Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

pcgamer.com

Post reply on HN
Print view View original

31–40 of 143 posts

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#31

Post by radlad »

jszymborski wrote: post #27
e2le wrote: post #20

Earlier quoted context omitted.

There are two alternatives I'm aware of, one is Attestation of Personhood[1] proposed by Cloudflare, the other is a proof-of-work[2] which the Tor project have themselves introduced[3]. [1]: https://blog.cloudflare.com/introducing-cryptographic-attest... [2]: https://github.com/mCaptcha/mCaptcha [3]: https://blog.torproject.org/introducing-proof-of-work-defens...

While I get the draw, I never understood how PoW is ever supposed to work practically. PoW tasks are meant to work on a wide range of mobile phones, desktops, single-board computers, etc... you have vastly different compute budgets in every environment. For a PoW task that is usable on a five year old mobile phone, an adversary with a consumer RTX 50 series card (or potentially even an ASIC) can easily perform it man…

PoW isn't meant to make something impossible, it's meant to attach a cost to it. Now you need to extract a value higher than the cost.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#32

Post by josefresco »

phoronixrly wrote: post #28
josefresco wrote: post #25

Earlier quoted context omitted.

I can tell you on the small level asking a simple question to activate the form action stops 99% of spam. Something like "What color is snow?" Granted, with a well trained "AI" system solving these questions would be trivial but I have yet to see it in practice.

Sorry for nitpicking but you need a puzzle that is knowledge-agnostic (be it cultural or scientific), otherwise you're guarding your site from both bots and people unfamiliar with the concept of or lacking the pre-existing knowledge necessary to solve the puzzle. What colour is snow is close but you can't assume that everyone knows what snow is, let alone what colour it is. This includes both people with disabilities…

I agree, and thankfully we're dealing with mostly regional visitors to small local business/organization websites. Not a global audience. That being said, it's hard to think of a simple question, with little to no ambiguity.

Once example is for a landscaper: What is the color of healthy grass?

The answer is "green" of course, but grass is common in our region. That question would not work in a culture or region unfamiliar with "lawn grass".

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#33

Post by radlad »

internetter wrote: post #7
jisnsm wrote: post #5

Earlier quoted context omitted.

As a website developer and host, I can assure you recaptcha works very well to stop spam and automated login requests. It is not perfect, but no system is.

yeah, a sufficiently motivated attacker can deploy some countermeasures to bypass it, but only really worth it for targeted attacks. Anyone who has a form on the internet knows that without any sort of captcha, you get lots of stupid bots just typing in jumbo. Likely you could tone back the captchas and still get a similar result in stopping the dumb bots[0] [0] on my contact page my email is protected via a custom c…

> Anyone who has a form on the internet knows that without any sort of captcha, you get lots of stupid bots just typing in jumbo.

I recall a form of "CAPTCHA" that involved a text input which was hidden via CSS, but which bots would fill in anyway. Any text in the input caused the entire form to be rejected. I wonder if that style still works today.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#34

Post by phoronixrly »

idunnoman1222 wrote: post #30
phoronixrly wrote: post #28

Earlier quoted context omitted.

Sorry for nitpicking but you need a puzzle that is knowledge-agnostic (be it cultural or scientific), otherwise you're guarding your site from both bots and people unfamiliar with the concept of or lacking the pre-existing knowledge necessary to solve the puzzle. What colour is snow is close but you can't assume that everyone knows what snow is, let alone what colour it is. This includes both people with disabilities…

There are no humans that know the word snow who don’t know what colours Snow is

> There are no humans that know the word snow who don’t know what colours Snow is

Sorry, I don't follow, English is a second language to me, but how does this stand against my statement that 'many people don't know the concept of snow, let alone what colour it is'?

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#35

Post by gtsop »

pupppet wrote: post #6

What's the alternative?

I think we need to critically re-evaluate what is it exactly we are doing on the internet, how we do it, and examine existing assumptions. For instance, do we really need all services to be centralised? Do we really need services to be "free" (part of the payment is selling your data ok). A server serving static files doesn't care about bot users, but apps... why would you let a stranger use your cpu/ram over the internet? I know i am not providing an answer but i believe we need to take a look again at all of these before we try to come up with an answer

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#36

Post by jszymborski »

radlad wrote: post #31
jszymborski wrote: post #27

Earlier quoted context omitted.

While I get the draw, I never understood how PoW is ever supposed to work practically. PoW tasks are meant to work on a wide range of mobile phones, desktops, single-board computers, etc... you have vastly different compute budgets in every environment. For a PoW task that is usable on a five year old mobile phone, an adversary with a consumer RTX 50 series card (or potentially even an ASIC) can easily perform it man…

PoW isn't meant to make something impossible, it's meant to attach a cost to it. Now you need to extract a value higher than the cost.

I understand that, but what I'm saying is that due to the wide gulf between the compute budget of the slowest device one is meant to support and a couple commodity VPSs adversaries need anyway to conduct a DDoS or to spam, there is ostensibly no extra cost.

In fact, all you are doing is slowing down legitimate clients with old equipment and doing nothing against adversaries.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#37

Post by a2128 »

jp191919 wrote: post #13

I'm at the point now that if I get a CAPTCHA, I'm just going to leave the site. I'll spend my money elsewhere or find an alternative

My government's websites require solving a reCAPTCHA for basic services, which is horrifying. They also use Cloudflare which blocks me sometimes. This is in the EU

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#38

Post by phoronixrly »

josefresco wrote: post #32
phoronixrly wrote: post #28

Earlier quoted context omitted.

Sorry for nitpicking but you need a puzzle that is knowledge-agnostic (be it cultural or scientific), otherwise you're guarding your site from both bots and people unfamiliar with the concept of or lacking the pre-existing knowledge necessary to solve the puzzle. What colour is snow is close but you can't assume that everyone knows what snow is, let alone what colour it is. This includes both people with disabilities…

I agree, and thankfully we're dealing with mostly regional visitors to small local business/organization websites. Not a global audience. That being said, it's hard to think of a simple question, with little to no ambiguity. Once example is for a landscaper: What is the color of healthy grass? The answer is "green" of course, but grass is common in our region. That question would not work in a culture or region unfam…

Yes, I would go for simpler stuff (word or digit puzzles) and package it in a way that is friendly for screen readers. So... No images or video, or at least one alternative to them that at the same time does not make it easy for the bots...

This has the added benefit that translators will be forced to come up with a translation that makes sense when your projects gets to a point that it needs i18n.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#39

Post by phoronixrly »

radlad wrote: post #33
internetter wrote: post #7

Earlier quoted context omitted.

yeah, a sufficiently motivated attacker can deploy some countermeasures to bypass it, but only really worth it for targeted attacks. Anyone who has a form on the internet knows that without any sort of captcha, you get lots of stupid bots just typing in jumbo. Likely you could tone back the captchas and still get a similar result in stopping the dumb bots[0] [0] on my contact page my email is protected via a custom c…

> Anyone who has a form on the internet knows that without any sort of captcha, you get lots of stupid bots just typing in jumbo. I recall a form of "CAPTCHA" that involved a text input which was hidden via CSS, but which bots would fill in anyway. Any text in the input caused the entire form to be rejected. I wonder if that style still works today.

I've had an issue with this approach -- many browsers (via autofill/autocomplete) and many password managers (when filling in password, e-mail, etc.) tend to also get trapped in this honeypot... The spam does still get stopped though.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#40

Post by phoronixrly »

a2128 wrote: post #37
jp191919 wrote: post #13

I'm at the point now that if I get a CAPTCHA, I'm just going to leave the site. I'll spend my money elsewhere or find an alternative

My government's websites require solving a reCAPTCHA for basic services, which is horrifying. They also use Cloudflare which blocks me sometimes. This is in the EU

Confirming this. I am also completely certain that gratuitous CAPTCHA use is banned for government systems by my country's set of laws governing their implementation. The judicial system and the community have not matured enough to consider this a breach of law worthy of fighting against...
Post reply on HN