3 ms·

I see there's several "captcha solving services" (Google the term, I don't want to link any) that charge in the $1's per 1000 solves. This makes me wonder how e

I see there's several "captcha solving services" (Google the term, I don't want to link any) that charge in the $1's per 1000 solves. This makes me wonder how effective captchas really are. Do they just raise the bar high enough so only spammers actually making money attack the more lucrative sites? Can anyone talk about their experience running a (large) service with a spam problem where adding a captcha helped? How about still battling bots/spam/abuse despite having a captcha? Supposedly these services have humans solving these. I remember hearing about a bypass in use where the attacker would pass-through captchas and present them to users on their own pirate/torrent/porn/etc sites, and then when the user solved it, they'd get at the content and the spammer would do whatever they were doing on the original site. I wonder if that technique is still in use, or if there are people specifically sitting there solving captchas all day being paid fractional pennies per solve?

wraptile 6y ago
Captchas are not effective at preventing attacks at all. There are many human and AI powered services as well as secret exploits that attackers can use. Captchas only stop spam, amateur scripts and web-scrapers. It's a real shame that because of this "safety feature" the web is losing is programability. You can't even curl many pages these days let alone write some programs that connect to the web. This whole bloated scene of browser emulation had to be spawned and now instead of serving 1kb htmls to few friendly bots several megabytes of junk traffic and countless processing cycles are wasted on some menial tasks like retrieving sport match results from the internet. The problem with these captcha services are _free_ which means people just throw them anywhere. Imagine a world where land mines are free for everyone at the tip of their fingers - you could hardly go outside! Well you can hardly go online now.
drivebycomment 6y ago
A classic case where captcha is essential is ddos attacks. By sheer volume, they are not able to bypass captcha, as they can't solve captcha at million qps. Rate limiting doesn't work under ddos as ddos attack can overwhelm rate limiting itself and also there are still many proxies that simple ip base rate limiting will cause large collateral damage. Captcha is a very effective tool for ddos protection. For spam/abuse, captcha is mainly about raising the cost of attack, not about eliminating completely, while still minimizing the collateral damage. Captcha is never meant to be a protection against any targeted narrow scoped attacks anyway. If the attack is small enough that attackers can pay captcha solving service, it's not big enough to matter. Captcha is here to stay. It is fundamentally a technical mean to deal with the tragedy of commons, and thus won't disappear anytime soon.

wraptile 6y ago

Captchas are not effective at preventing attacks at all. There are many human and AI powered services as well as secret exploits that attackers can use. Captchas only stop spam, amateur scripts and web-scrapers. It's a real shame that because of this "safety feature" the web is losing is programability. You can't even curl many pages these days let alone write some programs that connect to the web. This whole bloated scene of browser emulation had to be spawned and now instead of serving 1kb htmls to few friendly bots several megabytes of junk traffic and countless processing cycles are wasted on some menial tasks like retrieving sport match results from the internet. The problem with these captcha services are _free_ which means people just throw them anywhere. Imagine a world where land mines are free for everyone at the tip of their fingers - you could hardly go outside! Well you can hardly go online now.

drivebycomment 6y ago

A classic case where captcha is essential is ddos attacks. By sheer volume, they are not able to bypass captcha, as they can't solve captcha at million qps. Rate limiting doesn't work under ddos as ddos attack can overwhelm rate limiting itself and also there are still many proxies that simple ip base rate limiting will cause large collateral damage. Captcha is a very effective tool for ddos protection. For spam/abuse, captcha is mainly about raising the cost of attack, not about eliminating completely, while still minimizing the collateral damage. Captcha is never meant to be a protection against any targeted narrow scoped attacks anyway. If the attack is small enough that attackers can pay captcha solving service, it's not big enough to matter. Captcha is here to stay. It is fundamentally a technical mean to deal with the tragedy of commons, and thus won't disappear anytime soon.