Live data from Hacker News

CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

pcgamer.com

41–50 of 143 posts

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#41

Earlier quoted context omitted.

There are no humans that know the word snow who don’t know what colours Snow is

> There are no humans that know the word snow who don’t know what colours Snow is Sorry, I don't follow, English is a second language to me, but how does this stand against my statement that 'many people don't know the concept of snow, let alone what colour it is'?

There's no reason for an English language website to cater to people who don't know what snow is. How can it be discriminatory to have a question a user can't comprehend, when they won't be able to comprehend the rest of the website either? Even blind people who can read English Braille and input text in English know that snow is white, even if they've never seen it.

If a website is multilingual, it can offer language/region selection and add appropriate questions for each of them.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#43
post #26

The problem with this paper is that, while technically true, there are many website owners who have found that CAPTCHAs have effectively reduced the spam on their site to zero. The fact that a CAPTCHA _can_ be bypassed doesn't mean that it _will_, and most spam bots are not using cutting-edge tech because that's expensive. To say "it's worthless from a security perspective" is a pretty harsh and largely inaccurate re…

Yeah, we've used CAPTCHAs to great effect as gracefully-degraded service protection for unauthenticated form submissions. When we detect that a particular form is being spammed, we automatically flip on a feature flag for it to require CAPTCHAs to submit, and the flood immediately stops. Definitely saves our databases from being pummeled, and I haven't seen a scenario since we implemented it a few years ago where the CAPTCHA didn't help immediately.

Reminds me of the advice around the deadbolt on your house - it won't stop a determined attacker, but it will deter less-determined ones.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#44
post #31

Earlier quoted context omitted.

PoW isn't meant to make something impossible, it's meant to attach a cost to it. Now you need to extract a value higher than the cost.

I understand that, but what I'm saying is that due to the wide gulf between the compute budget of the slowest device one is meant to support and a couple commodity VPSs adversaries need anyway to conduct a DDoS or to spam, there is ostensibly no extra cost. In fact, all you are doing is slowing down legitimate clients with old equipment and doing nothing against adversaries.

I've seen a PoW CAPTCHA https://github.com/mCaptcha/mCaptcha and at the time it did not make any sense to me. I would still get spam, just a tiny bit slower, and spammers would have to expend more resources for just my site, which would barely register on their bill.

I bet that requiring JS stops more spam than the PoW itself. Can anyone who tried it chime in?

Oh, I see, it's effective against 'someone [who] wants to hammer your site'. That is usually never the case with my sites. I do get a steady stream of spam, but it is quite gentle as to not trigger any WAFs. The load comes from LLMs scraping this everliving shit of my sites and fortunately they don't seem to bother with filling in forms...

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#45
post #6

What's the alternative?

I can tell you on the small level asking a simple question to activate the form action stops 99% of spam. Something like "What color is snow?" Granted, with a well trained "AI" system solving these questions would be trivial but I have yet to see it in practice.

Sounds easy, but at this point everyone is trained to solve these captchas and implementing the questions is not a quick thing either on a bigger scale (Translations, cultural differences, bots easily bypassing them etc.). I've used captchas on my sites before because bots were just hammering the login form, checking checkboxes and causing me to rack up email sending bills.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#46
post #20

Earlier quoted context omitted.

There are two alternatives I'm aware of, one is Attestation of Personhood[1] proposed by Cloudflare, the other is a proof-of-work[2] which the Tor project have themselves introduced[3]. [1]: https://blog.cloudflare.com/introducing-cryptographic-attest... [2]: https://github.com/mCaptcha/mCaptcha [3]: https://blog.torproject.org/introducing-proof-of-work-defens...

While I get the draw, I never understood how PoW is ever supposed to work practically. PoW tasks are meant to work on a wide range of mobile phones, desktops, single-board computers, etc... you have vastly different compute budgets in every environment. For a PoW task that is usable on a five year old mobile phone, an adversary with a consumer RTX 50 series card (or potentially even an ASIC) can easily perform it man…

You are not missing something, you are finding it: the game theory of bots vs anti-bots is subtle and somewhat different from regular software engineering and cyber security.

For the most part bots wish to be hidden and sites wish to reveal them, and this plays out over repeat games on small and large scales. Can be near-constantly or intermittently.

The bot usually gets to make the first move against a backdrop that the anti-bot may or may not have a hand in.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#47

I'm at the point now that if I get a CAPTCHA, I'm just going to leave the site. I'll spend my money elsewhere or find an alternative

This automatically means that you're penalizing smaller websites. And killing off the independent alternatives to Reddit/Disqus. Do you want this?

Large sites like Amazon or CNN can afford to eat the bot traffic. Smaller sites can't.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#48

Earlier quoted context omitted.

> There are no humans that know the word snow who don’t know what colours Snow is Sorry, I don't follow, English is a second language to me, but how does this stand against my statement that 'many people don't know the concept of snow, let alone what colour it is'?

There's no reason for an English language website to cater to people who don't know what snow is. How can it be discriminatory to have a question a user can't comprehend, when they won't be able to comprehend the rest of the website either? Even blind people who can read English Braille and input text in English know that snow is white, even if they've never seen it. If a website is multilingual, it can offer languag…

I did not say it was discriminatory -- I stick to basic terms -- you may inadvertently be guarding against people who for one reason or another don't possess the knowledge to solve the puzzle. For example I could copy over an integral from one of my undergrad exams. 'Please calculate the value of the integral and enter it in the field below' (completely accessible to screen readers as well). This would effectively ban not only people who have not taken a calculus class, but many of my uni colleagues who have happily forgotten everything about calculus after they took their exams 10 years ago...

Another example for an inadvertently hard puzzle, this time due to a lack knowledge as a consequence of being part of a different culture, would be asking US people what colour is the edelweiss. In my country children learn about it in first grade if not in kindergarten. Another -- asking Europeans/US people what colour is romduol... I don't consider this discriminatory, I don't consider people in the US or Europe uneducated because they cannot solve such a simple puzzle... It is just poor/lazy/stupid design that fails the single requirement to block bots and only bots. And I get it 'I would just google it'... But how many conversions will you lose if a considerable part of your users need to google something to go to the next step of your funnel? It's just inexcusably shit UX...

You would indeed be fine with the 'snow' question if your site must only be visited and used by fellow citizens of your country (where citizens implies similar education -- both cultural and scientific). You would indeed be fine if you can make sure the puzzle will be translated intelligently (including the solution) if your site may be used in a foreign country or by users speaking the language in your own country.

I usually cannot make any of these assumptions for any of the projects I work on. The site's audience is but a whim of the Product team, and I18n is outsourced to (once) translation agencies and now directly to an LLM... This can even be done (and frankly should be done) without the knowledge or input of the dev team. Also, neither translators nor LLMs can be expected to understand that they must come up with basically a new puzzle that will not be hard for people that use the specific language. And I as a developer that does not speak the specific foreign language while I can roughly validate their translation (if by any chance it passes by me for review and I go above and beyond what is expected of me and pass it trough a translation service) and return it with feedback for fixes, I cannot rely that they will abide by the feedback, or how long it would take... Those are a lot unknowns to consider these assumptions reliable, and it seems much less effort to come up with a simpler puzzle that contains the answer in itself... Its effectiveness against spam will be exactly the same.

Also, you will definitely not be fine if your puzzle contains a concept foreign for a considerable part of people who can't for example see or hear. You would also not be fine if your puzzle's technical implementation makes it impossible to be perceived by them. The latter part is very simple to get wrong. For example, one of the best ways to protect any site from blind people is to implement a hero image slidshow that steals the focus on each slide. Their screen readers' focus gets moved each second and they literally cannot perceive, let alone navigate the site...

Finally, none of the peculiarities above excuses straight up going for reCAPTCHA. Even if you don't give a f about your users' data EU users can and will get you in trouble with EU regulators exactly when you get to a scale at which CAPTCHA use is a necessity. There's a cultural difference for you.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#49

Earlier quoted context omitted.

While I get the draw, I never understood how PoW is ever supposed to work practically. PoW tasks are meant to work on a wide range of mobile phones, desktops, single-board computers, etc... you have vastly different compute budgets in every environment. For a PoW task that is usable on a five year old mobile phone, an adversary with a consumer RTX 50 series card (or potentially even an ASIC) can easily perform it man…

You are not missing something, you are finding it: the game theory of bots vs anti-bots is subtle and somewhat different from regular software engineering and cyber security. For the most part bots wish to be hidden and sites wish to reveal them, and this plays out over repeat games on small and large scales. Can be near-constantly or intermittently. The bot usually gets to make the first move against a backdrop that…

Are you suggesting that ultra-quick solves would be a signal that a user-agent is malicious? That's interesting...

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#50
post #47

I'm at the point now that if I get a CAPTCHA, I'm just going to leave the site. I'll spend my money elsewhere or find an alternative

This automatically means that you're penalizing smaller websites. And killing off the independent alternatives to Reddit/Disqus. Do you want this? Large sites like Amazon or CNN can afford to eat the bot traffic. Smaller sites can't.

Sounds a heck of a lot like the bots are killing off these websites. Gross overuse of automated scraping is a fact of life but individual choice is intolerable. What if I told you they were the same thing?
Post reply on HN