4 ms·
I really hate all these captcha codes Why can’t they do something like a reverse SSL where we have to authenticate ourselves as humans? For example if I have
by abhinav22 6y ago
I really hate all these captcha codes
Why can’t they do something like a reverse SSL where we have to authenticate ourselves as humans?
For example if I have an Apple account on my Apple devices, why can’t they figure out a way to authenticate me as a human from that information?
This doesn’t work for all scenarios (eg throwaway accounts), but it could work for the majority?
- mathnmusic 6y agoWebauthn may make it easy because it supports platform authenticators like Touch ID / Face ID. Two good demos are at http://webauthn.me/ http://webauthn.me/ and https://webauthn.io/ https://webauthn.io/ It's now supported in all major browsers but platform authenticators are likely not supported on all OS yet.
- abhinav22 6y agoThis makes a lot of sense - exactly what I was thinking
- mathnmusic 6y agoI'm not sure it will be as secure as captchas though. Browsers will probably allow dummy platform authenticators for ease of development, which can be used by bots as well.
- hombre_fatal 6y agoWell, the point is to avoid automated abuse. Your Apple account on your Apple device doesn't stop you from unwittingly being part of a botnet, for example.
- abhinav22 6y agoWhy wouldn’t it? Unless they hack my account Genuine question - I don’t know much about this field
- mindslight 6y agoForget adding more draconian identity requirements. 95% of CAPTCHA use is simply unnecessary and could be straightforwardly removed or replaced with rate limiting login attempts per IP. Never mind sites that use it to prevent scraping. If serving static pages is that much of a burden that you want to discourage automated means of retrieving information that you're trying to publish, then work on your website performance instead of adding more user-hostile roadblocks.
- abhinav22 6y agoThat’s exactly what I’m thinking too! Lot of it is to prevent scraping and a lot of it is unnecessary
- hombre_fatal 6y ago> could be straightforwardly removed or replaced with rate limiting login attempts per IP This is very outdated intuition. Fresh IP addresses cost peanuts. For example, your solution still allows an attacker to run a 50k item /login combolist against one of your users with $5 of botnet time, each IP address trying a single uname/pass combo. Here you pay $18/GB to multiplex your abuse (cred stuffing being classic non-volumetric abuse example) across 72 million residential IP addresses. https://luminati.io/ https://luminati.io/
- mindslight 6y ago50k attempts is tiny, like a 3 character password or a single account run through /usr/share/dict/words. If you're worried about password with between other sites that have leaked, then the real answer is to generate something like a username for each user that they won't be able to share between sites. In fact with the prevalence of password managers, generating users' passwords for them might just be the better approach these days. And just fall back to email auth every time if they don't want to store it. Duct taping your broken system by throwing up an annoyance for every user who doesn't want to be tracked is not the way.
- GekkePrutser 6y agoI would start with blocking those 72 million addresses for starters :)
- t0astbread 6y agoMaybe there's a good solution somewhere there but the problem - as far as I can see - with this is that you either have a central party that knows who signed up for what or you have every account tied to a permanent super-identity. Both of which aren't great.