An Empirical Study and Evaluation of Modern CAPTCHAs

Post by croes » Sun, Dec 17, 2023, 10:01 AM UTC

Post by nextaccountic » Sun, Dec 17, 2023, 10:03 AM UTC

gary_0 wrote: post #66

Does HN ever require CAPTCHAs? It seems to do pretty well with its basic but battle-tested moderation/antispam tools, and rate-limiting that seems to repel all but the most concerted DDoS attacks. I don't think HN has any unreasonable restrictions on scraping or third-party clients, either. And it manages to serve 5M unique visitors a month and 10M views a day[0]. [0] https://news.ycombinator.com/item?id=33454140

Post by _ache_ » Sun, Dec 17, 2023, 10:04 AM UTC

plsbenice34 wrote: post #58

cinntaile wrote: post #37

Earlier quoted context omitted.

Solving captchas is pretty rare nowadays. Now you usually just press a button and then it does some sort of fingerprinting to determine if you're a human.

If you make zero attempts toward privacy maybe. Just turn on a commercial VPN or Tor and you'll find that your quality of life can quickly become severely damaged by captchas. I cant even do a Google search without a captcha so I started using Mullvad Leta as a proxy.

Post by malfist » Sun, Dec 17, 2023, 10:12 AM UTC

noduerme wrote: post #46

caymanjim wrote: post #42

Google CAPTCHAs were designed and deployed as a mechanism to train AIs. That's why they are the way they are. Any security theater surrounding them is entirely incidental. So it's no surprise that the AIs are now good at solving them. We've trained them for years.

All true, except: While these are considered just an excruciating security pain for users, they do serve a non-theatrical purpose in many cases of throttling the speed of brute force attacks (or at least costing your opponent money).

Post by nottorp » Sun, Dec 17, 2023, 10:12 AM UTC

maksimur wrote: post #64

shadowgovt wrote: post #39

Earlier quoted context omitted.

The price we pay for obfuscating the trust signals on our connection is that our connection is untrusted. As an American, I have a similar experience when I travel across the Atlantic. It's always funny to me when I land in the UK, start using websites I use normally at home, and get cookie verification modals from hell to breakfast.

Can't vouch for other Europeans but I got used to them to the point my arm moves automatically where needed before clicking, even accounting for extra modals. I almost don't register them anymore.