The No CAPTCHA problem
homakov.blogspot.com
The No CAPTCHA problem
1–10 of 100 posts
Re: The No CAPTCHA problem
#2That's quite funny
Re: The No CAPTCHA problem
#3What is the No CAPTCHA problem? What's being described here are problems that apply to all CAPTCHAs. Whatever 'human' detection system you put in place, humans can always be hired to solve them. The point of No CAPTCHA is not to fix these problems, it's to make it easier for 90% of people who don't care too much about cookie privacy etc. (or most likely have no idea it's even a thing).
Re: The No CAPTCHA problem
#4This is why I still recommend using other form spam prevention techniques before sacrificing usability for a CAPTCHA. One of the most effective combinations for 80%+ of the sites I've ever dealt with is having a honeypot field in the form, plus some amount of time required to pass before the form can be submitted successfully. There are other ways to mitigate bots as well, but these two alone have sufficed for quite some time for anything but dedicated human-based attacks.
Granted, I think the checkbox CAPTCHA is much better than the UX disaster that is the 'type some hard-to-read letters' CAPTCHA, but it's still adding a burden on the user, rather than a burden on the bot.
(Source: I maintain the Drupal Honeypot module[1], and have used it in a ton of different situations where CAPTCHA/reCAPTCHAs would normally be recommended).
Re: The No CAPTCHA problem
#5What is the No CAPTCHA problem? What's being described here are problems that apply to all CAPTCHAs. Whatever 'human' detection system you put in place, humans can always be hired to solve them. The point of No CAPTCHA is not to fix these problems, it's to make it easier for 90% of people who don't care too much about cookie privacy etc. (or most likely have no idea it's even a thing).
The problem itself is described in the end: it's about using clickjacking to get a valid token on behalf of "good guys". And this problem has nothing to do with existing systems.
Google could have made it so much easier and more secure: a POST request to google.com/verify_me will have Origin header in it to prevent CSRF (only wordpress.com scripts will be able to get token). Also there would be no need to make a click. No CAPTCHA looks fancy but the real No CAPTCHA should always have visibility:none!
Re: The No CAPTCHA problem
#6What is the No CAPTCHA problem? What's being described here are problems that apply to all CAPTCHAs. Whatever 'human' detection system you put in place, humans can always be hired to solve them. The point of No CAPTCHA is not to fix these problems, it's to make it easier for 90% of people who don't care too much about cookie privacy etc. (or most likely have no idea it's even a thing).
The problem itself is described in the end: it's about using clickjacking to get a valid token on behalf of "good guys". And this problem has nothing to do with existing systems. Google could have made it so much easier and more secure: a POST request to google.com/verify_me will have Origin header in it to prevent CSRF (only wordpress.com scripts will be able to get token). Also there would be no need to make a clic…
"No CAPTCHA looks fancy but the real No CAPTCHA should always have visibility:none!"
I agree, but I suppose they want something that's a Placeholder, if the user needs to type a captcha
Re: The No CAPTCHA problem
#7I have a hunch that it is Google's attempt to be on every form and know more about a Google user and their accounts on other websites. At least what websites they signed up for. I can stop Analytics but this is now out of my control. This is what a website owner required me to do to access their website.
Re: The No CAPTCHA problem
#8Earlier quoted context omitted.
The problem itself is described in the end: it's about using clickjacking to get a valid token on behalf of "good guys". And this problem has nothing to do with existing systems. Google could have made it so much easier and more secure: a POST request to google.com/verify_me will have Origin header in it to prevent CSRF (only wordpress.com scripts will be able to get token). Also there would be no need to make a clic…
"No CAPTCHA looks fancy but the real No CAPTCHA should always have visibility:none!" I agree, but I suppose they want something that's a Placeholder, if the user needs to type a captcha
Why? If no need to type any captcha - do the verification in the background, don't show me anything until you think I'm a bot
Re: The No CAPTCHA problem
#9I do not get the problem of hiring a clickfarm for 1$ an hour to click on cat pics.
If we take reputation, IP and cookie. All must be in order to pass. We want to spam a 1000 forms today. Scenario 1: The clickfarm itself fills in the Captcha. Result: Their IP's will soon be blacklisted, reputation of a third-world account will be inherently low. Scenario 2: We let the clickfarm send the answer to our own bot, which selects the right pictures. Result: Google will see a single IP and cookie trying out 1000s of captcha's a day, and ban you. Scenario 3: We let the clickfarm send the answer to our own bot, this bot uses a list of proxies that haven't yet been banned. Result: Google will see a single account cookie trying out 1000s of captcha's a day, from different IP's and ban you.
Can anyone come up with a scenario which involves reputation, IP and cookie that does not end up with Google detecting and banning your efforts? Cookie swapping?
Re: The No CAPTCHA problem
#10I have a hunch that it is Google's attempt to be on every form and know more about a Google user and their accounts on other websites. At least what websites they signed up for. I can stop Analytics but this is now out of my control. This is what a website owner required me to do to access their website.
Oh, it's already too late. Google already has enough data about you. I can imagine the future - people train bots like kids, make them visit different websites, google things and pretend to be humans. Your search history will be like your credit score.