Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

pcgamer.com

Post reply on HN
Print view View original

21–30 of 143 posts

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#21

Post by thatguy0900 »

unethical_ban wrote: post #19

What proof of humanity is sufficient? Today it is a phone call, or a verification sent to a real address (limit one registration per household), or a video call. How will we verify humanity in 20 years when audio and video emulation is foolproof? We'll have to have in-person attestation or make all services paid, perhaps.

Realistically it will be a government or private service that everyone will have to have to verify that it is a real person. Or at least tied to a real person so that banning will be more sticky.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#24

Post by phoronixrly »

unethical_ban wrote: post #19

What proof of humanity is sufficient? Today it is a phone call, or a verification sent to a real address (limit one registration per household), or a video call. How will we verify humanity in 20 years when audio and video emulation is foolproof? We'll have to have in-person attestation or make all services paid, perhaps.

I would wager all services will be linked to a verified credit or debit (non-temporary) card. Most of them are now...

How are you going to connect the physical person with an identity with in-person attestation? Many (several of which major English-speaking) countries don't have mandatory government IDs...

A commenter below suggests that government eIDs could be used. I bet this will be harder to implement and will have much worse conversion rates than (the already terrible) mandatory credit/debit cards... Not to mention the hell that we as non-US citizens will have to endure if anyone tries to impose any form of mandatory ID there... One can only take so much complaining about government overreach about something that is basic necessity here in the EU...

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#25

Post by josefresco »

pupppet wrote: post #6

What's the alternative?

I can tell you on the small level asking a simple question to activate the form action stops 99% of spam. Something like "What color is snow?" Granted, with a well trained "AI" system solving these questions would be trivial but I have yet to see it in practice.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#26

Post by eykanal »

The problem with this paper is that, while technically true, there are many website owners who have found that CAPTCHAs have effectively reduced the spam on their site to zero. The fact that a CAPTCHA _can_ be bypassed doesn't mean that it _will_, and most spam bots are not using cutting-edge tech because that's expensive.

To say "it's worthless from a security perspective" is a pretty harsh and largely inaccurate representation. It's been tremendously useful to those who have used it. If it wasn't valuable, it wouldn't be so widely used.

Definitely agree with the whole "tons of free $$$ for Google", but that's kind of their business model, so yeah, Google is being Google. In other breaking news, water is still wet.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#27

Post by jszymborski »

e2le wrote: post #20
pupppet wrote: post #6

What's the alternative?

There are two alternatives I'm aware of, one is Attestation of Personhood[1] proposed by Cloudflare, the other is a proof-of-work[2] which the Tor project have themselves introduced[3]. [1]: https://blog.cloudflare.com/introducing-cryptographic-attest... [2]: https://github.com/mCaptcha/mCaptcha [3]: https://blog.torproject.org/introducing-proof-of-work-defens...

While I get the draw, I never understood how PoW is ever supposed to work practically.

PoW tasks are meant to work on a wide range of mobile phones, desktops, single-board computers, etc... you have vastly different compute budgets in every environment. For a PoW task that is usable on a five year old mobile phone, an adversary with a consumer RTX 50 series card (or potentially even an ASIC) can easily perform it many, many, many orders of magnitude faster.

Am I missing something?

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#28

Post by phoronixrly »

josefresco wrote: post #25
pupppet wrote: post #6

What's the alternative?

I can tell you on the small level asking a simple question to activate the form action stops 99% of spam. Something like "What color is snow?" Granted, with a well trained "AI" system solving these questions would be trivial but I have yet to see it in practice.

Sorry for nitpicking but you need a puzzle that is knowledge-agnostic (be it cultural or scientific), otherwise you're guarding your site from both bots and people unfamiliar with the concept of or lacking the pre-existing knowledge necessary to solve the puzzle.

What colour is snow is close but you can't assume that everyone knows what snow is, let alone what colour it is. This includes both people with disabilities and in parts of the world where there is no snow...

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#29

Post by phoronixrly »

loloquwowndueo wrote: post #10
jdietrich wrote: post #9

-

It’s not three years, it’s thirteen. > A lifetime value of $888 billion for all of reCAPTCHAv2's tracking cookies produced between 2010 and 2023.

jdietrich, I feel your pain, I am also completely convinced that 2010 was 3 years ago :(

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#30

Post by idunnoman1222 »

phoronixrly wrote: post #28
josefresco wrote: post #25

Earlier quoted context omitted.

I can tell you on the small level asking a simple question to activate the form action stops 99% of spam. Something like "What color is snow?" Granted, with a well trained "AI" system solving these questions would be trivial but I have yet to see it in practice.

Sorry for nitpicking but you need a puzzle that is knowledge-agnostic (be it cultural or scientific), otherwise you're guarding your site from both bots and people unfamiliar with the concept of or lacking the pre-existing knowledge necessary to solve the puzzle. What colour is snow is close but you can't assume that everyone knows what snow is, let alone what colour it is. This includes both people with disabilities…

There are no humans that know the word snow who don’t know what colours Snow is
Post reply on HN