Live data from Hacker News

CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

pcgamer.com

51–60 of 143 posts

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#51
Naive question: how can clicking on the motorbike or traffic light image help to train an ML algorithm if they already know what image has a motorbike in it, or otherwise the captcha would not make sense. Maybe they put 3 image which are already with a score of >0.90 and one which is just 0.40?

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#52

Naive question: how can clicking on the motorbike or traffic light image help to train an ML algorithm if they already know what image has a motorbike in it, or otherwise the captcha would not make sense. Maybe they put 3 image which are already with a score of >0.90 and one which is just 0.40?

[deleted]

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#53

Naive question: how can clicking on the motorbike or traffic light image help to train an ML algorithm if they already know what image has a motorbike in it, or otherwise the captcha would not make sense. Maybe they put 3 image which are already with a score of >0.90 and one which is just 0.40?

Yes, known images are used for validation, unknown images are used for training.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#54

Naive question: how can clicking on the motorbike or traffic light image help to train an ML algorithm if they already know what image has a motorbike in it, or otherwise the captcha would not make sense. Maybe they put 3 image which are already with a score of >0.90 and one which is just 0.40?

they ask you to solve two. one they know, the other they don’t

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#55

Naive question: how can clicking on the motorbike or traffic light image help to train an ML algorithm if they already know what image has a motorbike in it, or otherwise the captcha would not make sense. Maybe they put 3 image which are already with a score of >0.90 and one which is just 0.40?

Hypothetically speaking, if they've got a 97% good ML model, they could implement a captcha where if you disagree with their model you have to do a second image, and a third image and so on. Then they could show each image to several different humans, and only if a bunch of people disagree with the model do they take a closer look.

Frankly a lot of the images I get are... kinda easy? This isn't the classic book-reading recaptcha where you could see why the text had confused the OCR.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#56
post #37

I'm at the point now that if I get a CAPTCHA, I'm just going to leave the site. I'll spend my money elsewhere or find an alternative

My government's websites require solving a reCAPTCHA for basic services, which is horrifying. They also use Cloudflare which blocks me sometimes. This is in the EU

Name and shame, please!!

ReCAPTCHA due lack of opt out is effectively illegal in the EU.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#58
post #26

The problem with this paper is that, while technically true, there are many website owners who have found that CAPTCHAs have effectively reduced the spam on their site to zero. The fact that a CAPTCHA _can_ be bypassed doesn't mean that it _will_, and most spam bots are not using cutting-edge tech because that's expensive. To say "it's worthless from a security perspective" is a pretty harsh and largely inaccurate re…

Far too many people talk about security as if it's a simple binary and not about effort levels and dissuading attackers.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#60
post #47

I'm at the point now that if I get a CAPTCHA, I'm just going to leave the site. I'll spend my money elsewhere or find an alternative

This automatically means that you're penalizing smaller websites. And killing off the independent alternatives to Reddit/Disqus. Do you want this? Large sites like Amazon or CNN can afford to eat the bot traffic. Smaller sites can't.

Did you read the article? What you said directly goes against the study's conclusion.
Post reply on HN