The relevant data for the claim of the headline is in Table 3. On all the tasks with enough data, bots were both faster and more accurate than humans.
An Empirical Study and Evaluation of Modern CAPTCHAs
151–160 of 338 posts
Re: An Empirical Study and Evaluation of Modern CAPTCHAs
#152Earlier quoted context omitted.
They go down somewhat frequently. I think it’s like four 9’s? I’m not sure why they insist on running just a few machines though. They have more than enough money and probably make up the difference by the advertising for YC that they get.
Unless something changed, it's just the one server.
Main and backup. The last outage was because they have a single network provider. Those are rare, and can be dealt with relatively easily by dual connecting your server to two different networks and sharing across both and removing the dns entry for a broken one. But it’s not worthwhile for such a rare outage
The “outages” that are common are slowdowns for logged in users.
Re: An Empirical Study and Evaluation of Modern CAPTCHAs
#153I guess validating a payment card is going to be the next step to sign up for whatever. Don’t allow pre paid BINs and let’s go. Gonna be pretty miserable, however someone needs to find something as I currently would rather pay 0.01$ instead of solving a captcha. Especially the select all the bicycles; it’s a waste of life.
The next step is device attestation. IIRC Safari already does this, so you should not see captcha on places that support it. Something that can work on any browser can be like this: Scan the QR code in your iPhone or Android device that supports attestation. Will ask you if you approve login, then will attest for you. If you turn out to be a bad actor, the website can ban this device - so no flooding with a single de…
The day this is used widely across browsers is the day devices you own can no longer be flashed with anything other than what the OEM puts on it--even if that is outdated or buggy.
Re: An Empirical Study and Evaluation of Modern CAPTCHAs
#154Earlier quoted context omitted.
EU digital ID, asking for mobile number and sending text, so something that is linked to an ID and/or costs money to have. Goodbye anonimity, probably.
This just made me ponder again—where does the assumption that the Internet should allow unconstrained anonymity come from, other than that’s how it used to be for some time? The real world doesn’t allow that. It’s hard to remain anonymous in the real world. The real world largely runs on identity and (identity) trust. Why should the Internet be different?
Theoretically you don't need to reveal your identity to prove that you're human. You can use a zero knowledge proof instead, likely attached to something like an EU Digital ID, which would allow you to remain anonymous and also prove that you're human.
Re: An Empirical Study and Evaluation of Modern CAPTCHAs
#155As best as I can tell this study explores many facets of how humans solve captchas. I couldn't find anything about AIs outperforming humans in the study. Can someone give me a section reference? Solving reCAPTCHA v2/v3 requires more than just clicking the box and an image puzzle. If that was all it was we would be overrun by now. Lots of folks commenting that the title's statement makes sense because CAPTCHAs are mea…
It's in Table 3.
Re: An Empirical Study and Evaluation of Modern CAPTCHAs
#156I guess validating a payment card is going to be the next step to sign up for whatever. Don’t allow pre paid BINs and let’s go. Gonna be pretty miserable, however someone needs to find something as I currently would rather pay 0.01$ instead of solving a captcha. Especially the select all the bicycles; it’s a waste of life.
The next step is device attestation. IIRC Safari already does this, so you should not see captcha on places that support it. Something that can work on any browser can be like this: Scan the QR code in your iPhone or Android device that supports attestation. Will ask you if you approve login, then will attest for you. If you turn out to be a bad actor, the website can ban this device - so no flooding with a single de…
There are over a billion Idevices out there. Malware on just 1% of them can make and control 10 million spam accounts on every site using device attestation, and they're indistinguishable from real users.
Re: An Empirical Study and Evaluation of Modern CAPTCHAs
#157Earlier quoted context omitted.
All true, except: While these are considered just an excruciating security pain for users, they do serve a non-theatrical purpose in many cases of throttling the speed of brute force attacks (or at least costing your opponent money).
> they do serve a non-theatrical purpose in many cases of throttling the speed of brute force attacks Might do that unobtrusively for the average person, by using projects like mCaptcha [0] for instance. [0] https://mcaptcha.org/
Oh what a perfect find. I have on my todolist to add POW to some of my api endpoints
Re: An Empirical Study and Evaluation of Modern CAPTCHAs
#158Earlier quoted context omitted.
EU digital ID, asking for mobile number and sending text, so something that is linked to an ID and/or costs money to have. Goodbye anonimity, probably.
This just made me ponder again—where does the assumption that the Internet should allow unconstrained anonymity come from, other than that’s how it used to be for some time? The real world doesn’t allow that. It’s hard to remain anonymous in the real world. The real world largely runs on identity and (identity) trust. Why should the Internet be different?
Yes it does? Especially in a dense city vs small village (which is more comparable to the internet at large) - go for a walk, see some advertisement billboards, buy a newspaper (esp. with cash), read the news, who knows who I am?
Re: An Empirical Study and Evaluation of Modern CAPTCHAs
#159Does HN ever require CAPTCHAs? It seems to do pretty well with its basic but battle-tested moderation/antispam tools, and rate-limiting that seems to repel all but the most concerted DDoS attacks. I don't think HN has any unreasonable restrictions on scraping or third-party clients, either. And it manages to serve 5M unique visitors a month and 10M views a day[0]. [0] https://news.ycombinator.com/item?id=33454140
IIRC the registration page (only in some cases?) shows a reCAPTCHA.
Re: An Empirical Study and Evaluation of Modern CAPTCHAs
#160Earlier quoted context omitted.
That’s excessively optimistic. The most likely scenario is that we’ll have captchas for the next 30 years but only humans will be bothered by them.
This. There are plenty of government websites etc out there that have completely antiquated captchas next to the helpful "works best in Internet Explorer 6" suggestion.
This is exactly what I was referring to. “Minimal compliance” and unmaintained websites.