Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

pcgamer.com

Post reply on HN
Print view View original

11–20 of 143 posts

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#11

Post by nonrandomstring »

jisnsm wrote: post #5
catlikesshrimp wrote: post #4

Earlier quoted context omitted.

Except captcha is not supposed to be security for the user, but security for the website. But in the end it is not (effective) security for a website, is an antifeature for users and is profit for google.

As a website developer and host, I can assure you recaptcha works very well to stop spam and automated login requests. It is not perfect, but no system is.

I had a great conversation about this last week. I'll just casually leave this [0] here for anyone who has time (50 mins - ausio only) for a deep-dive into machine learning to protect sites (APIs). TLDR - a lot of serious defenders have given up on PoW/CAPTCHA human filters because the cost to AI solve them has dropped to almost nothing. YMMV.

[0] https://cybershow.uk/episodes.php?id=39

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#12

Post by nonrandomstring »

internetter wrote: post #7
jisnsm wrote: post #5

Earlier quoted context omitted.

As a website developer and host, I can assure you recaptcha works very well to stop spam and automated login requests. It is not perfect, but no system is.

yeah, a sufficiently motivated attacker can deploy some countermeasures to bypass it, but only really worth it for targeted attacks. Anyone who has a form on the internet knows that without any sort of captcha, you get lots of stupid bots just typing in jumbo. Likely you could tone back the captchas and still get a similar result in stopping the dumb bots[0] [0] on my contact page my email is protected via a custom c…

> It’s the dumbest PoW imaginable, but it works

Nice one! I guess you mainly need to get above a certain novelty threshold, because all ML is based on what has already been seen/learned rather than actually outsmarting the defence.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#14

Post by phoronixrly »

atoav wrote: post #8
pupppet wrote: post #6

What's the alternative?

Building your own captcha or running one that doesn't sell your users data to the highest bidder? What a time where people on a site called "Hacker News" ask such a question..

And if you ever get so big that people start writing bespoke software to break your CAPTCHA, then investing some more engineering effort into it will quite likely not be a problem.

Of course reCAPTCHA is also still vulnerable to the use of a mechanical turk so even giving away your users' data won't save you.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#15

Post by nonchalantsui »

pupppet wrote: post #6

What's the alternative?

Since this was focused on v2 and other interactive captcha, the alternative is to upgrade to new versions that don’t do so. Still some downsides (and the study does address very briefly the use of AI to trick v3), but at the very least it does address some of the concerns.

Important to note though that as AI gets more accessible then the downsides of v3 start to weigh more.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#16

Post by phoronixrly »

jisnsm wrote: post #5
catlikesshrimp wrote: post #4

Earlier quoted context omitted.

Except captcha is not supposed to be security for the user, but security for the website. But in the end it is not (effective) security for a website, is an antifeature for users and is profit for google.

As a website developer and host, I can assure you recaptcha works very well to stop spam and automated login requests. It is not perfect, but no system is.

As a website developer and host can you compare running your own CAPTCHA in place of any CAPTCHA-as-a-service? In my experience even a simple static how much is 3 + 39 stops the flood of spam in a form... It is also not perfect, but as you say no system is, and it does not pilfer my users' data...

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#18

Post by joseppudev »

catlikesshrimp wrote: post #4
nonrandomstring wrote: post #3

You can get people to do almost anything if you lie to them that it's for "security".

Except captcha is not supposed to be security for the user, but security for the website. But in the end it is not (effective) security for a website, is an antifeature for users and is profit for google.

[dead]

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#19

Post by unethical_ban »

What proof of humanity is sufficient? Today it is a phone call, or a verification sent to a real address (limit one registration per household), or a video call. How will we verify humanity in 20 years when audio and video emulation is foolproof?

We'll have to have in-person attestation or make all services paid, perhaps.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#20

Post by e2le »

pupppet wrote: post #6

What's the alternative?

There are two alternatives I'm aware of, one is Attestation of Personhood[1] proposed by Cloudflare, the other is a proof-of-work[2] which the Tor project have themselves introduced[3].

[1]: https://blog.cloudflare.com/introducing-cryptographic-attest...

[2]: https://github.com/mCaptcha/mCaptcha

[3]: https://blog.torproject.org/introducing-proof-of-work-defens...

Post reply on HN