What makes other solutions not GDPR compliant?
Probably cookies. Some captcha will try to remember that you are human with a cookie so that you don't have to solve captchas repeatedly, this one advertises as not storing personal information:
Friendly Captcha – GDPR-Compliant Bot Protection
11–20 of 45 posts
Re: Friendly Captcha – GDPR-Compliant Bot Protection
#12Same but free and open source: https://mcaptcha.org/
Been using it for a new project of mine. Mcaptcha is great and extremely easy to build custom components for.
Re: Friendly Captcha – GDPR-Compliant Bot Protection
#13Earlier quoted context omitted.
It sounds like a proof of work rate limiter similar to something hashcash. I don't think it will stop a bot machine, just make it very expensive to use. Which is actually all regular captchas do anyway. Whenever this comes up as an alternative to regular captchas I see a lot of push back that we can't do this because it would cost mobile users to much battery power. If that is really such a concern, let the mobile us…
> I don't think it will stop a bot machine, just make it very expensive to use My phone solves the captcha puzzle in about three seconds. I assume it's working on one core. If you're running this on a server and it's able to do one every, say, two seconds, and you have sixteen cores, that's still about eight per second. At that point, what is this defending against? You're running into API rate limit territory. The w…
> At that point, what is this defending against?
I have seen spam attacks against webforms running with hundreds of calls per seconds. We in the end ran our own solution - a simple math captcha was all it took.
Re: Friendly Captcha – GDPR-Compliant Bot Protection
#14> Friendly Captcha generates a unique crypto puzzle for each visitor. As soon as the user starts filling a form it starts getting solved automatically. Solving it will usually take a few seconds. By the time the user is ready to submit, the puzzle is probably already solved. What makes this NOT work on a bot machine?
A better question is why you can't just use a token bucket rather than mining bitcoins on your client's phone wasting their battery.
Re: Friendly Captcha – GDPR-Compliant Bot Protection
#15Earlier quoted context omitted.
It sounds like a proof of work rate limiter similar to something hashcash. I don't think it will stop a bot machine, just make it very expensive to use. Which is actually all regular captchas do anyway. Whenever this comes up as an alternative to regular captchas I see a lot of push back that we can't do this because it would cost mobile users to much battery power. If that is really such a concern, let the mobile us…
> I don't think it will stop a bot machine, just make it very expensive to use My phone solves the captcha puzzle in about three seconds. I assume it's working on one core. If you're running this on a server and it's able to do one every, say, two seconds, and you have sixteen cores, that's still about eight per second. At that point, what is this defending against? You're running into API rate limit territory. The w…
> If you're running this on a server and it's able to do one every, say, two seconds, and you have sixteen cores, that's still about eight per second.
That's no problem. It's supposed to protect against bots making billions requests a second.
Re: Friendly Captcha – GDPR-Compliant Bot Protection
#16GDPR is about how you handle personally identifiable information. And IPs famously don't count as PII unless they are stored in combination with other data that allows linking that IP to a real human being, so I'm having a really hard time understanding why being GDPR-compliant is even relevant to a captcha solution.
Re: Friendly Captcha – GDPR-Compliant Bot Protection
#17What makes other solutions not GDPR compliant?
Probably cookies. Some captcha will try to remember that you are human with a cookie so that you don't have to solve captchas repeatedly, this one advertises as not storing personal information: https://friendlycaptcha.com/privacy/gdpr/
That doesn't violate the GDPR. For a cookie to violate GDPR it has to trace back to personally identifiable information, not just "a uuid'd session". The number of people that get this wrong is staggering.
Re: Friendly Captcha – GDPR-Compliant Bot Protection
#18> Friendly Captcha generates a unique crypto puzzle for each visitor. As soon as the user starts filling a form it starts getting solved automatically. Solving it will usually take a few seconds. By the time the user is ready to submit, the puzzle is probably already solved. What makes this NOT work on a bot machine?
A better question is why you can't just use a token bucket rather than mining bitcoins on your client's phone wasting their battery.
because bots use hundreds IP addresses assigned to the same system, if you have 5r/s from 10k IP addresses it adds up
if you require computational power you force them to invest money in hardware and potentially make it unprofitable
Re: Friendly Captcha – GDPR-Compliant Bot Protection
#19GDPR is about how you handle personally identifiable information. And IPs famously don't count as PII unless they are stored in combination with other data that allows linking that IP to a real human being, so I'm having a really hard time understanding why being GDPR-compliant is even relevant to a captcha solution.
> And IPs famously don't count as PII
Please elaborate, as IP addresses are specifically listed as PII on European Commission's website: https://commission.europa.eu/law/law-topic/data-protection/r...
Re: Friendly Captcha – GDPR-Compliant Bot Protection
#20GDPR is about how you handle personally identifiable information. And IPs famously don't count as PII unless they are stored in combination with other data that allows linking that IP to a real human being, so I'm having a really hard time understanding why being GDPR-compliant is even relevant to a captcha solution.
IP addresses are considered personal data according to [1] and there’s no mention of it being counted as personal data conditionally.
[1] https://commission.europa.eu/law/law-topic/data-protection/r...