7 ms·

I’m quite proud of GOV.UK for banning CAPTCHAs from government services completely.[1] Have you ever tried to use the ‘accessible’ fallback for ReCAPTCHA? It’s

I’m quite proud of GOV.UK for banning CAPTCHAs from government services completely.[1] Have you ever tried to use the ‘accessible’ fallback for ReCAPTCHA? It’s literally impossible (my team had 0% passes trying it over and over again) so by implementing ReCAPTCHA you’re completely blocking an entire set of already disadvantaged users. At the same time, even a normal CAPTCHA is already harder for some users to solve than it is for some bots and you’re lining Google’s pockets by training their ML algorithms. While this new version potentially helps things, it feels like the users with more automated interaction methods or those who want to reduce fingerprinting efforts will still fall foul of over-zealous site owners. At the end of the day, all a CAPTCHA is is a method to externalise business costs onto your users. [1] https://www.gov.uk/service-manual/technology/using-captchas https://www.gov.uk/service-manual/technology/using-captchas

avip 8y ago
I'd suggest CAPTCHA nay-sayers to come up with alternatives. The implied alternative is, by default, constant abuse, phishery, scrapping, automated login attempts, and DDoS. Which sometimes may be fine, and many times is just not acceptable.
- chickenfries 8y ago
  If a CAPTCHA is the only thing keeping your site secure from abuse then I think you have larger problems.
  - wild_preference 8y ago
    It probably eliminates 90% of it for 90% of websites, like off-the-shelf spamware hitting your blog's comments. The prevention measure you create for the remaining 10% (like a moderation queue + human review if you can afford it) is likely to only work because its workload is diminished 90% by a crude measure like ReCaptcha. Your dismissal doesn't illuminate anything. It turns out that abuse prevention is hard and costly.
    - avip 8y ago
      > It turns out that abuse prevention is hard and costly This should come as Tshirt or coffee mug.
  - spookthesunset 8y ago
    > If a CAPTCHA is the only thing keeping your site secure from abuse then I think you have larger problems. This is one of those pithy remarks that add zero value to a discussion. I'm curious how you would approach blocking automated access to various parts of your site?
    - chickenfries 8y ago
      Well usually ReCAPCHA is usually used on sign in pages. You can rate limit login attempts, exponentially increasing rate limit (or just locking out) IPs that exceed allowed login attempts and analyze your logs to ban abusive IPs. Yeah, that's harder than ReCAPTCHA, but I think a lot of these big companies can afford to do these pretty basic steps. If you just want to throw some comments on your free blog and not have to moderate the comments (and honestly, how many comments does your blog get that you can't read them?) then sure, throw ReCAPTCHA on there. But there are plenty of big companies that use ReCAPTCHA.
      - spookthesunset 8y ago
        > You can rate limit login attempts, exponentially increasing rate limit (or just locking out) IPs that exceed allowed login attempts and analyze your logs to ban abusive IPs. Rate limiting and bot blocking are two totally different things. Rate limiting only increases the cost of a bot attack. Either they need more IP's (which are dirt cheap in the black market) or they need more time--either way it is increased cost. But it won't stop a bot. Just slow it. Banning IP's might have worked back in 2000, but these days it is useless. Bypassing an IP block is trivially easy for even a low-sophistication attacker.
        tinus_hn 8y ago
        > Bypassing an IP block is trivially easy for even a low-sophistication attacker. Not easy for an average user though.
        saati 8y ago
- blub 8y ago
  Two-factor authentication, obviously, even e-mail based.
  - avip 8y ago
    You've just lost 95% of your users.
    - prolikewh0a 8y ago
      Taking 10 minutes to solve one reCaptcha is also a good way to lose users. There are plenty of websites I refuse to use now because they have outrageous reCaptchas.
      - h2onock 8y ago
        Same here, I HATE CAPTCHA's.
      - avip 8y ago
        2FA requires you to be a registered user. That's a whole new level of user friction.
wild_preference 8y ago
Cool, that solution works for one of the hegemonic governments of the world. Now what about about literally every other entity in the world that has a website? The vast majority of which not being a business? Nor serving life-critical documentation to all of the country's disabled?

avip 8y ago

I'd suggest CAPTCHA nay-sayers to come up with alternatives. The implied alternative is, by default, constant abuse, phishery, scrapping, automated login attempts, and DDoS. Which sometimes may be fine, and many times is just not acceptable.

chickenfries 8y ago
If a CAPTCHA is the only thing keeping your site secure from abuse then I think you have larger problems.
- wild_preference 8y ago
  It probably eliminates 90% of it for 90% of websites, like off-the-shelf spamware hitting your blog's comments. The prevention measure you create for the remaining 10% (like a moderation queue + human review if you can afford it) is likely to only work because its workload is diminished 90% by a crude measure like ReCaptcha. Your dismissal doesn't illuminate anything. It turns out that abuse prevention is hard and costly.
  - avip 8y ago
    > It turns out that abuse prevention is hard and costly This should come as Tshirt or coffee mug.
- spookthesunset 8y ago
  > If a CAPTCHA is the only thing keeping your site secure from abuse then I think you have larger problems. This is one of those pithy remarks that add zero value to a discussion. I'm curious how you would approach blocking automated access to various parts of your site?
  - chickenfries 8y ago
    Well usually ReCAPCHA is usually used on sign in pages. You can rate limit login attempts, exponentially increasing rate limit (or just locking out) IPs that exceed allowed login attempts and analyze your logs to ban abusive IPs. Yeah, that's harder than ReCAPTCHA, but I think a lot of these big companies can afford to do these pretty basic steps. If you just want to throw some comments on your free blog and not have to moderate the comments (and honestly, how many comments does your blog get that you can't read them?) then sure, throw ReCAPTCHA on there. But there are plenty of big companies that use ReCAPTCHA.
    - spookthesunset 8y ago
      > You can rate limit login attempts, exponentially increasing rate limit (or just locking out) IPs that exceed allowed login attempts and analyze your logs to ban abusive IPs. Rate limiting and bot blocking are two totally different things. Rate limiting only increases the cost of a bot attack. Either they need more IP's (which are dirt cheap in the black market) or they need more time--either way it is increased cost. But it won't stop a bot. Just slow it. Banning IP's might have worked back in 2000, but these days it is useless. Bypassing an IP block is trivially easy for even a low-sophistication attacker.
      - tinus_hn 8y ago
        > Bypassing an IP block is trivially easy for even a low-sophistication attacker. Not easy for an average user though.
        saati 8y ago
blub 8y ago
Two-factor authentication, obviously, even e-mail based.
- avip 8y ago
  You've just lost 95% of your users.
  - prolikewh0a 8y ago
    Taking 10 minutes to solve one reCaptcha is also a good way to lose users. There are plenty of websites I refuse to use now because they have outrageous reCaptchas.
    - h2onock 8y ago
      Same here, I HATE CAPTCHA's.
    - avip 8y ago
      2FA requires you to be a registered user. That's a whole new level of user friction.

wild_preference 8y ago

Cool, that solution works for one of the hegemonic governments of the world. Now what about about literally every other entity in the world that has a website? The vast majority of which not being a business? Nor serving life-critical documentation to all of the country's disabled?