Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

pcgamer.com

Post reply on HN
Print view View original

131–140 of 143 posts

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#131

Post by gtsop »

theamk wrote: post #126
gtsop wrote: post #35

Earlier quoted context omitted.

I think we need to critically re-evaluate what is it exactly we are doing on the internet, how we do it, and examine existing assumptions. For instance, do we really need all services to be centralised? Do we really need services to be "free" (part of the payment is selling your data ok). A server serving static files doesn't care about bot users, but apps... why would you let a stranger use your cpu/ram over the int…

Who are "we" and what are "we" going to do with the answer once "we" come up with it? For example, there is a someone's personal blog, which is beset by comment spammers. The blog's owner is tired of deleting spammy comments, and do not want their comment section to look like garbage bin, so they want some bot protection. The website's author is not that technical, so they do some googling and install reCaptcha (or c…

"we" is another word for "the people building the systems living on the web"

Once, "we" come up with the answer we are going to build based on the newly defined assumptions.

Here is what critically re-examining everything means: Do i really need to have a comment section? And if I do, shall I be the one responsible for managing it's technical infrastructure? The answer could be to use an off-the-shelf solution in your particular story. When you pivot to the side of the off-the-shelf solution developers who actually needs to do the spam filtering, then answers may differ, as will assumptions.

Edit: What are your thoughts of the mechanism hacker news have used to reduce bot comments?

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#132

Post by hyperman1 »

darkwater wrote: post #51

Naive question: how can clicking on the motorbike or traffic light image help to train an ML algorithm if they already know what image has a motorbike in it, or otherwise the captcha would not make sense. Maybe they put 3 image which are already with a score of >0.90 and one which is just 0.40?

They ask the same question to multiple people. Whatever the majority answers is right.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#133

Post by nonrandomstring »

nonrandomstring wrote: post #3

You can get people to do almost anything if you lie to them that it's for "security".

Literally. Social engineering 101. Grab a clipboard, put on a hi-viz, speak in an authoritive, directive voice and people will absolutely do what you ask at the sound of the word "security". Social engineering defence 101: teach scepticism and not being intimidated by the word "security"... ask "whose security?", "security from what?", "security to what end?", and "show me your ID and the written policy".

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#134

Post by kalleboo »

cccbbbaaa wrote: post #67
pupppet wrote: post #6

What's the alternative?

I've heard about form fields hidden with CSS multiple times. No idea how effective this is though.

It works for low-stakes stuff, e.g. it has eliminated the spam sent to our contact form.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#136

Post by LightHugger »

mike_hearn wrote: post #120
LightHugger wrote: post #85

Earlier quoted context omitted.

Can't you just put a 5 second "loading bar" delay instead of a captcha then i wonder?

Not easily: if it's enforced client side it may as well not exist, if it's enforced server side you just let anyone lock anyone else out of their account by running a constant brute force attack against their account (a DoS vuln). It also does nothing for attackers who try a giant list of accounts but only one or two passwords for each. I worked on Google's system for solving this. It's a pretty sophisticated analysi…

Serverside of course, but i would think the loading bar can be per connection rather than be per account right? Like a connection is attempted, starting the loading bar, and then 5s later you only allow that connection to continue the load? I do non-web dev stuff so maybe i'm missing something but it sounds like should be easy enough.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#137

Post by nervysnail »

unethical_ban wrote: post #19

What proof of humanity is sufficient? Today it is a phone call, or a verification sent to a real address (limit one registration per household), or a video call. How will we verify humanity in 20 years when audio and video emulation is foolproof? We'll have to have in-person attestation or make all services paid, perhaps.

Nothing less than drinking a "verification can", as presciently propounded by a 4chan user a decade ago.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#138

Post by mike_hearn »

LightHugger wrote: post #136
mike_hearn wrote: post #120

Earlier quoted context omitted.

Not easily: if it's enforced client side it may as well not exist, if it's enforced server side you just let anyone lock anyone else out of their account by running a constant brute force attack against their account (a DoS vuln). It also does nothing for attackers who try a giant list of accounts but only one or two passwords for each. I worked on Google's system for solving this. It's a pretty sophisticated analysi…

Serverside of course, but i would think the loading bar can be per connection rather than be per account right? Like a connection is attempted, starting the loading bar, and then 5s later you only allow that connection to continue the load? I do non-web dev stuff so maybe i'm missing something but it sounds like should be easy enough.

What stops you dropping the connection the moment you realize you're being loading barred.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#139

Post by LightHugger »

mike_hearn wrote: post #138
LightHugger wrote: post #136

Earlier quoted context omitted.

Serverside of course, but i would think the loading bar can be per connection rather than be per account right? Like a connection is attempted, starting the loading bar, and then 5s later you only allow that connection to continue the load? I do non-web dev stuff so maybe i'm missing something but it sounds like should be easy enough.

What stops you dropping the connection the moment you realize you're being loading barred.

Presumably the point is that the user (or bot) wants to access the content, a connection would have to complete the load successfully to do what they came for. if they just drop it instantly then that's a bot turned away.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#140

Post by openplatypus »

veeti wrote: post #107
openplatypus wrote: post #56

Earlier quoted context omitted.

Name and shame, please!! ReCAPTCHA due lack of opt out is effectively illegal in the EU.

If it's "effectively" illegal can you name a single court decision saying so?

Sure thing

https://wideangle.co/blog/is-recaptcha-illegal-under-gdpr#cn...

Post reply on HN