Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dazed and Confused: A Large-Scale Real-World User Study of ReCAPTCHAv (2023)

arxiv.org

Post reply on HN
Print view View original

11–20 of 65 posts

Re: Dazed and Confused: A Large-Scale Real-World User Study of ReCAPTCHAv (2023)

#11

Post by buro9 »

I abandon 1 in 10 captchas recently. They're becoming so abstract and confusing, few are on sites that I critically need to persevere with. Of the ones I do, I need to regenerate about a third as I'm slightly colour blind, but apparently enough to not see whatever they need me to see.

Mostly I won't sign up to a service that has a captcha unless I know in advance it's a service I need (unlikely), it's an immediate click away.

I'd rather have one time magic links and codes via text and email than a captcha.

Inconvenience that is robotic on my behalf (copy a code from here to there and treat this as part of "something you have") is much preferred over something that is demanding on my behalf (interpret this puzzle we're showing you, and pause the context you were in to now solve the puzzle).

The worst recent offenders are a grid of 9 abstract representations of something with the instruction to click the one that is correct (right way up), which is only as good as those generated images. Next up is the ones where you need to click images that are in certain "orbits" depending on what the object in orbit is. And of course the never-ending hell of solving Google Captchas where you must pick American English items and perform several leaps of "maybe the computer thinks this is a staircase or bridge?" when what you say and it thinks clearly disagreed.

Captchas are nothing but friction, they've become too hard for humans and too trivial for machines, and the result is that they are only friction to humans... the very humans you want to extract time, money and attention from.

Re: Dazed and Confused: A Large-Scale Real-World User Study of ReCAPTCHAv (2023)

#13

Post by Closi »

> We explore the cost and security of reCAPTCHAv2 and conclude that it has an immense cost and no security. Overall, we believe that this study's results prompt a natural conclusion: reCAPTCHAv2 and similar reCAPTCHA technology should be deprecated.

Not sure I 100% agree with the conclusion. IMO they currently still offer some level of security against unsophisticated actors, not no security.

And something can be bad and still be the best choice - we probably need some valid alternatives before we abandon captcha entirely - although i'm not sure what that alternative would be.

IMO the conclusion is a little bit like 'if lockpicks exist, locks offer no security and should be depreciated' - but at the moment locks and captcha still offer a level of security against unsophisticated actors.

Re: Dazed and Confused: A Large-Scale Real-World User Study of ReCAPTCHAv (2023)

#14

Post by tpxl »

Closi wrote: post #13

> We explore the cost and security of reCAPTCHAv2 and conclude that it has an immense cost and no security. Overall, we believe that this study's results prompt a natural conclusion: reCAPTCHAv2 and similar reCAPTCHA technology should be deprecated. Not sure I 100% agree with the conclusion. IMO they currently still offer some level of security against unsophisticated actors, not no security. And something can be bad…

Captcha is nothing like a lock. It's a little guy that gives you a run around before you get to insert your key. It does very little to stop the bad actors (if there's a payday at the other end of the runaround, they'll do it), but annoys (and is a slap in the face for) every single legitimate user.

Re: Dazed and Confused: A Large-Scale Real-World User Study of ReCAPTCHAv (2023)

#15

Post by eptcyka »

tpxl wrote: post #14
Closi wrote: post #13

> We explore the cost and security of reCAPTCHAv2 and conclude that it has an immense cost and no security. Overall, we believe that this study's results prompt a natural conclusion: reCAPTCHAv2 and similar reCAPTCHA technology should be deprecated. Not sure I 100% agree with the conclusion. IMO they currently still offer some level of security against unsophisticated actors, not no security. And something can be bad…

Captcha is nothing like a lock. It's a little guy that gives you a run around before you get to insert your key. It does very little to stop the bad actors (if there's a payday at the other end of the runaround, they'll do it), but annoys (and is a slap in the face for) every single legitimate user.

It takes a script kiddy considerably more effort to circumvent a captcha than just automating a site via curl or chromium. This difference is the increase in cost of an attack. This is the security gain.

Re: Dazed and Confused: A Large-Scale Real-World User Study of ReCAPTCHAv (2023)

#16

Post by throwawayffffas »

tpxl wrote: post #14
Closi wrote: post #13

> We explore the cost and security of reCAPTCHAv2 and conclude that it has an immense cost and no security. Overall, we believe that this study's results prompt a natural conclusion: reCAPTCHAv2 and similar reCAPTCHA technology should be deprecated. Not sure I 100% agree with the conclusion. IMO they currently still offer some level of security against unsophisticated actors, not no security. And something can be bad…

Captcha is nothing like a lock. It's a little guy that gives you a run around before you get to insert your key. It does very little to stop the bad actors (if there's a payday at the other end of the runaround, they'll do it), but annoys (and is a slap in the face for) every single legitimate user.

Captcha is like locks on soap shelves. It's friction on people who want to buy soap and can be trivially defeated if you want to steal the soap.

Re: Dazed and Confused: A Large-Scale Real-World User Study of ReCAPTCHAv (2023)

#18

Post by tpxl »

eptcyka wrote: post #15
tpxl wrote: post #14

Earlier quoted context omitted.

Captcha is nothing like a lock. It's a little guy that gives you a run around before you get to insert your key. It does very little to stop the bad actors (if there's a payday at the other end of the runaround, they'll do it), but annoys (and is a slap in the face for) every single legitimate user.

It takes a script kiddy considerably more effort to circumvent a captcha than just automating a site via curl or chromium. This difference is the increase in cost of an attack. This is the security gain.

A script kiddie downloads a script that does it for them.

The hard work of solving captchas automatically was already done, for free (linked in this very thread).

Re: Dazed and Confused: A Large-Scale Real-World User Study of ReCAPTCHAv (2023)

#19

Post by abid786 »

dheera wrote: post #9
supriyo-biswas wrote: post #6

To play devil's advocate; it is better to have some kind of fallback when the automated, non-interactive verification does fail. Anecdotally from many posters here and as I've personally experienced, automated verification (as attempted by some captchas which entirely eliminate any user interaction) is not foolproof, and an escape hatch is necessary from time to time. While it could be argued that this leaves the cap…

Time to create a captcha solver Chrome plugin that is continually updated with the latest automated solving to make this easier. Captchas should be deemed an ADA violation.

Why are they an ADA violation? Who are they discriminating against

Re: Dazed and Confused: A Large-Scale Real-World User Study of ReCAPTCHAv (2023)

#20

Post by eptcyka »

tpxl wrote: post #18
eptcyka wrote: post #15

Earlier quoted context omitted.

It takes a script kiddy considerably more effort to circumvent a captcha than just automating a site via curl or chromium. This difference is the increase in cost of an attack. This is the security gain.

A script kiddie downloads a script that does it for them. The hard work of solving captchas automatically was already done, for free (linked in this very thread).

Cool, invoke it from bash.
Post reply on HN