3 ms·
None of the barriers are fool-proof, but they are layers of defense. When adding defensive layers, you need a cost comparison of how much time and money it cost
by throwaway892238 3y ago
None of the barriers are fool-proof, but they are layers of defense. When adding defensive layers, you need a cost comparison of how much time and money it costs you, versus how much time and money it costs the attacker. If it costs you $0 recurring and 5 developer days, and it costs the attacker 1 human solving 1 captcha per 1 form submission, then it's probably worth doing it, if only to stop randomly-scanning botnets and reduce the signal-to-noise on your detection capabilities. (I know AI is getting better at automated solving, dunno if they're all broken yet)
- reaperman 3y ago> you need a cost comparison of how much time and money it costs you, versus how much time and money it costs the attacker. Not quite! It's actually "how much money your countermeasures costs the attacker to beat, versus how much money it gains the attacker to beat your countermeasures". The attacker doesn't care if you spent $1 or $1 billion on it, they only care what it costs them vs. gains them. If it gains a lot, there are usually ways to fund the effort, no matter how large. There's usually an enormous mismatch between your budget and the attackers' budgets (in either direction), as well as a massive adjustment for purchasing-power-parity. This isn't a "near-peer" fight where you're trying to "outspend" the attackers using efficient techniques to exhaust their budget before your budget is exhausted. This is a situation where there are nomadic bandits, regional pirates, FAANGs, and entire governments where you want to just make it so they look at your system and go "nah skip that. we'll do this another way entirely by getting access to a different company's system instead".