adding these challenges to login forms and anything else you can imagine. It's entirely reasonable to show a challenge after a couple of failed login attempt…

>It's entirely reasonable to show a challenge after a couple of failed login attempts, but they should never be part of the default login flow.

Nope, that only works if there weren't botnets that just multiplex millions of requests over thousands of websites.

Anyone who has tried IP-blocking bots has run into this where 50k+ IP addresses just need to send you one request per couple minutes.

Your posts in this thread show how easy it is to be against recaptcha without addressing why people use it, or you suggest it's a flawed security model when people use it. It's kind of hard to take your advice seriously when I think of real world websites fighting real world abuse.

In another post of yours, you recommend the web developer to just expend more and more effort to circumvent abuse without recaptcha. Like creating a whole pending message system for, say, a forum instead of just a contact form. In fact, you'll find that there's no shortage of work for you to do once you attract abuse. And that's an easy solution to prescribe when you have no skin in the game. God forbid the site doesn't even make any money.

Post reply on HN