Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Captchas have gotten so difficult

theverge.com

Post reply on HN
Print view View original

131–140 of 218 posts

Re: Why Captchas have gotten so difficult

#131

Post by hombre_fatal »

dessant wrote: post #124
hombre_fatal wrote: post #120

Earlier quoted context omitted.

>It's entirely reasonable to show a challenge after a couple of failed login attempts, but they should never be part of the default login flow. Nope, that only works if there weren't botnets that just multiplex millions of requests over thousands of websites. Anyone who has tried IP-blocking bots has run into this where 50k+ IP addresses just need to send you one request per couple minutes. Your posts in this thread…

I would have appreciated if your post would not have been a personal attack. I was suggesting limiting login attempts based on a particular user account, not an IP address, and I have never talked about a pending message system for forums.

Most brute-forcing at scale isn't for a specific account, it's for {uname,password} tuples. As in, you buy these combo lists online and rent a botnet to try them out on a list of sites.

What would your advice achieve?

I changed the "you" to "your advice", but I think that's a petty distraction since I'm making specific points against your advice, not you as a person. And this comment is an example of what seems to be a disconnect between your understood attack models and the attacks that people actually need to defend against.

Re: Why Captchas have gotten so difficult

#132

Post by darkpuma »

tyingq wrote: post #104
dessant wrote: post #103

I've made a browser extension that solves CAPTCHAs using the audio challenge. Native user input simulation will come with the next release. https://github.com/dessant/buster On my part it is a direct reaction to developers and their employers cutting corners and adding these challenges to login forms and anything else you can imagine. It's entirely reasonable to show a challenge after a couple of failed login attempt…

I do use a CAPTCHA, but not on a login form. It's solely for a "contact us" form. We do try to encourage just regular email with a mailto: href, but unfortunately, customers expect a form. And, if I don't use the captcha, we get flooded with spam. We are using Google's "nocaptcha", which is usually unintrusive, but is a pain for anyone not logged into some Google property.

nocaptcha aka reCAPTCHAv3 is the worst choice. At least with v2 users of firefox/adblock/ec get a chance of passing the captcha by answering challenges. v3 takes that opportunity away from them.

Re: Why Captchas have gotten so difficult

#133

Post by tobi1449 »

lucb1e wrote: post #112
webmobdev wrote: post #46

What many commentors here don't realise is that Google also uses reCaptcha to make you do free work for them.

Proving one is human takes human effort. Given that, I'd rather do something marginally useful than something completely pointless. It would be cool if they released the gained data as open source, but that might compromise the service, and I guess someone has to develop and host this thing, so keeping it to themselves is fair enough. The only issue is the conflict of interest (they benefit from giving me more captch…

The problem is that as soon as you're getting value from users solving captchas, there's an incentive to show them more captchas to solve before accepting that they're human.

Re: Why Captchas have gotten so difficult

#134

Post by dessant »

hombre_fatal wrote: post #131
dessant wrote: post #124

Earlier quoted context omitted.

I would have appreciated if your post would not have been a personal attack. I was suggesting limiting login attempts based on a particular user account, not an IP address, and I have never talked about a pending message system for forums.

Most brute-forcing at scale isn't for a specific account, it's for {uname,password} tuples. As in, you buy these combo lists online and rent a botnet to try them out on a list of sites. What would your advice achieve? I changed the "you" to "your advice", but I think that's a petty distraction since I'm making specific points against your advice, not you as a person. And this comment is an example of what seems to be…

Discord defends against combo lists by showing a CAPTCHA and asking for email confirmation if you log in from a new location, but no challenge is shown during the default login flow.

Re: Why Captchas have gotten so difficult

#135

Post by darkpuma »

hombre_fatal wrote: post #120
dessant wrote: post #103

I've made a browser extension that solves CAPTCHAs using the audio challenge. Native user input simulation will come with the next release. https://github.com/dessant/buster On my part it is a direct reaction to developers and their employers cutting corners and adding these challenges to login forms and anything else you can imagine. It's entirely reasonable to show a challenge after a couple of failed login attempt…

>It's entirely reasonable to show a challenge after a couple of failed login attempts, but they should never be part of the default login flow. Nope, that only works if there weren't botnets that just multiplex millions of requests over thousands of websites. Anyone who has tried IP-blocking bots has run into this where 50k+ IP addresses just need to send you one request per couple minutes. Your posts in this thread…

reCAPTCHA's tile fade-in doesn't punish bots, it punishes real humans. Your argument might be valid if reCAPTCHA were a true CAPTCHA, rather than compliance/recruiting mechanism used by google to abuse people until they relent and adopt google products.

But yeah, it's free so you can't resist using it. Have you ever stopped to wonder why google gives this service out for free? When you integrate reCAPTCHA into your website, you're selling your users out.

Re: Why Captchas have gotten so difficult

#137

Post by danShumway »

vpmpaul wrote: post #136

I've actually started trying to see how wrong the newer Capchas from will let me be on purpose. Either by not selecting all of them or picking wrong ones. They let you through a lot of the time.

Me too!

My working theory was that companies like Google were using the capchas mostly to generate AI data, so only a few of the images on any given test were actually already labeled. Any of the other images (particularly the really grainy ones) would accept any answer because they were genuine classification questions.

Reading this article, I wonder if it's not even that -- that companies like Google are assuming, "you're not going to get everything right, so we'll give you some leeway."

Re: Why Captchas have gotten so difficult

#138

Post by darkpuma »

black_puppydog wrote: post #107
konschubert wrote: post #55

And I SUCK at these to the point where I think I’m not getting the rules of the game. For example, for the one with traffic lights: Am I supposed to just mark the light bulbs or also the poles and beams?

I'd guess they just make you solve an appropriate (TM) number of puzzles to absolutely certain you really are not a robot. Of course, being logged in to your google account, preferably in chrome, and not blocking any of their scripts or cookies, would also go a long way for that. wink

>"I'd guess they just make you solve an appropriate (TM) number of puzzles to absolutely certain you really are not a robot."

If it were a matter of security then they wouldn't allow people with javascript disabled (which could reasonably be considered a bot-ish characteristic...) to pass through after solving a single challenge. Given how much easier the noscript version is to solve, who would make a bot that requests and solves the normal version instead of the noscript version? Any bot making a semi-serious attempt to crack their captcha will try the noscript version first.

Multiple challenges aren't there for more security, they are there to get more free labor out of the human. And the tile fade-in is to punish the human for not using the web in a Google Approved™ manner.

Re: Why Captchas have gotten so difficult

#139

Post by chocolatkey »

pmoriarty wrote: post #84
userbinator wrote: post #64

Earlier quoted context omitted.

Indeed, I definitely am not happy with how much control Google has over the Internet in general. Everything from how they present and rank search results, Google Analytics scripts everywhere, the sometimes vaguely-political messages on their homepage, the ostensibly-anti-bot checks including CAPTCHAs and just plain banning you if you want to do more "advanced" searches (like the ones Fravia would've taught...), etc.

There's other (mysterious to me) stuff that sites call to Google for, apart from captchas and analytics. As a uMatrix (and former NoScript) user, I've long noticed that many sites make calls to ajax.googleapis.com for I have no idea what. Quite often the site will refuse to work without that. To be fair, a lot of sites make use of javascript from a lot of other sites as well: cloudfront and amazon are common.

As a uMatrix user as well, I have manually whitelisted ajax.googleapis.com. It is actually not tracking scripts, but hosted libs like jQuery, which many many sites use and will not function without. See here: https://developers.google.com/speed/libraries/

Re: Why Captchas have gotten so difficult

#140

Post by hombre_fatal »

Pharmakon wrote: post #118
TorKlingberg wrote: post #81

I find it strange how all the comments here are blaming Google. Isn't it obvious that CAPTCHAs have gotten difficult because AI got better at solving them? Soon bots will be better than humans at solving CAPTCHAs, and the system will fail completely. I predict that then Google and Facebook will completely block new user signup from Tor, VPNs or browsers without cookines. Everyone else will require an existing Google,…

We hate them for the same reason we hate airport security theater; they do not work and have a high burden on the people being subjected to them. Plus, as it’s Google doing it, you can hardly escape the goddamned things. So yeah, we blame Google for using us as data classifiers and adding hoops and hurdles to the open net, while accomplishing precisely dick. I for one hope that AI gets to the point that it can effort…

> We hate them for the same reason we hate airport security theater; they do not work

Well, they absolutely do work. They work so well that they've reduced bot actions by almost 100% on our sites.

We wouldn't use Recaptcha if there wasn't abuse on the internet. But, unfortunately, there is. There is a sobering amount of it.

I'm actually curious about all these posts suggesting that websites use Recaptcha for no real reason or for some trivial reason. To me, it suggests a massive misunderstanding that people have about the internet.

It's certainly something to worry about, but how about this angle: abuse is getting so cheap and hard to prevent that we're electing the aid of complicated systems engineered by large corporations like Google. That scares me, but not from a Google=bad standpoint. It indicates that the internet has fundamental problems that make abuse trivial, and that's a different discussion worth having, but it's a much harder one than Google=bad. Probably less cathartic, too.

Post reply on HN