14 ms·

> it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time As much as I agree with your dislike of captcha

by slx26 6y ago

> it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time As much as I agree with your dislike of captchas, I don't think this is true at scale (unless universal online identities existed, which could and should include anonymous identifiers by design). When you need to accept information from anonymous users (comments, votes, forms, registrations), there's no way to not invade users privacy and not waste their time, unless you are manually filtering / moderating all the input data, in which case you can't really say it scales. You might say emails can solve the problem. Well, they don't really solve the problem against dedicated attackers / spammers, and they do invade privacy for the average user. You can use statistical approaches to try to reduce privacy invasion or others, but I don't know of anything that really solves the problem without manual identity verification at some point.

BMSmnqXAE4yfe1 6y ago
One such solution would be a small payment, something like 1 cent for access. That's not too much, because I am already paying 3 cents to a service solving captchas for me.
- gopty 6y ago
  Please, what is the service? I want to pay someone to solve Captchas for me.
  - banana_giraffe 6y ago
    https://anti-captcha.com/ https://anti-captcha.com/ is one such service. There are others, but this one that has browser plugins for visually impaired people in addition to APIs. I've used the service in the past, though it's far enough in the past all I can say is it worked once upon a time, no clue if it's still reliable.
    - hedora 6y ago
      Interestingly, it takes them under 20 seconds to solve a recaptcha and 70 for hCaptcha. I wonder if they’ve partially automated recaptcha, or if hCaptcha is just a bigger pain in the neck. (I usually can’t solve a reCaptcha in 15 seconds...)
    - chromanoid 6y ago
      WTF Did you see the super man like guy shooting at the sweatshop workers? This looks pretty bad... https://imgur.com/a/CvYyBQH https://imgur.com/a/CvYyBQH
      - seirim 6y ago
        Holy crap that's terrible and offensive.
        octoberfranklin 6y ago
        Websites spamming me with captchas is terrible and offensive. "Because scaling. It is our God-given right."
        anoncake 6y ago
        It is possible to solve captchas without glorifying violence against workers.
    - hatch_q 6y ago
      I use Buster browser extension with free IBM Watson speech to text node, free limitation is 500minutes of speech per month, which is plenty for solving captchas. The crux of all this privacy (blocked 3rd party cookies) is that i need to solve 3 ReCaptchas every time.
- t0astbread 6y ago
  Maybe but how would you transfer 1 cent in a way that's fast enough not to impair UX and cheap (where the transfer doesn't cost more than the validation fee)? Additionally (as with all online payments) there are privacy concerns.
protoduction 6y ago
I built an alternative[0] that takes a proof of work approach. As a site owner you set the difficulty that makes sense for you: so perhaps you would want 20 seconds of computation before you can submit. The nice thing is that this can happen entirely in the background while the user fills in the form. Also with multiple requests from the same IP in a short timespan, the difficulty increases. There are downsides to to any captcha, but in my opinion make a much better tradeoff. Accessibility and privacy are respected, and there are no annoying tasks. [0]: https://friendlycaptcha.com https://friendlycaptcha.com
- lowlevellimbo 6y ago
  > FriendlyCaptcha will prevent 99.9% of spam For someone who has little expertise in this specific field, how are you calculating this?
  - protoduction 6y ago
    Admittedly it's not calculated so it may be a stretch, it's based on the assumption that the vast majority of spam out there just looks for forms to submit without smarts (which is also why honeypots can be pretty effective, especially if you have a small website that nobody will take the effort to work around it.) I've seen people report that they have reduced spam to near nothing already with just a honeypot, but of course I can't verify those claims.
    - protoduction 6y ago
      Judging by the downvotes (despite answering the question truthfully), I see it's not a good way to present ourselves, and frankly we don't have to make that claim. It's hard to estimate the real percentage, our customers are happy but measuring what is no longer there is tricky in the real world. I will change the wording on the website and remove the percentage.
      - tehjoker 6y ago
        People take quantitative claims seriously. I wouldn't make them without being able to defend them in an intellectually rigorous way.
smittywerben 6y ago
CAPTCHA does not scale. CAPTCHA spams real people with requests and wastes my VALUABLE time, and still labels disabled people as subhuman. It's offensive. It's ineffective. It's outdated. It's reaching a point where encapsulating a VPN with anti-captcha is something I'd pay for.
- lovegoblin 6y ago
  > CAPTCHA is the worst option, except for all the others that have been tried.
  - zingplex 6y ago
    I would happily pay 15¢ or so per site to bypass captchas if it were done in a way that would preserve my privacy. Has something like this ever been offered?
- deleted 6y ago
  [deleted]
3np 6y ago
> unless universal online identities existed, which could and should include anonymous identifiers by design Yes but no. Anonymized identifiers can be deanonymized. They should utilize zero-knowledge proofs in such a way that they can prove "yes, I have an identity verified by entity X (and Y and Z) (based on passport/phone number/...)", without disclosing any of those details. It could, optionally, yield an identifier unique to each requester and unlinkable to others unless an explicit proof of the link is provided. Though if this is included, there has to be some mechanism to avoid huge ad networks sharing the same "requester entity". This is a solved problem. All that's left is politics, implementation and alignment.
- dorgo 6y ago
  >"yes, I have an identity verified by entity X (and Y and Z) (based on passport/phone number/...)", without disclosing any of those details. Actually, I would prefer: "Yey, this one-use temporary ID is tied to an identity which is known to behave on public websites." Or "... is tied to an identity which is known to be knowledgeable on topic X". Or whatever information is needed at the time. Next time a new ID will be generated and the identity provider will vouch for it. No passport or phone number should be required. Edit: fixed spelling.
- slx26 6y ago
  Maybe "anonymous identifiers" has some very technical and exact meaning that I didn't know, but when I said "anonymous identifiers" I did it very abstractly, no need to assume a specific underlying implementation from those two words. I have actually discussed the concept in the past [0], and I exchanged some emails with the guy in that thread to talk more about technical details. We all seem to agree that design and political will are the problems, not technology. What I was basically saying in the comments, in general terms, is that you might have one primary identifier, and then somehow you can get more identifiers that are tied to your main one, but that might have different expiration periods, might grant access to different levels of information about you, and might be limited to a certain number for each service you use. Of course, there are quite a few ways to implement such a system. And that's precisely why I'm more focused on the design, usability and characteristics than the underlying technical implementation; I think the best we can do if we ever want to see this happen is to spread the idea in terms that anyone can understand [1]. I mean, I'm interested in the technical details too, so I'm just complementing and contextualizing a bit here. [0] https://news.ycombinator.com/item?id=22180120 https://news.ycombinator.com/item?id=22180120 [1] ...or discuss more the idea among those that are interested and setup a demo website to make it easier to spread the word, even if there's no actual implementation behind it and it's just a mock-up. I'm quite busy at the moment, but I'll definitely do something along those lines when I have some time.

by slx26 6y ago

BMSmnqXAE4yfe1 6y ago

One such solution would be a small payment, something like 1 cent for access. That's not too much, because I am already paying 3 cents to a service solving captchas for me.

gopty 6y ago
Please, what is the service? I want to pay someone to solve Captchas for me.
- banana_giraffe 6y ago
  https://anti-captcha.com/ https://anti-captcha.com/ is one such service. There are others, but this one that has browser plugins for visually impaired people in addition to APIs. I've used the service in the past, though it's far enough in the past all I can say is it worked once upon a time, no clue if it's still reliable.
  - hedora 6y ago
    Interestingly, it takes them under 20 seconds to solve a recaptcha and 70 for hCaptcha. I wonder if they’ve partially automated recaptcha, or if hCaptcha is just a bigger pain in the neck. (I usually can’t solve a reCaptcha in 15 seconds...)
  - chromanoid 6y ago
    WTF Did you see the super man like guy shooting at the sweatshop workers? This looks pretty bad... https://imgur.com/a/CvYyBQH https://imgur.com/a/CvYyBQH
    - seirim 6y ago
      Holy crap that's terrible and offensive.
      - octoberfranklin 6y ago
        Websites spamming me with captchas is terrible and offensive. "Because scaling. It is our God-given right."
        anoncake 6y ago
        It is possible to solve captchas without glorifying violence against workers.
  - hatch_q 6y ago
    I use Buster browser extension with free IBM Watson speech to text node, free limitation is 500minutes of speech per month, which is plenty for solving captchas. The crux of all this privacy (blocked 3rd party cookies) is that i need to solve 3 ReCaptchas every time.
t0astbread 6y ago
Maybe but how would you transfer 1 cent in a way that's fast enough not to impair UX and cheap (where the transfer doesn't cost more than the validation fee)? Additionally (as with all online payments) there are privacy concerns.

protoduction 6y ago

I built an alternative[0] that takes a proof of work approach. As a site owner you set the difficulty that makes sense for you: so perhaps you would want 20 seconds of computation before you can submit. The nice thing is that this can happen entirely in the background while the user fills in the form. Also with multiple requests from the same IP in a short timespan, the difficulty increases. There are downsides to to any captcha, but in my opinion make a much better tradeoff. Accessibility and privacy are respected, and there are no annoying tasks. [0]: https://friendlycaptcha.com https://friendlycaptcha.com

lowlevellimbo 6y ago
> FriendlyCaptcha will prevent 99.9% of spam For someone who has little expertise in this specific field, how are you calculating this?
- protoduction 6y ago
  Admittedly it's not calculated so it may be a stretch, it's based on the assumption that the vast majority of spam out there just looks for forms to submit without smarts (which is also why honeypots can be pretty effective, especially if you have a small website that nobody will take the effort to work around it.) I've seen people report that they have reduced spam to near nothing already with just a honeypot, but of course I can't verify those claims.
  - protoduction 6y ago
    Judging by the downvotes (despite answering the question truthfully), I see it's not a good way to present ourselves, and frankly we don't have to make that claim. It's hard to estimate the real percentage, our customers are happy but measuring what is no longer there is tricky in the real world. I will change the wording on the website and remove the percentage.
    - tehjoker 6y ago
      People take quantitative claims seriously. I wouldn't make them without being able to defend them in an intellectually rigorous way.

smittywerben 6y ago

CAPTCHA does not scale. CAPTCHA spams real people with requests and wastes my VALUABLE time, and still labels disabled people as subhuman. It's offensive. It's ineffective. It's outdated. It's reaching a point where encapsulating a VPN with anti-captcha is something I'd pay for.

lovegoblin 6y ago
> CAPTCHA is the worst option, except for all the others that have been tried.
- zingplex 6y ago
  I would happily pay 15¢ or so per site to bypass captchas if it were done in a way that would preserve my privacy. Has something like this ever been offered?
deleted 6y ago
[deleted]

3np 6y ago

> unless universal online identities existed, which could and should include anonymous identifiers by design Yes but no. Anonymized identifiers can be deanonymized. They should utilize zero-knowledge proofs in such a way that they can prove "yes, I have an identity verified by entity X (and Y and Z) (based on passport/phone number/...)", without disclosing any of those details. It could, optionally, yield an identifier unique to each requester and unlinkable to others unless an explicit proof of the link is provided. Though if this is included, there has to be some mechanism to avoid huge ad networks sharing the same "requester entity". This is a solved problem. All that's left is politics, implementation and alignment.

dorgo 6y ago
>"yes, I have an identity verified by entity X (and Y and Z) (based on passport/phone number/...)", without disclosing any of those details. Actually, I would prefer: "Yey, this one-use temporary ID is tied to an identity which is known to behave on public websites." Or "... is tied to an identity which is known to be knowledgeable on topic X". Or whatever information is needed at the time. Next time a new ID will be generated and the identity provider will vouch for it. No passport or phone number should be required. Edit: fixed spelling.
slx26 6y ago
Maybe "anonymous identifiers" has some very technical and exact meaning that I didn't know, but when I said "anonymous identifiers" I did it very abstractly, no need to assume a specific underlying implementation from those two words. I have actually discussed the concept in the past [0], and I exchanged some emails with the guy in that thread to talk more about technical details. We all seem to agree that design and political will are the problems, not technology. What I was basically saying in the comments, in general terms, is that you might have one primary identifier, and then somehow you can get more identifiers that are tied to your main one, but that might have different expiration periods, might grant access to different levels of information about you, and might be limited to a certain number for each service you use. Of course, there are quite a few ways to implement such a system. And that's precisely why I'm more focused on the design, usability and characteristics than the underlying technical implementation; I think the best we can do if we ever want to see this happen is to spread the idea in terms that anyone can understand [1]. I mean, I'm interested in the technical details too, so I'm just complementing and contextualizing a bit here. [0] https://news.ycombinator.com/item?id=22180120 https://news.ycombinator.com/item?id=22180120 [1] ...or discuss more the idea among those that are interested and setup a demo website to make it easier to spread the word, even if there's no actual implementation behind it and it's just a mock-up. I'm quite busy at the moment, but I'll definitely do something along those lines when I have some time.