4 ms·

Are you kidding? Your compensation is all the free apps you get (Gmail, Maps, etc.) You’ll rarely see a Captcha for a paid product once they have your cc info.

by human 8y ago

jammygit 8y ago
I get most of my captchas while attempting to access products I've paid for already (very few at purchase time).
- udfalkso 8y ago
  Imagine if those sites had to build their own captcha service instead. How much more expensive would they be?
  - gcb0 8y ago
    wonder if someone is collecting actual data instead of listening to udfalkso, the google sales rep here. maybe to save them a few $ from bots and spam (bandwidth and storage is very cheap today) they might be losing new users by the thousands (and traffic acquisition is far more expensive than the formers)
  - JohnFen 8y ago
    Or they could just use one of the many free CAPTCHA applications that are around.
    - hombre_fatal 8y ago
      Off the shelf spam software like Xrumer[0] has been cracking those captchas for 10+ years. Recaptcha isn't obnoxious for fun, it's obnoxious because this is the state of the arms race right now. There's also the challenge of creating a captcha that allows blind people in. [0]: https://en.wikipedia.org/wiki/XRumer https://en.wikipedia.org/wiki/XRumer
  - foxylad 8y ago
    It's actually not that hard, assuming you control your form generation. Bots usually fill in fields using the actual field name - not the label the user sees. So provide a field labelled "Age" but named "email", and simply check it contains digits. If it's got an email address in it, it's a bot. Labels can also be obfuscated with javascript, replacing the raw HTML "Email" with "Age"on page load. Getting this right will require the bot to parse both HTML and JS, and we can force them to handle CSS too. Add a "zip" field, and hide it with complex CSS rules. If it contains a zip code, it's a bot. If you're really paranoid, randomise combinations of distinguishable fields (name, email, phone, age and hidden fields) every time you generate the form, so even if a bot herder manually maps names to fields one time, it'll fail the next. At this stage it'll be cheaper for the bot herder to use Mechanical Turk, after which even Google's captcha is compromised.
    - jtolmar 8y ago
      This is very hostile to people who use screen readers.
      - darkpuma 8y ago
        I've found that the tech industry often is. Trying to get managers to set aside time to iron out accessibility issues is like pulling teeth. Trying to get other developers to take it seriously is almost as bad. Often you count yourself lucky if the bare legal minimum is implemented. Accessibility is very important, and if accessibility features are implemented well they'll often be useful even to people without disabilities, but do any CS/SE or code bootcamp programs take the topic seriously? I'm sure it must be taught somewhere, but it doesn't seem to be common at all. Can you even imagine 21st century university architecture department that didn't cover ADA compliance? That'd be unthinkable.
        cesarb 8y ago
        > Can you even imagine 21st century university architecture department that didn't cover ADA compliance? That'd be unthinkable. I can easily imagine it: architecture departments from universities in other countries don't necessarily have to cover compliance with USA laws.
- ummonk 8y ago
  Yeah, that is what annoys me. “Thanks for paying us to use our product. Now do free work for us for the privilege of using the product you already paid for!”
JohnFen 8y ago
But I don't use those services, so that can't be my compensation.
- hombre_fatal 8y ago
  Your compensation is access to the website that uses Recaptcha and the fewer abuse/bots that you deal with on that platform. For example, since you're here and HN uses Recaptcha on its register/login form, it seems like the compensation was adequate.
  - JohnFen 8y ago
    > Your compensation is access to the website that uses Recaptcha Which is one of the reasons why the presence of reCAPTCHA is strong push to avoid that site. > since you're here and HN uses Recaptcha on its register/login form, it seems like the compensation was adequate. Perhaps so. I don't remember doing a CAPTCHA to sign up, but I don't dispute that I did it. However, I've never been presented with one after signup. If I was, I wouldn't be here.

Are you kidding? Your compensation is all the free apps you get (Gmail, Maps, etc.) You’ll rarely see a Captcha for a paid product once they have your cc info.

by human 8y ago

Are you kidding? Your compensation is all the free apps you get (Gmail, Maps, etc.) You’ll rarely see a Captcha for a paid product once they have your cc info.

jammygit 8y ago

I get most of my captchas while attempting to access products I've paid for already (very few at purchase time).

udfalkso 8y ago
Imagine if those sites had to build their own captcha service instead. How much more expensive would they be?
- gcb0 8y ago
  wonder if someone is collecting actual data instead of listening to udfalkso, the google sales rep here. maybe to save them a few $ from bots and spam (bandwidth and storage is very cheap today) they might be losing new users by the thousands (and traffic acquisition is far more expensive than the formers)
- JohnFen 8y ago
  Or they could just use one of the many free CAPTCHA applications that are around.
  - hombre_fatal 8y ago
    Off the shelf spam software like Xrumer[0] has been cracking those captchas for 10+ years. Recaptcha isn't obnoxious for fun, it's obnoxious because this is the state of the arms race right now. There's also the challenge of creating a captcha that allows blind people in. [0]: https://en.wikipedia.org/wiki/XRumer https://en.wikipedia.org/wiki/XRumer
- foxylad 8y ago
  It's actually not that hard, assuming you control your form generation. Bots usually fill in fields using the actual field name - not the label the user sees. So provide a field labelled "Age" but named "email", and simply check it contains digits. If it's got an email address in it, it's a bot. Labels can also be obfuscated with javascript, replacing the raw HTML "Email" with "Age"on page load. Getting this right will require the bot to parse both HTML and JS, and we can force them to handle CSS too. Add a "zip" field, and hide it with complex CSS rules. If it contains a zip code, it's a bot. If you're really paranoid, randomise combinations of distinguishable fields (name, email, phone, age and hidden fields) every time you generate the form, so even if a bot herder manually maps names to fields one time, it'll fail the next. At this stage it'll be cheaper for the bot herder to use Mechanical Turk, after which even Google's captcha is compromised.
  - jtolmar 8y ago
    This is very hostile to people who use screen readers.
    - darkpuma 8y ago
      I've found that the tech industry often is. Trying to get managers to set aside time to iron out accessibility issues is like pulling teeth. Trying to get other developers to take it seriously is almost as bad. Often you count yourself lucky if the bare legal minimum is implemented. Accessibility is very important, and if accessibility features are implemented well they'll often be useful even to people without disabilities, but do any CS/SE or code bootcamp programs take the topic seriously? I'm sure it must be taught somewhere, but it doesn't seem to be common at all. Can you even imagine 21st century university architecture department that didn't cover ADA compliance? That'd be unthinkable.
      - cesarb 8y ago
        > Can you even imagine 21st century university architecture department that didn't cover ADA compliance? That'd be unthinkable. I can easily imagine it: architecture departments from universities in other countries don't necessarily have to cover compliance with USA laws.
ummonk 8y ago
Yeah, that is what annoys me. “Thanks for paying us to use our product. Now do free work for us for the privilege of using the product you already paid for!”

JohnFen 8y ago

But I don't use those services, so that can't be my compensation.

hombre_fatal 8y ago
Your compensation is access to the website that uses Recaptcha and the fewer abuse/bots that you deal with on that platform. For example, since you're here and HN uses Recaptcha on its register/login form, it seems like the compensation was adequate.
- JohnFen 8y ago
  > Your compensation is access to the website that uses Recaptcha Which is one of the reasons why the presence of reCAPTCHA is strong push to avoid that site. > since you're here and HN uses Recaptcha on its register/login form, it seems like the compensation was adequate. Perhaps so. I don't remember doing a CAPTCHA to sign up, but I don't dispute that I did it. However, I've never been presented with one after signup. If I was, I wouldn't be here.