Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The CAPTCHA arms race: from distorted text to browser identity

browserbase.com

Post reply on HN
Print view View original

21–30 of 60 posts

Re: The CAPTCHA arms race: from distorted text to browser identity

#21

Post by nosioptar »

thenthenthen wrote: post #16

Omg. I am on various VPN’s and now and again Google Auth (for youtube) throws me a captcha. They are mostly unreadable, but there is an audio option… which is just insane and does not make any sense, anyone had that? It sounds like a recording of 300 people speaking at the same time in a call center while on various dosages of LSD

I've actually been in a call center with 300 intoxicated folk all talking at once. Its easier to understand than the recaptcha audio.

(Only a couple folks on hallucinogenics, most on various downers.)

Re: The CAPTCHA arms race: from distorted text to browser identity

#23

Post by kgwxd »

throwawayffffas wrote: post #11
zuzululu wrote: post #6

so whats the solution then? get people to turn on their camera and hold up 15 fingers ?

The solution is login and paywalls.

That's crazy. People aren't going to pay to be tracked and have ads shoved in their faces! The economy would collapse!

Re: The CAPTCHA arms race: from distorted text to browser identity

#24

Post by nosioptar »

Zak wrote: post #13
jmclnx wrote: post #2

They have been around that long ? Does not seem so but the timing could be correct probably because the sites I went to had no need for CAPTCHAs until AI came around.

The name wasn't invented until 2003, but yes. Guestbooks, contact forms, signup pages, and the like started receiving automated abuse approximately five minutes after they were invented. It didn't take long after that for people to start including a question they expected to be easy for a person and hard to automate with a script. What's relatively new is CAPTCHAs merely to browse a site. There are few faster ways to…

My first guestbook asked Hagar or Roth. Answering correctly got your message added to the book. Answering Hagar got you sent to an infinite redirect loop for being either a bot or a moron.

Re: The CAPTCHA arms race: from distorted text to browser identity

#25

Post by hombre_fatal »

As TFA points out, a major change is that bot traffic now comes from honest users via their LLM sessions, so you don't even necessarily want to block automated bots anymore.

The game is shifting to a better ideal: how do you design a service knowing that any user/request might be automated?

Especially in place of the historical, easy solution/hack where you have some sort of gate that, once passed, puts the user in some trusted low-scrutiny tier, like a forum's registration page.

It's a similar question to designing a system so that it's resilient to account take-overs. (i.e. The user was a trusted human until now, and now it's a spammer)

Example: on a forum, run new posts through an LLM to classify it as spam which is a magic solution we always wish we had (remember akismet?) but was too rudimentary.

Re: The CAPTCHA arms race: from distorted text to browser identity

#26

Post by CM30 »

The issue is that anything that becomes a standard here automatically becomes a target. If the same sort of captcha protects everything from Gmail to Twitter to Cloudflare and Facebook, then bot creators and spammers have a huge incentive to bypass it no matter what. And if we've learnt anything about spam, it's that pretty much every system we can think of can be bypassed or automated away.

The solution is really a ton of different captcha like systems and anti spam solutions, all unpopular enough that an attacker may not even bother targeting them. If an attacker needs to target a few thousand different captcha style setups to get their spam through, then many of them won't bother.

It's like centralised vs decentralised communication systems. If everything is centralised, a bad actor (like a government, corporation, criminal group, etc) can go after one target to control the narrative. If it's decentralised, then suddenly they have to go after dozens or hundreds of different targets, many of which won't cooperate with them.

Re: The CAPTCHA arms race: from distorted text to browser identity

#27

Post by fusslo »

zuzululu wrote: post #6

so whats the solution then? get people to turn on their camera and hold up 15 fingers ?

it sounds like the article & company are building identity based on fingerprinting/cross-domain behavior. Inferring at multiple levels, including cloudflare's

It's just more identity verification afaict

Re: The CAPTCHA arms race: from distorted text to browser identity

#29

Post by matteo8p »

Really nice read Harsehaj!

I haven't looked deeply into Web Bot Auth, but is identification tied to the agent (one identity per agent) or is it tied to the underlying person using the agent (the user)?

Hope that question makes sense, lmk if you need clarification

Post reply on HN