Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Friendly Captcha – GDPR-Compliant Bot Protection

friendlycaptcha.com

Post reply on HN
Print view View original

21–30 of 45 posts

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#21

Post by jart »

Szpadel wrote: post #18
jart wrote: post #14

Earlier quoted context omitted.

A better question is why you can't just use a token bucket rather than mining bitcoins on your client's phone wasting their battery.

because bots use hundreds IP addresses assigned to the same system, if you have 5r/s from 10k IP addresses it adds up if you require computational power you force them to invest money in hardware and potentially make it unprofitable

The last botnet I fended off had 49131669 IPs so believe me I know: https://ipv4.games/statusz The issue is it's not their money. A lot of these botnets are compromised of ordinary people's devices that got hacked into or hijacked by some slimy mobile app, that fires off a DDOS request every ~5sec or so in the background, and they do it because hacked devices aren't easy to fingerprint. So I feel bad for what's going to happen to all those normal people if the industry pivots to using CPU hard approaches to defend themselves.

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#22

Post by omoikane »

TheRealPomax wrote: post #17
omoikane wrote: post #11

Earlier quoted context omitted.

Probably cookies. Some captcha will try to remember that you are human with a cookie so that you don't have to solve captchas repeatedly, this one advertises as not storing personal information: https://friendlycaptcha.com/privacy/gdpr/

That doesn't violate the GDPR. For a cookie to violate GDPR it has to trace back to personally identifiable information, not just "a uuid'd session". The number of people that get this wrong is staggering .

Then I have no idea. Sounds like more captcha vendors should be advertising themselves as "GDPR compliant".

Reminds me of "asbestos free" labeling: https://xkcd.com/641/

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#23

Post by cccbbbaaa »

TheRealPomax wrote: post #17
omoikane wrote: post #11

Earlier quoted context omitted.

Probably cookies. Some captcha will try to remember that you are human with a cookie so that you don't have to solve captchas repeatedly, this one advertises as not storing personal information: https://friendlycaptcha.com/privacy/gdpr/

That doesn't violate the GDPR. For a cookie to violate GDPR it has to trace back to personally identifiable information, not just "a uuid'd session". The number of people that get this wrong is staggering .

I'm pretty sure a session ID is personal data since it can be linked to a specific user by the service provider (see GDPR article 4(1)), and can be processed under the “legitimate interest” legal basis (article 6(1)f).

Cookies don't violate GDPR, but are subject to ePrivacy 2002/58/CE, article 5(3). “Strictly necessary” cookies (eg. session ID cookies) are exempt from consent.

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#24

Post by hot_gril »

TheRealPomax wrote: post #17
omoikane wrote: post #11

Earlier quoted context omitted.

Probably cookies. Some captcha will try to remember that you are human with a cookie so that you don't have to solve captchas repeatedly, this one advertises as not storing personal information: https://friendlycaptcha.com/privacy/gdpr/

That doesn't violate the GDPR. For a cookie to violate GDPR it has to trace back to personally identifiable information, not just "a uuid'd session". The number of people that get this wrong is staggering .

Because the law is unclear and lots of sites are afraid to accidentally violate it. If you search "do you need a cookies banner to operate in the EU" online, Google's suggested answer is "If your site has EU or UK visitors, you require a cookie banner to comply with GDPR," which you're saying isn't exactly true.

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#25

Post by hot_gril »

Kiro wrote: post #15
bastawhiz wrote: post #8

Earlier quoted context omitted.

> I don't think it will stop a bot machine, just make it very expensive to use My phone solves the captcha puzzle in about three seconds. I assume it's working on one core. If you're running this on a server and it's able to do one every, say, two seconds, and you have sixteen cores, that's still about eight per second. At that point, what is this defending against? You're running into API rate limit territory. The w…

> If you're running this on a server and it's able to do one every, say, two seconds, and you have sixteen cores, that's still about eight per second. That's no problem. It's supposed to protect against bots making billions requests a second.

Captchas are not just ddos protection, and even if it were, the botnets don't send tons of spam from any single device. Otherwise it's too easy to identify and block.

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#26

Post by hot_gril »

jart wrote: post #21
Szpadel wrote: post #18

Earlier quoted context omitted.

because bots use hundreds IP addresses assigned to the same system, if you have 5r/s from 10k IP addresses it adds up if you require computational power you force them to invest money in hardware and potentially make it unprofitable

The last botnet I fended off had 49131669 IPs so believe me I know: https://ipv4.games/statusz The issue is it's not their money. A lot of these botnets are compromised of ordinary people's devices that got hacked into or hijacked by some slimy mobile app, that fires off a DDOS request every ~5sec or so in the background, and they do it because hacked devices aren't easy to fingerprint. So I feel bad for what's going…

Right. Captchas are supposed to ensure the operation is human-initiated. This solution doesn't work.

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#27

Post by Kiro »

hot_gril wrote: post #25
Kiro wrote: post #15

Earlier quoted context omitted.

> If you're running this on a server and it's able to do one every, say, two seconds, and you have sixteen cores, that's still about eight per second. That's no problem. It's supposed to protect against bots making billions requests a second.

Captchas are not just ddos protection, and even if it were, the botnets don't send tons of spam from any single device. Otherwise it's too easy to identify and block.

That's why you use something like this, where each request incurs a cost for the attacker so it doesn't matter if the origins are distributed.

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#28

Post by hot_gril »

omoikane wrote: post #22
TheRealPomax wrote: post #17

Earlier quoted context omitted.

That doesn't violate the GDPR. For a cookie to violate GDPR it has to trace back to personally identifiable information, not just "a uuid'd session". The number of people that get this wrong is staggering .

Then I have no idea. Sounds like more captcha vendors should be advertising themselves as "GDPR compliant". Reminds me of "asbestos free" labeling: https://xkcd.com/641/

The website also advertises "made in Europe," so it seems like a national(-ish) trust/pride thing.

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#29

Post by hot_gril »

Kiro wrote: post #27
hot_gril wrote: post #25

Earlier quoted context omitted.

Captchas are not just ddos protection, and even if it were, the botnets don't send tons of spam from any single device. Otherwise it's too easy to identify and block.

That's why you use something like this, where each request incurs a cost for the attacker so it doesn't matter if the origins are distributed.

The attacker doesn't have to calculate the puzzles in one central place. It can do that on the hacked devices.

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#30

Post by TheRealPomax »

cccbbbaaa wrote: post #23
TheRealPomax wrote: post #17

Earlier quoted context omitted.

That doesn't violate the GDPR. For a cookie to violate GDPR it has to trace back to personally identifiable information, not just "a uuid'd session". The number of people that get this wrong is staggering .

I'm pretty sure a session ID is personal data since it can be linked to a specific user by the service provider (see GDPR article 4(1)), and can be processed under the “legitimate interest” legal basis (article 6(1)f). Cookies don't violate GDPR, but are subject to ePrivacy 2002/58/CE, article 5(3). “Strictly necessary” cookies (eg. session ID cookies) are exempt from consent.

Fun fact: if you have user accounts, the act of logging in is literally the act that consents to storing and handling PII (unless you're so bad at writing a signup agreement that you forgot to put that in there).

If you don't require users to be logged in to serve content, e.g. the overwhelming majority of web content, then a visitor's session id, by definition, cannot be linked to their personal information, because there is no personal information to link to.

However, if a session id is used to track "the same user across different websites", building up a behavioural profile, THAT would require explicit consent. But since cookies are per-domain, and browsers have severely locked down cross domain access, that's basically a non-existence concern (as both a blessing and a curse. The wild west web is long gone, for better and for worse).

Post reply on HN