Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

pcgamer.com

Post reply on HN
Print view View original

91–100 of 143 posts

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#91

Post by apitman »

thatguy0900 wrote: post #21
unethical_ban wrote: post #19

What proof of humanity is sufficient? Today it is a phone call, or a verification sent to a real address (limit one registration per household), or a video call. How will we verify humanity in 20 years when audio and video emulation is foolproof? We'll have to have in-person attestation or make all services paid, perhaps.

Realistically it will be a government or private service that everyone will have to have to verify that it is a real person. Or at least tied to a real person so that banning will be more sticky.

Like Google

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#92

Post by btown »

The "cookie farm for profit" point is worth elaborating on. From the original paper https://arxiv.org/pdf/2311.10911 :

> More concretely, the current average value life-time of a cookie is €2.52 or $2.7 [58]. Given that there have been at least 329 billion reCAPTCHAv2 sessions, which created tracking cookies, that would put the estimated value of those cookies at $888 billion dollars.

The cited paper is https://www.sciencedirect.com/science/article/pii/S016781162... - but it doesn't deal with CAPTCHAs, just with the general economics of third-party cookies.

In practice, many of these cookies will have already been placed by other Google services on the site in question, with how ubiquitous Google's ad and analytics products are. And it's unclear whether Google uses the _GRECAPTCHA cookies for purposes other than the CAPTCHA itself (in the places where this isn't regulated).

But reCAPTCHA does gives Google an ability to have scripts running that fundamentally can't be ad-blocked without breaking site functionality, and it's an effective foot in the door if Google ever wanted to use it more broadly. It's absolutely something to be aware of.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#93

Post by [deleted] »

LightHugger wrote: post #85
technion wrote: post #68

Earlier quoted context omitted.

Logon forms are another whole issue. "Lock out the account" is just a DoS vector. People are quick to talk about systems that can defeat a captcha but if the brute force goes from 50 passwords/sec to one password/10 sec it's mission accomplished.

Can't you just put a 5 second "loading bar" delay instead of a captcha then i wonder?

[deleted]

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#94

Post by ThatPlayer »

phoronixrly wrote: post #14
atoav wrote: post #8

Earlier quoted context omitted.

Building your own captcha or running one that doesn't sell your users data to the highest bidder? What a time where people on a site called "Hacker News" ask such a question..

And if you ever get so big that people start writing bespoke software to break your CAPTCHA, then investing some more engineering effort into it will quite likely not be a problem. Of course reCAPTCHA is also still vulnerable to the use of a mechanical turk so even giving away your users' data won't save you.

I've come across a CAPTCHA on a website I was scraping that was absolutely terrible. It was 10 multiple image choice answer, with a question to click the image that had "X". Their implementation didn't even have a nonce, so I would just attempt every single answer and get past it.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#95

Post by onetokeoverthe »

cryptoegorophy wrote: post #61
cyberax wrote: post #47

Earlier quoted context omitted.

This automatically means that you're penalizing smaller websites. And killing off the independent alternatives to Reddit/Disqus. Do you want this? Large sites like Amazon or CNN can afford to eat the bot traffic. Smaller sites can't.

Problem isn’t a bot traffic. I run an Ecommerce site and scammers run python scripts to test 1000s of cards per hour if there is no captcha. I hate it, my customers hate it, scammers hate it, but it is the only thing that keeps my merchant account running. Any advise is welcome!

would requiring a un/pw sent to an email address work￶?

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#96

Post by LordKeren »

phoronixrly wrote: post #28
josefresco wrote: post #25

Earlier quoted context omitted.

I can tell you on the small level asking a simple question to activate the form action stops 99% of spam. Something like "What color is snow?" Granted, with a well trained "AI" system solving these questions would be trivial but I have yet to see it in practice.

Sorry for nitpicking but you need a puzzle that is knowledge-agnostic (be it cultural or scientific), otherwise you're guarding your site from both bots and people unfamiliar with the concept of or lacking the pre-existing knowledge necessary to solve the puzzle. What colour is snow is close but you can't assume that everyone knows what snow is, let alone what colour it is. This includes both people with disabilities…

.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#97

Post by bigbuppo »

819 million hours of unpaid labor. And just think, a large chunk of that was performed by children. CAPTCHAs are slave labor in small doses. It's also a way of avoiding paying taxes on that labor. But hey, what's a few billion dollars in unpaid taxes and unpaid wages and child labor violations between friends?

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#98

Post by kevin_thibedeau »

Dotnaught wrote: post #83

Google addressed the claims in this paper last year, and one of the authors challenged the company's responses. See: https://www.theregister.com/2024/07/24/googles_recaptchav2_l...

As of two weeks ago my locked down Firefox profile gets hit with captchas on every visit to Google search. DDG has also gone to shit with captchas and stupid low cache lifetime because I use their non-javascript site. I'm giving Bing a test run before making the leap to Kagi.

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#99

Post by aja12 »

LightHugger wrote: post #85
technion wrote: post #68

Earlier quoted context omitted.

Logon forms are another whole issue. "Lock out the account" is just a DoS vector. People are quick to talk about systems that can defeat a captcha but if the brute force goes from 50 passwords/sec to one password/10 sec it's mission accomplished.

Can't you just put a 5 second "loading bar" delay instead of a captcha then i wonder?

If you do that on the server side, per account, it works. Small DoS risk, but it remains acceptable

Re: CAPTCHAs: 'a tracking cookie farm for profit masquerading as a security service'

#100

Post by aja12 »

LightHugger wrote: post #85
technion wrote: post #68

Earlier quoted context omitted.

Logon forms are another whole issue. "Lock out the account" is just a DoS vector. People are quick to talk about systems that can defeat a captcha but if the brute force goes from 50 passwords/sec to one password/10 sec it's mission accomplished.

Can't you just put a 5 second "loading bar" delay instead of a captcha then i wonder?

If you do that on the server side, per account, it works. Small DoS risk, but it remains acceptable
Post reply on HN