Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Friendly Captcha – GDPR-Compliant Bot Protection

friendlycaptcha.com

Post reply on HN
Print view View original

31–40 of 45 posts

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#31

Post by hot_gril »

toxicFork wrote: post #3

> Friendly Captcha generates a unique crypto puzzle for each visitor. As soon as the user starts filling a form it starts getting solved automatically. Solving it will usually take a few seconds. By the time the user is ready to submit, the puzzle is probably already solved. What makes this NOT work on a bot machine?

I really think it's meant to awe the business customer with a slick-looking demo, along with assurances that it's "made in Europe, GDPR-compliant, and proven accessible" rather than actually doing the job of a captcha. Sorry to be cynical, but it's oversimplifying the problem and just doesn't work (see below).

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#32

Post by JohnFen »

hot_gril wrote: post #24
TheRealPomax wrote: post #17

Earlier quoted context omitted.

That doesn't violate the GDPR. For a cookie to violate GDPR it has to trace back to personally identifiable information, not just "a uuid'd session". The number of people that get this wrong is staggering .

Because the law is unclear and lots of sites are afraid to accidentally violate it. If you search "do you need a cookies banner to operate in the EU" online, Google's suggested answer is "If your site has EU or UK visitors, you require a cookie banner to comply with GDPR," which you're saying isn't exactly true.

I don't think the law is unclear at all on this point. If your site wants to ride the fine line of what is allowed, you can get into a gray area. But unless you're trying to push the boundary, there isn't any mystery.

> Google's suggested answer

Do not trust Google's suggested answers for anything that matters. If you're really in doubt, consult an attorney that works with these issues.

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#33

Post by hot_gril »

JohnFen wrote: post #32
hot_gril wrote: post #24

Earlier quoted context omitted.

Because the law is unclear and lots of sites are afraid to accidentally violate it. If you search "do you need a cookies banner to operate in the EU" online, Google's suggested answer is "If your site has EU or UK visitors, you require a cookie banner to comply with GDPR," which you're saying isn't exactly true.

I don't think the law is unclear at all on this point. If your site wants to ride the fine line of what is allowed, you can get into a gray area. But unless you're trying to push the boundary, there isn't any mystery. > Google's suggested answer Do not trust Google's suggested answers for anything that matters. If you're really in doubt, consult an attorney that works with these issues.

If you look through several top results, you get other unconditional yeses and some murky maybes. On this topic, Recaptcha doesn't say whether or not it's GDPR-compliant, and searches give unsure answers. You're saying a session ID isn't personal info, but https://commission.europa.eu/law/law-topic/data-protection/r... lists both "cookie IDs" and IP addresses as personal info. Which one is it?

>If you're really in doubt, consult an attorney that works with these issues.

If I have to consult a lawyer just to run a basic website without cookie banners, that means the law is unclear.

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#34

Post by cccbbbaaa »

TheRealPomax wrote: post #30
cccbbbaaa wrote: post #23

Earlier quoted context omitted.

I'm pretty sure a session ID is personal data since it can be linked to a specific user by the service provider (see GDPR article 4(1)), and can be processed under the “legitimate interest” legal basis (article 6(1)f). Cookies don't violate GDPR, but are subject to ePrivacy 2002/58/CE, article 5(3). “Strictly necessary” cookies (eg. session ID cookies) are exempt from consent.

Fun fact: if you have user accounts, the act of logging in is literally the act that consents to storing and handling PII (unless you're so bad at writing a signup agreement that you forgot to put that in there). If you don't require users to be logged in to serve content, e.g. the overwhelming majority of web content, then a visitor's session id, by definition, cannot be linked to their personal information, because…

With a visitor session ID, you can identify a single user, so it's personal data under GDPR. Yes, even if you don't have a detailed profile of them. It's not even ambiguous, it's spelled in article 4(1).

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#35

Post by bastawhiz »

mschuster91 wrote: post #13
bastawhiz wrote: post #8

Earlier quoted context omitted.

> I don't think it will stop a bot machine, just make it very expensive to use My phone solves the captcha puzzle in about three seconds. I assume it's working on one core. If you're running this on a server and it's able to do one every, say, two seconds, and you have sixteen cores, that's still about eight per second. At that point, what is this defending against? You're running into API rate limit territory. The w…

> At that point, what is this defending against? I have seen spam attacks against webforms running with hundreds of calls per seconds. We in the end ran our own solution - a simple math captcha was all it took.

In college (2010) I built a honeypot to test this. Simply adding a field that blocks anything that doesn't run JavaScript worked in most cases. And that makes sense: a lot of this junk is garbage like malicious WordPress plugins that crank away to just fire off HTTP requests.

But you don't need proof of work to stop that abuse. The simplest JS with a fallback to a "I'm not a bot" checkbox would do the trick. So you're defending against folks that do run JavaScript, but...not fast?

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#36

Post by bastawhiz »

Kiro wrote: post #15
bastawhiz wrote: post #8

Earlier quoted context omitted.

> I don't think it will stop a bot machine, just make it very expensive to use My phone solves the captcha puzzle in about three seconds. I assume it's working on one core. If you're running this on a server and it's able to do one every, say, two seconds, and you have sixteen cores, that's still about eight per second. At that point, what is this defending against? You're running into API rate limit territory. The w…

> If you're running this on a server and it's able to do one every, say, two seconds, and you have sixteen cores, that's still about eight per second. That's no problem. It's supposed to protect against bots making billions requests a second.

> It's supposed to protect against bots making billions requests a second.

Billions of requests per second is the sort of traffic that Google receives in total. Not the traffic to your blog.

The spam isn't the bottleneck here: at the point where you're caring about the actual load it's putting on your system, you're talking about open connections and the number of occupied workers in your HTTP server. Captcha doesn't help with that. You still need to accept the request in order to reject it.

But even if the goal is to just slow down a botnet that's pounding your server into oblivion, this still ain't it. There's no 16xlarge ec2 instance somewhere beating on your server. It's a bunch of malicious chrome extensions and garbage mobile apps. Why pay for servers when you can have ten thousand people install your software and run it for nearly nothing? The cost of the compute load isn't felt by the bad actor.

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#39

Post by cccbbbaaa »

hot_gril wrote: post #33
JohnFen wrote: post #32

Earlier quoted context omitted.

I don't think the law is unclear at all on this point. If your site wants to ride the fine line of what is allowed, you can get into a gray area. But unless you're trying to push the boundary, there isn't any mystery. > Google's suggested answer Do not trust Google's suggested answers for anything that matters. If you're really in doubt, consult an attorney that works with these issues.

If you look through several top results, you get other unconditional yeses and some murky maybes. On this topic, Recaptcha doesn't say whether or not it's GDPR-compliant, and searches give unsure answers. You're saying a session ID isn't personal info, but https://commission.europa.eu/law/law-topic/data-protection/r... lists both "cookie IDs" and IP addresses as personal info. Which one is it? >If you're really in do…

Sessions IDs _are_ personal data, it's not even ambiguous if you read the definition in GDPR (article 4(1)). You even found it on the commission's website, it should give you a clear answer.

About cookies, the relevant law is ePrivacy 2002/58/CE, article 5(3), which says you don't need to ask for consent for “strictly necessary” cookies. In practice, this means session ID cookies, user preferences, etc. This also applies to local storage or any other way to store and retrieve data on a user's device.

The issue is not that the law is unclear, it's people that can't help but speculate on its content even though they never read it. Google is full of links to this, and HN is bad in this regard. And to be honest, this is not exclusive to GDPR.

I've found Stackexchange law and /r/gdpr to be okay-ish. Otherwise, there is a guide on the commission's website, there is gdpr.eu, there is the commented version of GDPR on gdprhub.eu:

https://commission.europa.eu/law/law-topic/data-protection/r... https://gdpr.eu/ https://gdprhub.eu/index.php?title=Article_1_GDPR

You can find a lot of advice on various DPAs website (ICO, and even the CNIL publishes stuff in english sometimes).

https://ico.org.uk/for-organisations/direct-marketing-and-pr...

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#40

Post by JohnFen »

hot_gril wrote: post #33
JohnFen wrote: post #32

Earlier quoted context omitted.

I don't think the law is unclear at all on this point. If your site wants to ride the fine line of what is allowed, you can get into a gray area. But unless you're trying to push the boundary, there isn't any mystery. > Google's suggested answer Do not trust Google's suggested answers for anything that matters. If you're really in doubt, consult an attorney that works with these issues.

If you look through several top results, you get other unconditional yeses and some murky maybes. On this topic, Recaptcha doesn't say whether or not it's GDPR-compliant, and searches give unsure answers. You're saying a session ID isn't personal info, but https://commission.europa.eu/law/law-topic/data-protection/r... lists both "cookie IDs" and IP addresses as personal info. Which one is it? >If you're really in do…

> If I have to consult a lawyer just to run a basic website without cookie banners, that means the law is unclear.

My whole point is that you don't need to consult a lawyer for a basic website. You need to do that if what you want to do is near the edge of the law. If you're using cookies for functional website reasons, you don't need to present a banner. That's very clear.

Post reply on HN