Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The CAPTCHA arms race: from distorted text to browser identity

browserbase.com

Post reply on HN
Print view View original

51–60 of 60 posts

Re: The CAPTCHA arms race: from distorted text to browser identity

#51

Post by ktpsns »

CM30 wrote: post #26

The issue is that anything that becomes a standard here automatically becomes a target. If the same sort of captcha protects everything from Gmail to Twitter to Cloudflare and Facebook, then bot creators and spammers have a huge incentive to bypass it no matter what. And if we've learnt anything about spam, it's that pretty much every system we can think of can be bypassed or automated away. The solution is really a…

This is the reason why I implemented rather dumb but individual, hand-crafted captchas for my own websites in the past. Things like input fields which must be left empty, silly multiple choice questions only humans could properly answer at that time, etc.

I have seen communities to implement their own captchas with domain knowledge. For instance, math/STEM people showing captchas with rather easy calculus tasks (such as solving a definite integral). This can be fun to solve and as a human you feel valued. It is this handmade feeling of the "old internet".

The problem with self-made captchas is that even them are rather easy to solve nowadays with LLMs and thelike. Therefore I don't believe that decentralized individualized captchas are the solution as they tend to be rather simple.

Re: The CAPTCHA arms race: from distorted text to browser identity

#52

Post by ameliaquining »

netik wrote: post #50
chrismorgan wrote: post #45

Earlier quoted context omitted.

Proof-of-work is bad rate limiting: https://news.ycombinator.com/item?id=44093918 . The playing field is wildly unbalanced. Even naive attackers tend to have a lot more computing power available than a lot of your normal users, and where it’s SHA-256 (which is almost the worst choice imaginable for a proof of work scheme, yet which every single service that I know of has used), an intelligent attacker goes from being…

I agree with this assessment but for many applications it's a viable approach, until the attacker goes off and writes their own shader to solve the PoW. We go to back to threat modeling here, and looking at the amount of effort vs gain here. They're now integrating Argon2ID in an attempt to squash GPU hacks but it places ridiculous demands on the client being Memory hard.

This seems like the real mechanism here is not actually proof-of-work so much as security-through-obscurity.

Re: The CAPTCHA arms race: from distorted text to browser identity

#53

Post by ameliaquining »

epgui wrote: post #12

I thought half the point of captchas was to train vision models?

Those were not "vision models" in the modern sense, but rather crude classifiers or OCR systems that were heavily dependent on human labor to handle many cases, because the vision models of the time sucked and were hardly capable of anything. The economic value of CAPTCHA-based data labeling went to zero when AlexNet (the first general-purpose vision model good enough for real-world use) was released in 2012; from then on, you could just have the machines do that work instead.

Re: The CAPTCHA arms race: from distorted text to browser identity

#54

Post by CodesInChaos »

netik wrote: post #50
chrismorgan wrote: post #45

Earlier quoted context omitted.

Proof-of-work is bad rate limiting: https://news.ycombinator.com/item?id=44093918 . The playing field is wildly unbalanced. Even naive attackers tend to have a lot more computing power available than a lot of your normal users, and where it’s SHA-256 (which is almost the worst choice imaginable for a proof of work scheme, yet which every single service that I know of has used), an intelligent attacker goes from being…

I agree with this assessment but for many applications it's a viable approach, until the attacker goes off and writes their own shader to solve the PoW. We go to back to threat modeling here, and looking at the amount of effort vs gain here. They're now integrating Argon2ID in an attempt to squash GPU hacks but it places ridiculous demands on the client being Memory hard.

Did they evaluate good old bcrypt? I haven't looked at it in a while, but it used to be very GPU unfriendly (though still vulnerable to FPGA/ASIC).

Re: The CAPTCHA arms race: from distorted text to browser identity

#55

Post by pentacent_hq »

netik wrote: post #31

So this is a basically a shill advertisement ending in "Your AI Agents can avoid captchas if you pay us." The last example is a false narrative, that captchas will only happen if the "browser looks suspicious". Systems like Altcha put an end to this argument. They don't care if the browser looks suspicious, only that the browser can perform a proof-of-work to get past a captcha designed to slow down the request rate.…

Do you have real-world experience deploying PoW captchas? I'd love to give them a try but I'm worried my forms will end up getting overwhelmed with spam if I switch away from hCaptcha.

Re: The CAPTCHA arms race: from distorted text to browser identity

#57

Post by CM30 »

ktpsns wrote: post #51
CM30 wrote: post #26

The issue is that anything that becomes a standard here automatically becomes a target. If the same sort of captcha protects everything from Gmail to Twitter to Cloudflare and Facebook, then bot creators and spammers have a huge incentive to bypass it no matter what. And if we've learnt anything about spam, it's that pretty much every system we can think of can be bypassed or automated away. The solution is really a…

This is the reason why I implemented rather dumb but individual, hand-crafted captchas for my own websites in the past. Things like input fields which must be left empty, silly multiple choice questions only humans could properly answer at that time, etc. I have seen communities to implement their own captchas with domain knowledge. For instance, math/STEM people showing captchas with rather easy calculus tasks (such…

The issue is that AI bots can answer pretty much any captcha that isn't ridiculously obtuse. Your homemade captcha can be solved with an LLM, but so can the latest version of Recaptcha or whatever.

But I feel that there may be some other tools here. Spammers in general tend to be fairly predictable in their behaviour, so tracking that could help. If a member is including links to a third party site in dozens of messages, that should be a pretty big hint that their intentions are questionable. If they blast through the registration page in seconds, same thing.

Personally, I've not seen more than a single spammer on the forum I run for the last 6 months or so, so I'm still optimistic that most don't bother unless it's easy to attack and worth their time.

Re: The CAPTCHA arms race: from distorted text to browser identity

#59

Post by willmadden »

prmoustache wrote: post #35
willmadden wrote: post #18

Earlier quoted context omitted.

They give you that (or hieroglyphics) if you are using certain VPNs and don't leave a specific browser fingerprint.

There is a point where not leaving fingerprints becomes a fingerprint in itself.

The best browsers that do not leave fingerprints do so by making your fingerprint look like every other fingerprint. Cydec used to have a plugin that actually worked for randomizing everything, but support ended. Maintenance for that must have been a nightmare. The best approach now is to blend in by looking like everyone else doing the same thing.

Re: The CAPTCHA arms race: from distorted text to browser identity

#60

Post by hombre_fatal »

wildzzz wrote: post #34
hombre_fatal wrote: post #25

As TFA points out, a major change is that bot traffic now comes from honest users via their LLM sessions, so you don't even necessarily want to block automated bots anymore. The game is shifting to a better ideal: how do you design a service knowing that any user/request might be automated? Especially in place of the historical, easy solution/hack where you have some sort of gate that, once passed, puts the user in s…

You use API tokens for things intended to be machine to machine communication and captchas for things intended to be filled out by humans. Not every site or service wants automated input, even if it's being directed by a human. I dont want forums like HN just filled with a bunch of agents talking to eachother, where's the human connection?

Captchas are dead or will be dead shortly. The question is what do you do in a world where you can't tell human from machine, or when there's now honest machine traffic that acts on behalf of honest users.

> You use API tokens for things intended to be machine to machine communication

Who uses it and why? Not for websites where the agent is making read-only web requests for the user. And now that agents have generalized abilities/intelligence, there's fewer and fewer incentives to use APIs since the arms race to keep humans and machines segregated is ended/ending.

We need new ideas and paradigms, not cling on to old ones that won't work.

Post reply on HN