321–330 of 338 posts
I wish captcha providers universally had to provide a way to shut down their use by bad actors. Here in Canada I get tons of scam texts pointing me to a fake banking or postal service website asking me to pay a fake bill. I want to ddos them with fake payment data but they’re all protected by hcaptcha.
If you report the website/sitekey to hCaptcha support it'll get banned pretty quickly.
Earlier quoted context omitted.
It struggles whenever there's a story more popular than usual though
Only for those logged in, because we bypass caches/cdn. Logout helps both you and HN in these cases.
Earlier quoted context omitted.
@_rutinerad got it - on macOS you can select text in any image, and I just assumed you could do that on windows as well (I figure in the context of linux it would be much more dependent on specific configuration so unilateral assumptions on behaviour would be questionable). It's honestly annoying as it frequently interferes with dragging images out of safari, except on those occasions when I do want the text when it'…
Am I the only one paranoid enough to think that this means Apple is now indexing even the text content of images stored on it's users computers?
If your concern is "apple is harvesting my data" then no. All of apple's various analysis systems ("AI") are entirely local. This does mean you get a bunch of duplicated work as every device redoes the same analysis but on the other hand it saves you from "how do we defend against a compromised network".
Earlier quoted context omitted.
mCaptcha is interesting, but I wonder what its energy impact would be on a sufficiently large deployment, e.g imagine we replaced all reCAPTCHAs with mCaptcha.
I expect its not significantly larger than loading your average 2023 webpage with 15MB of js
Earlier quoted context omitted.
I am pretty confident that, when it comes to browser users, proof of work simply doesn't work. The disparity in speed between GPUs and javascript is so high that either you are a non-issue to a sane attacker or you make your users sit for a minute with their fans on full waiting to be able to sign in.
Would it be possible to conceive a proof-of-work that is difficult to parallelize, making it harder for GPU computing?
Earlier quoted context omitted.
That non-theatrical role would likely be better served by actual throttling or computational proof of work.
I am pretty confident that, when it comes to browser users, proof of work simply doesn't work. The disparity in speed between GPUs and javascript is so high that either you are a non-issue to a sane attacker or you make your users sit for a minute with their fans on full waiting to be able to sign in.
Earlier quoted context omitted.
I believe that the question should be the other way around: Why is it that you have to lose your anonimity when you are on the internet? The real world always allowed that until it became dependent on surveillance capitalism. Of course you need to prove you're yourself for some things, but that should be the exception. You could always look things up at your local library while being anonymous (for checking out you'd…
In the real world people can see who's doing what by looking.
on large cities everybody is anonymous to some degree
Earlier quoted context omitted.
How could renting out one's ID to provide access to bots for spamming/manipulation be avoided then?
A simple zero-knowledge credential system isn't sufficient. It would need to embed some kind of protections to limit how often it could be used, to detect usage of the same credential from multiple (implausibly far apart) IP addresses. There would need to be extremely sophisticated reputation scoring and blocklisting to quickly catch people who built fake identities or stole them. And even with every one of those pro…
And what if you develop this very sophisticated system of reputation score, what if bad actors find a way to still perfectly abuse it, e.g. they pay for desperate people for the IDs and then stay just within the limits ever so slightly.
Would you be able to easily iterate on the system when that happens to make it more secure?
But if you also track IP addresses then doesn't that already mean loss of anonymity?
And ultimately with something like IP address, a bad actor could offer you to download an app where they could simply use your IP address to post content/propaganda from under your ID and IP.
It would be more expensive for bad actors, but also I think there was period when Facebook accounts were bought and sold, and there was very active market for that. I imagine teenagers for example are really easily tricked into selling their creds etc.
Also Reddit and other social media accounts are being sold a lot, so definitely there would be market for that.
Earlier quoted context omitted.
I always thought they used more timing & mouse movement instead of correct answer to verify if your a human.
So instead of running some script checkbox = getPos(checkbox='notRobot') button = getPos(button='submit') cursor() .transition(pos=checkbox) .click() .transition(pos=button) .click() They now checkbox = getPos(checkbox='notRobot') button = getPos(button='submit') cursor() .sleep(time=random(distribution='human_captcha')) .transition(pos=checkbox , method='human_captcha') .sleep(time=random(distribution='human_captcha…