Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

pcgamer.com

Post reply on HN
Print view View original

61–70 of 143 posts

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#61

Post by cryptoegorophy »

cyberax wrote: post #47
jp191919 wrote: post #13

I'm at the point now that if I get a CAPTCHA, I'm just going to leave the site. I'll spend my money elsewhere or find an alternative

This automatically means that you're penalizing smaller websites. And killing off the independent alternatives to Reddit/Disqus. Do you want this? Large sites like Amazon or CNN can afford to eat the bot traffic. Smaller sites can't.

Problem isn’t a bot traffic. I run an Ecommerce site and scammers run python scripts to test 1000s of cards per hour if there is no captcha. I hate it, my customers hate it, scammers hate it, but it is the only thing that keeps my merchant account running. Any advise is welcome!

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#62

Post by phoronixrly »

breppp wrote: post #57

I get that people are here to hate on Google, but I am just here to say that reCAPTCHA albeit acquired, is an absolutely brilliant idea. The kind that solves two (three? if you count tracking) problems so elegantly

Absolutely agreed on the 'very elegant solution for global-scale tracking' part!

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#63

Post by thechao »

voisin wrote: post #17
ghuroo1 wrote: post #2

That made us spend 819 million hours clicking on traffic lights to generate nearly $1 trillion for Google.

At an approx 750,000 hours in a human lifespan, they wasted 1100 human lives in totality. Unbelievable.

There's a dystopian short story in your comment about AI that can't self-bootstrap without ground-truth from humans, so they keep us around just to mark images, music, etc. Lives wasted annotating things. I like to think they'd drag us from solar system to solar system for this purpose.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#64

Post by therein »

breppp wrote: post #57

I get that people are here to hate on Google, but I am just here to say that reCAPTCHA albeit acquired, is an absolutely brilliant idea. The kind that solves two (three? if you count tracking) problems so elegantly

Multi-purpose trojan horse. Not only will it look beautiful in your city but you can use it as scaffolding to repair tall buildings or children in your community could use it as a play gym.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#65

Post by cyberax »

mouse_ wrote: post #60
cyberax wrote: post #47

Earlier quoted context omitted.

This automatically means that you're penalizing smaller websites. And killing off the independent alternatives to Reddit/Disqus. Do you want this? Large sites like Amazon or CNN can afford to eat the bot traffic. Smaller sites can't.

Did you read the article? What you said directly goes against the study's conclusion.

I'm helping a neighbor to run a small e-commerce website with reviews. Review forms are being spammed by bots that get even through CAPTCHAs, and the owner needs to clean them up constantly. Without CAPTCHAs, it becomes unsustainable.

They don't get a lot of bots trying stolen credit cards, but mostly because they are pretty niche.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#66

Post by taftster »

thechao wrote: post #63
voisin wrote: post #17

Earlier quoted context omitted.

At an approx 750,000 hours in a human lifespan, they wasted 1100 human lives in totality. Unbelievable.

There's a dystopian short story in your comment about AI that can't self-bootstrap without ground-truth from humans, so they keep us around just to mark images, music, etc. Lives wasted annotating things. I like to think they'd drag us from solar system to solar system for this purpose.

Gosh. This is too perfect. I feel like you've just captured the exact moment we're living in.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#68

Post by technion »

cryptoegorophy wrote: post #61
cyberax wrote: post #47

Earlier quoted context omitted.

This automatically means that you're penalizing smaller websites. And killing off the independent alternatives to Reddit/Disqus. Do you want this? Large sites like Amazon or CNN can afford to eat the bot traffic. Smaller sites can't.

Problem isn’t a bot traffic. I run an Ecommerce site and scammers run python scripts to test 1000s of cards per hour if there is no captcha. I hate it, my customers hate it, scammers hate it, but it is the only thing that keeps my merchant account running. Any advise is welcome!

Logon forms are another whole issue. "Lock out the account" is just a DoS vector. People are quick to talk about systems that can defeat a captcha but if the brute force goes from 50 passwords/sec to one password/10 sec it's mission accomplished.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#69

Post by phoronixrly »

openplatypus wrote: post #56
a2128 wrote: post #37

Earlier quoted context omitted.

My government's websites require solving a reCAPTCHA for basic services, which is horrifying. They also use Cloudflare which blocks me sometimes. This is in the EU

Name and shame, please!! ReCAPTCHA due lack of opt out is effectively illegal in the EU.

reCAPTCHA (and others based outside of EU) is illegal on privacy ground (in any site, not just owned by EU entities). Homebrew CAPTCHAs are illegal due to their general lack of accessibility (in any site owned by an EU entity), and in Bulgaria their gratuitous use is banned in government sites on account of them being poor UX (not enforced unless caught during the acceptance phase of a project).

An example of an inaccessible homebrew CAPTCHA that causes very poor UX can be found on the portal that provides access to the legal acts of the Bulgarian judicial system: https://legalacts.justice.bg/ . Try taking the legal system to court. I tried for this one, you can see for yourself how it went.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#70

Post by rachofsunshine »

Scaevolus wrote: post #58
eykanal wrote: post #26

The problem with this paper is that, while technically true, there are many website owners who have found that CAPTCHAs have effectively reduced the spam on their site to zero. The fact that a CAPTCHA _can_ be bypassed doesn't mean that it _will_, and most spam bots are not using cutting-edge tech because that's expensive. To say "it's worthless from a security perspective" is a pretty harsh and largely inaccurate re…

Far too many people talk about security as if it's a simple binary and not about effort levels and dissuading attackers.

People really struggle with things that have measurable, probabilistic effects. You see it with healthcare ("Steve smoked his whole life and never got cancer, so cigarettes aren't bad for you!"), environmental effects ("Alice was poor and she didn't rob anyone, so poverty is no excuse!"), hiring ("Charlie is a great employee and he had no experience, so you should never look at backgrounds!"), etc.

It should be a general standard of proof for any sort of sociological claim that you look at rates, not just examples, but it usually isn't.

Post reply on HN