Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The CAPTCHA arms race: from distorted text to browser identity

browserbase.com

Post reply on HN
Print view View original

41–50 of 60 posts

Re: The CAPTCHA arms race: from distorted text to browser identity

#41

Post by yieldcrv »

giancarlostoro wrote: post #39

I remember at one point in my teens, someone had made a web app that would snag the captcha and show you only the captcha, and you would just endlessly solve captchas, while the application tried different passwords on a backend, and logging any successful logins.

Some of the first bitcoin faucets in 2011, 2012 were bots doing that

Users thought the captcha was antispam prevention for them to receive bitcoin

It was really just the bot forwarding a captcha to continue its spam once solved, posting the user in bitcoin

Re: The CAPTCHA arms race: from distorted text to browser identity

#42

Post by peytoncasper »

matteo8p wrote: post #29

Really nice read Harsehaj! I haven't looked deeply into Web Bot Auth, but is identification tied to the agent (one identity per agent) or is it tied to the underlying person using the agent (the user)? Hope that question makes sense, lmk if you need clarification

Hey Matt,

I would say everyone is leaning towards organization/individual right now but I would image that flips as the number of agents grow

Re: The CAPTCHA arms race: from distorted text to browser identity

#43

Post by curtisboortz »

The Chrome extension angle is interesting here. We ship an extension that interacts with Gmail and have seen how much variance there is in what Google considers "bot-like" behavior from extensions vs. the browser tab. The line between "automated" and "assisted" is not well defined at the API level, which ends up being a similar underlying problem: distinguishing intent rather than pattern.

Re: The CAPTCHA arms race: from distorted text to browser identity

#44

Post by chinathrow »

ben_w wrote: post #32
epgui wrote: post #12

I thought half the point of captchas was to train vision models?

This is in the article. Indeed, half the point for reCAPTCHA: That how Google could justify supplying reCAPTCHA for free, but not why people wanted to use them.

> That how Google could justify supplying reCAPTCHA for free, but not why people wanted to use them

This and Pokemon Go for collecting videos: are there other examples of users doing the free work for $large_co?

Re: The CAPTCHA arms race: from distorted text to browser identity

#45

Post by chrismorgan »

netik wrote: post #31

So this is a basically a shill advertisement ending in "Your AI Agents can avoid captchas if you pay us." The last example is a false narrative, that captchas will only happen if the "browser looks suspicious". Systems like Altcha put an end to this argument. They don't care if the browser looks suspicious, only that the browser can perform a proof-of-work to get past a captcha designed to slow down the request rate.…

Proof-of-work is bad rate limiting: https://news.ycombinator.com/item?id=44093918. The playing field is wildly unbalanced. Even naive attackers tend to have a lot more computing power available than a lot of your normal users, and where it’s SHA-256 (which is almost the worst choice imaginable for a proof of work scheme, yet which every single service that I know of has used), an intelligent attacker goes from being hundreds of times as powerful to millions of times as powerful.

Re: The CAPTCHA arms race: from distorted text to browser identity

#46

Post by peeet »

netik wrote: post #31

So this is a basically a shill advertisement ending in "Your AI Agents can avoid captchas if you pay us." The last example is a false narrative, that captchas will only happen if the "browser looks suspicious". Systems like Altcha put an end to this argument. They don't care if the browser looks suspicious, only that the browser can perform a proof-of-work to get past a captcha designed to slow down the request rate.…

More advanced and targeted bots can "bypass" Proof of work as well though, e.g. using something like https://github.com/toman-tom/Incapsula-PoW

Re: The CAPTCHA arms race: from distorted text to browser identity

#47

Post by giancarlostoro »

yieldcrv wrote: post #41
giancarlostoro wrote: post #39

I remember at one point in my teens, someone had made a web app that would snag the captcha and show you only the captcha, and you would just endlessly solve captchas, while the application tried different passwords on a backend, and logging any successful logins.

Some of the first bitcoin faucets in 2011, 2012 were bots doing that Users thought the captcha was antispam prevention for them to receive bitcoin It was really just the bot forwarding a captcha to continue its spam once solved, posting the user in bitcoin

LOL I don't remember doing captcha, but I remember receiving bitcoin from a faucet, thought it was strange.

Re: The CAPTCHA arms race: from distorted text to browser identity

#49

Post by ben_w »

chinathrow wrote: post #44
ben_w wrote: post #32

Earlier quoted context omitted.

This is in the article. Indeed, half the point for reCAPTCHA: That how Google could justify supplying reCAPTCHA for free, but not why people wanted to use them.

> That how Google could justify supplying reCAPTCHA for free, but not why people wanted to use them This and Pokemon Go for collecting videos: are there other examples of users doing the free work for $large_co?

https://en.wikipedia.org/wiki/Self-checkout

Re: The CAPTCHA arms race: from distorted text to browser identity

#50

Post by netik »

chrismorgan wrote: post #45
netik wrote: post #31

So this is a basically a shill advertisement ending in "Your AI Agents can avoid captchas if you pay us." The last example is a false narrative, that captchas will only happen if the "browser looks suspicious". Systems like Altcha put an end to this argument. They don't care if the browser looks suspicious, only that the browser can perform a proof-of-work to get past a captcha designed to slow down the request rate.…

Proof-of-work is bad rate limiting: https://news.ycombinator.com/item?id=44093918 . The playing field is wildly unbalanced. Even naive attackers tend to have a lot more computing power available than a lot of your normal users, and where it’s SHA-256 (which is almost the worst choice imaginable for a proof of work scheme, yet which every single service that I know of has used), an intelligent attacker goes from being…

I agree with this assessment but for many applications it's a viable approach, until the attacker goes off and writes their own shader to solve the PoW. We go to back to threat modeling here, and looking at the amount of effort vs gain here.

They're now integrating Argon2ID in an attempt to squash GPU hacks but it places ridiculous demands on the client being Memory hard.

Post reply on HN