Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why can’t a bot tick the 'I'm not a robot' box?

quora.com

Post reply on HN
Print view View original

251–260 of 647 posts

Re: Why can’t a bot tick the 'I'm not a robot' box?

#251

Post by JohnFen »

gingerbread-man wrote: post #197
littleweep wrote: post #163

Earlier quoted context omitted.

I've been thinking about this a lot lately. Where is our compensation? It's our time and brain power training Google's AI that will one day be sold back to us. I'm really not into this.

Because Google can extract value from captchas, it makes world-class captchas and bot detection AI available to every webmaster for free. I don't know what that level of service would otherwise cost, but it almost certainly wouldn't be affordable for low-traffic blogs and the like, which would end up vulnerable using weaker captchas or trying to roll their own. Everywhere else the cost would just get passed on to use…

> it almost certainly wouldn't be affordable for low-traffic blogs and the like

Very few low-traffic blogs that I see use (or need) CAPTCHAs. I know that the ones I run don't.

> I don't love the compromise of paying for things with my data or by training Google's AI, but it's hard to say users aren't getting anything out of it.

I don't think they are getting much, if anything out of it -- aside from being increasingly punished for defending themselves against being spied on by Google.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#252

Post by shawnz »

askvictor wrote: post #249
shawnz wrote: post #247

Earlier quoted context omitted.

Were you using an unusual user agent or a VPN or something?

Why would they bother checking the user agent when it's the easiest thing to spoof (really, you probably can't even call it spoofing)

I'd bet that the vast majority of botters/phishers which Facebook deals with are amateurs. That said, I meant using unusual user agent software, not really just having an unusual user agent string.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#253

Post by JohnFen »

human wrote: post #175
littleweep wrote: post #163

Earlier quoted context omitted.

I've been thinking about this a lot lately. Where is our compensation? It's our time and brain power training Google's AI that will one day be sold back to us. I'm really not into this.

Are you kidding? Your compensation is all the free apps you get (Gmail, Maps, etc.) You’ll rarely see a Captcha for a paid product once they have your cc info.

But I don't use those services, so that can't be my compensation.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#254

Post by JohnFen »

udfalkso wrote: post #190
jammygit wrote: post #182

Earlier quoted context omitted.

I get most of my captchas while attempting to access products I've paid for already (very few at purchase time).

Imagine if those sites had to build their own captcha service instead. How much more expensive would they be?

Or they could just use one of the many free CAPTCHA applications that are around.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#255

Post by explainplease »

MiddleEndian wrote: post #146
singularity2001 wrote: post #92

Earlier quoted context omitted.

The worst thing is that it prevents me from accessing my BANK account. Shame on you FIDOR for blocking my own access to my own finances!

Send them a message. Switch to another bank, close your account, and tell them why.

Why? My time is valuable. If they want such detailed feedback (i.e. free business advice) from me, they can compensate me for it. I would get nothing in return for spending my time explaining why I'm not going to give them any more of my money.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#256

Post by clairity »

koonsolo wrote: post #150
clairity wrote: post #109

Earlier quoted context omitted.

just preemtively say no and leave the site. this is just another tracking vector for google and it should be discouraged. i'm generally against this type of gating, where the people doing the right thing get punished disproportionately (even small slices of time add up to wasting thousands of human-years over the population) just to combat the tiny number of bad actors. target the bad actors directly. it's the same f…

It's either that or getting your entire forum spammed with hundreds of spam posts. I'm using that captcha on my website, and I can tell you, that one works 100% while the other ones don't.

yes, the problem is prevalent and (small) forum operators bear the pain acutely. i'm not so dogmatic that i can't sympathize with your need for a working, if imperfect, solution, or as a user, needing to jump through the captcha hoops occasionally.

this is a subtle externality borne from scale combined with zero marginal cost. we need to find a way to make the bad actors bear the cost of that externality rather than the rest of us.

it's a hard problem that resists simple solutions like captchas, certificate signing, delivery fees, taxes, or even just outlawing the practice. as a lowly consumer, one of the few levers i have is curtailing my use of services employing (google) captchas.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#257

Post by phire »

bhntr3 wrote: post #239

I haven't seen any mention of keystroke (or mouse) biometrics ( https://en.m.wikipedia.org/wiki/Keystroke_dynamics ) When the checkbox appeared I assumed that was what it was. Keep a history of the biometrics of the devices either on the account or in a cookie. Use a sufficiently secure and obfuscated language to capture and upload the data (maybe using steganography in an image, explaining the weird image uploads.)…

The basic theory behind that checkbox is to attach an unmovable cookie to your browser.

The majority the client side reCAPTCHA is fingerprinting to make it impossible for spammers to steal cookies from legitimate users.

Once you have the immovable cookie, is easy to do regular reCAPTCHA challenges until you are sure that browser is being used by a regular human.

You will notice that if you ever move to fresh OS install, or a different browser that reCAPTCHA suddenly starts showing you image challenges again, which last for several weeks.

Keyboard/mouse biometics is a nice theory. But that's all it is. It doesn't work as a general CAPTCHA solution because it's so easy for bots to fake human looking input.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#258

Post by JohnFen »

sneakernets wrote: post #177
crankylinuxuser wrote: post #70

Earlier quoted context omitted.

> My timezone has not changed, my IP address and rough location has not changed, my screensize has not changed, my broadband speed has not changed, and my general computer dexterity has not changed, yet I am relentlessly targeted. On chrome I never saw these challenges, but on firefox with the privacy plug-ins I am always always always challenged. That's because Google isn't just profiling "Tor users". They're going…

There is no Google "punishment algorithm". It's just computers being dumb.

I think that Google is more than happy to punish people for protecting their privacy. That may or may not be the main goal, but it doesn't appear to be something Google considers a downside.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#260

Post by hombre_fatal »

EpicEng wrote: post #131
afandian wrote: post #127

Earlier quoted context omitted.

Wait til it's standing between you and your bank account.

Yeah I don't imagine anyone will actually do this if they actually care about what's on the other side.

Yeah, the extreme comments that we see whenever the topic of ReCaptcha comes up are especially amusing because HN uses it on its own register/login page.
Post reply on HN