5 ms·

I use Firefox with maximum tracking protections and a VPN, so I'm first in line to claim frustration about being forced to solve reCAPTCHAs. But on the other s

I use Firefox with maximum tracking protections and a VPN, so I'm first in line to claim frustration about being forced to solve reCAPTCHAs. But on the other side, it needs to be understood just how important having a CAPTCHA is. The amount of destruction to user experience that bots can cause is sometimes far worse than the pain the CAPTCHA causes. The long chains of reCAPTCHAs annoy me to no end, and I hope a middle ground can be reached, but bots are a very serious problem. I do wonder if maybe computational challenges are a feasible alternative in some scenarios, or perhaps as an alternative choice you could give to the users.

sgillen 8y ago
What exactly do you mean by computational challenges? That seems like the exact kind of thing a bot would be much better at compared to a human.
- robin_reala 8y ago
  The thought is that a single user isn’t inconvenienced by a small amount of computational work to access a site, but a scraper is tarpitted into uselessness by it. Unfortunately this completely ignores the fact that the majority of site accesses are on battery power now.
- Kaveren 8y ago
  The idea is that you'd need to make the computational challenge more expensive to solve than any profit that success would have. This is what some DDoS protection services do (e.g. the "checking your browser" messages you might see). In some scenarios such as spam, the profit per bot action isn't high at all, so this might be feasible. If it's a ticket bot, that wouldn't work at all. Of course, you're hurting users without good devices, which just sucks. I haven't really thought too deep into the economics of this, I don't know if it'd work at all. Just a thought. Edit: Meant to include mobile in there, I don't know how if this would or wouldn't work with this scheme for mid-end+ Android devices or iPhones.
  - wild_preference 8y ago
    HashCash had the same idea and failed for the same reason: bad actors aren't using their own machines. They have access to the cheapest compute in the world: botnets and the compute of honest actors. Add in the mobile-device issue and you quite literally have a solution that's lose/lose.

sgillen 8y ago

What exactly do you mean by computational challenges? That seems like the exact kind of thing a bot would be much better at compared to a human.

robin_reala 8y ago
The thought is that a single user isn’t inconvenienced by a small amount of computational work to access a site, but a scraper is tarpitted into uselessness by it. Unfortunately this completely ignores the fact that the majority of site accesses are on battery power now.
Kaveren 8y ago
The idea is that you'd need to make the computational challenge more expensive to solve than any profit that success would have. This is what some DDoS protection services do (e.g. the "checking your browser" messages you might see). In some scenarios such as spam, the profit per bot action isn't high at all, so this might be feasible. If it's a ticket bot, that wouldn't work at all. Of course, you're hurting users without good devices, which just sucks. I haven't really thought too deep into the economics of this, I don't know if it'd work at all. Just a thought. Edit: Meant to include mobile in there, I don't know how if this would or wouldn't work with this scheme for mid-end+ Android devices or iPhones.
- wild_preference 8y ago
  HashCash had the same idea and failed for the same reason: bad actors aren't using their own machines. They have access to the cheapest compute in the world: botnets and the compute of honest actors. Add in the mobile-device issue and you quite literally have a solution that's lose/lose.