3 ms·

Generally, the point of a CAPTCHA is to prevent automated use of a service. If we get to the point where CAPTCHA's no longer work in preventing automated access

by cyorir 11y ago

Generally, the point of a CAPTCHA is to prevent automated use of a service. If we get to the point where CAPTCHA's no longer work in preventing automated access to services, we need to look for atypical use of services. For example, if a computer passes a CAPTCHA in order to use gmail to automate the sending of spam emails, look for users that mass-spam; typical users won't do that. On the other hand, the computer may try to approximate the usage of a typical user to avoid detection. But if you cant distinguish automated use of your service from typical use of your service, then at that point maybe it doesn't matter so much.

MuEta 11y ago
The natural extension of that argument always reminds me of this: https://xkcd.com/810/ https://xkcd.com/810/
rms_returns 11y ago
Another alternative to CAPTCHA is the obvious three-factor authentication. Send a random code to your mobile number, if its really you, you can verify yourself by entering that number on the web-page. Another way is to send the same using email which is a bit more convenient than sending it to cell-phone. In other words, we need to keep inventing more sophisticated ways of telling the difference between humans and computers (and the great progress in the field of AI is certainly going to push us to do that more frequently) Looking for atypical use of services is something that we should be already doing, but there are limits to those. The said users you are talking about keep churning new email addresses and hide behind dynamic IP ranges of countries like Mongolia or Kyrgyzstan over which we have no control. We can't tell the difference between good/bad IPs for traffic coming from there, otherwise there is no need for Google to keep re-inventing the CAPTCHA every few years.
grkvlt 11y ago
Sure, but the point of a CAPTCHA is to pre-emptively detect the user as a human or computer. Waiting until the account sends a boat-load of spam, and then saying 'must've been a computer, let's disable the account' does nothing - the culprit has accomplished their task, and moved on. We want to be able to prevent the spam from being sent in the first place, somehow, and determining if it's a real human opening the account is (was?) a very good check.

by cyorir 11y ago

MuEta 11y ago

The natural extension of that argument always reminds me of this: https://xkcd.com/810/ https://xkcd.com/810/

rms_returns 11y ago

Another alternative to CAPTCHA is the obvious three-factor authentication. Send a random code to your mobile number, if its really you, you can verify yourself by entering that number on the web-page. Another way is to send the same using email which is a bit more convenient than sending it to cell-phone. In other words, we need to keep inventing more sophisticated ways of telling the difference between humans and computers (and the great progress in the field of AI is certainly going to push us to do that more frequently) Looking for atypical use of services is something that we should be already doing, but there are limits to those. The said users you are talking about keep churning new email addresses and hide behind dynamic IP ranges of countries like Mongolia or Kyrgyzstan over which we have no control. We can't tell the difference between good/bad IPs for traffic coming from there, otherwise there is no need for Google to keep re-inventing the CAPTCHA every few years.

grkvlt 11y ago

Sure, but the point of a CAPTCHA is to pre-emptively detect the user as a human or computer. Waiting until the account sends a boat-load of spam, and then saying 'must've been a computer, let's disable the account' does nothing - the culprit has accomplished their task, and moved on. We want to be able to prevent the spam from being sent in the first place, somehow, and determining if it's a real human opening the account is (was?) a very good check.