4 ms·
IMHO CPATCHA is a lazy way to protect your service as you shift the burden to your users. Maybe if you are big and essential for some users, you can afford tha
by noncoml 7y ago
IMHO CPATCHA is a lazy way to protect your service as you shift the burden to your users.
Maybe if you are big and essential for some users, you can afford that. But if not, be aware that users will turn their back on you if you add obstacles between them and your service.
Edit: meant to say “be aware that some users will turn their back to you”
- onion2k 7y agoBut if not be aware that users will turn their back on you if you add obstacles between them and your service. You have to balance that against how many users you'd lose if the site was down/vandalized/compromised by an attacker if the captcha protection wasn't there to keep it out. It's often worthwhile moving the captcha away from the initial login or signup form and only putting it on the second or third attempt to login, or on features that put significant load on the server.
- hombre_fatal 7y ago> It's often worthwhile moving the captcha away from the initial login or signup form and only putting it on the second or third attempt to login Though if your service is a lucrative target for {uname,pass} combolist spam, you'll see that each attempt comes from its own IP address and only makes that one request. It's pretty sobering.
- gurrone 7y agoYes it's trade off as usual. The main benefit I see is on networks where you've a mix of good and bad traffic and you would still like to offer the service to the few good users. I see this a lot on networks hosting a lot of free VPN providers. The other option we choose before was outright blocking. That is even more harmful for the few good users.
- eythian 7y agoI run a small forum, and it was getting flooded with fake and spam accounts, the moderators were struggling to keep up and the users were finding it annoying. So I put a captcha on the registration page. The problem went to zero, new users still showed up, and more people were happier than before.
- cdubzzz 7y ago> IMHO CPATCHA is a lazy way to protect your service as you shift the burden to your users. What is the non-lazy solution to having a basic website contact form that _doesn't_ receive hundreds of spam submission per day?
- noncoml 7y ago"receive hundreds of spam submission per day" But this is exactly the point I am trying to make. That's the service provider's problem and not the user's. CAPTCHA shifts the problem to the user. CAPTCHA is a 00's idea, when we had the multiple page registrations(with errors showing only after you submit the page), the insane password requirements, etc.. It doesn't belong to modern stack in my opinion. "What is the non-lazy solution?" That's how disruption is born.
- cdubzzz 7y ago> "What is the non-lazy solution?" That's how disruption is born. So there is no non-lazy solution. I get your point about shifting the problem, but that's kind of the only option for the vast majority of website operators (particularly small ones). I have zero love for CAPTCHA myself, I have put time and effort in to other, server-side solutions but none perform even remotely as well.
- hombre_fatal 7y agoThe vast majority of users never see a recaptcha puzzle when you're using v2's invisible recaptcha.
- SquareWheel 7y agoAnd 0% of users see it if you're using reCaptcha v3.
- xur17 7y agoIt never presents challenges to users, but instead just buckets them into bot or not bot?