6 ms·

Serious question: who has a decent plan to create proof-of-human systems that are not only CAPTCHA based? We will soon need this, and I feel government will gl

by sph 3y ago

Serious question: who has a decent plan to create proof-of-human systems that are not only CAPTCHA based? We will soon need this, and I feel government will gladly present a solution: provide your ID when you connect to the Internet, and we will guarantee you are a human. Who's actually working on this and has released papers I can study? Because all this AI nonsense will only accelerate us towards this total control of the Internet because the spam and AI bots have made it worse for everyone.

RobotToaster 3y ago
I'm not really sure why anyone cares about bots. They've been part of the internet at least since search engines were invented. I guess spam is an issue currently, but if bots become advanced enough to avoid heuristics, by making insightful and useful comments, they are probably better than most human users. Proof of work captchas like mcaptcha can stop, or at least make very expensive, (d)dos attacks.
- acdha 3y ago
  Bots aren’t random, someone is running them for a reason. The problem isn’t the “insightful and useful comments”, it’ll be the ones which sound like that to any non-expert but are designed to sell products or push political outcomes. Historically the tell for things like that were things like copy-and-paste messages, poor grammar or spelling, etc. which LLMs are great at avoiding.
- polygamous_bat 3y ago
  > I'm not really sure why anyone cares about bots. They've been part of the internet at least since search engines were invented. It's all fun and games until foreign agencies are controlling who wins in your elections through misinformation and propaganda.
ribosometronome 3y ago
>provide your ID when you connect to the Internet, and we will guarantee you are a human. Or an AI using a human's ID?
- flangola7 3y ago
  Hard to do that if the ID is tied to a hardware token and rate limited in silicon. For extra strength require biometrics to activate the token.
troymc 3y ago
You might start here: https://scholar.google.com/scholar?hl=en&as_sdt=0%2C5&q=captcha&btnG= https://scholar.google.com/scholar?hl=en&as_sdt=0%2C5&q=capt...
- sph 3y ago
  I have explicitly asked if there is something that is not CAPTCHA. Because in the age of ever smarter AI do you really want to solve CAPTCHA more and more frequently, and not to show you're not a bot, but to prove you are human with a physical body borne from an ovum. It is not crazy to think we will eventually need to prove this fact somehow.
x-complexity 3y ago
> Serious question: who has a decent plan to create proof-of-human systems that are not only CAPTCHA based? > We will soon need this, and I feel government will gladly present a solution: provide your ID when you connect to the Internet, and we will guarantee you are a human.' I'm extremely hesitant to give any State the ability to track an individual user's online activity that intensely. It's been extensively documented that any State will fully utilize its size to violate an individual's personal privacy, with this often being done on a grand scale. > Who's actually working on this and has released papers I can study? Because all this AI nonsense will only accelerate us towards this total control of the Internet because the spam and AI bots have made it worse for everyone. The alternative is relatively straightforward: Utilize compute-intensive & memory-intensive tasks in CAPTCHAs. https://github.com/mCaptcha/mCaptcha https://github.com/mCaptcha/mCaptcha What would only take a few seconds for a single user would take hours for anyone seeking to establish a bot network spanning thousands of pseudo-users. With such tasks, it adds additional friction to the bots at minimal frustration to the user. these can be placed as periodic silent challenges when trying to watch an episode, taking up only a few seconds at the user's end where they wouldn't notice. https://news.ycombinator.com/item?id=32339902 https://news.ycombinator.com/item?id=32339902
- notatoad 3y ago
  this is the second plug i've seen today for mCaptcha. and i can see the utility, i've actually got a spot where it would be perfect and plan to implement it. but it's absolutely not a captcha: it is not a test to tell humans and computers apart. it's a test that can only be completed by a computer. its only utility is to be expensive. it's not a test to determine if there's a human behind the computer, it's only a test to determine if the computer has more resources than it currently needs, and can tolerate wasting some of them for a while.
- hedora 3y ago
  > What would only take a few seconds for a single user would take hours for anyone seeking to establish a bot network spanning thousands of pseudo-users. The claims on the mCaptcha site contradict this. They say it takes about 2 seconds worst case for a computer to do the work, which is hashing sha 256. Looking around, an unaccelerated celron is about 1/20th the speed of a single ryzen core, and gpus are much faster. Assuming the attacker has an 8 core ryzen with no gpu, they can hash 160 times faster than the person with an older machine. Assuming the 2 sec upper bound is correct, this means a sub $1000 desktop can create 80 accounts per second, or 4800 accounts per minute. If they are operating a botnet, then they presumably have access to more than one machine.
bakugo 3y ago
> We will soon need this, and I feel government will gladly present a solution: provide your ID when you connect to the Internet, and we will guarantee you are a human. Relevant: https://www.youtube.com/watch?v=-gGLvg0n-uY https://www.youtube.com/watch?v=-gGLvg0n-uY
TechBro8615 3y ago
I'm pretty sure this was (is?) the idea behind Sam Altman's creepy "World Coin" which IIRC basically involves stamping your retina on a federated blockchain with Microsoft controlling the supernodes.
- w-ll 3y ago
  Make an AI good enough to solve captchas, to make the world use your retina scanning blockchain. Ok its starting to make sense.
philistine 3y ago
The best attempt at solving the problem without providing government ID is Apple's system to get is of CAPTCHAs: https://techcrunch.com/2022/06/21/apple-is-introducing-new-tech-in-ios-16-to-let-you-skip-captchas/ https://techcrunch.com/2022/06/21/apple-is-introducing-new-t...
mplewis 3y ago
The only people who really can solve this problem are the government.
- philihp 3y ago
  Healthcare could also do it. Ultimately you need people to be incentivized to both have an UID in the system, and also not want more than one.
theaiquestion 3y ago
I'm not saying PGP or cryptocurrency because both of those have issues and the moment money is involved everything is foobar'd But essentially allowing people to make "identities" via cryptography and then use a reputation system. Preferably by allowing people to follow/whitelist/favorite people across websites. I like hacker new's method of making new people green. And I wish I could make it highlight the big names I recognize. The problem with this is that nobody has figured out the distribution system for how we communicate the keys - IMO blockchains are the closest but it's so difficult to mention them because 98% of them are money-grabs. PGP/GPG has struggled so hard pypi literally removed support for it. The second problem is that what will likely happen is sites like twitter will only allow very trusted accounts and never allow new ones - effectively locking you into one account.
- flagrant_taco 3y ago
  > IMO block gains are the closest but it's so difficult to mention them because 98% of them are money-grabs git is a really popular blockchain, though I guess GitHub seeking to Microsoft may further the money-grab argument
  - theaiquestion 3y ago
    Sorry I should clarify, I don't mean append-only graphs, I mean what people call "blockchain" in the cryptocurrency sense as actual projects - there's so much stigma largely because the motivation of most of the projects appears to be "making money/investing" and not actually solving a technical problem appropriately. If github was like this there would be a "fee" for making making commits, this fee would be paid in some proprietary coin, initially created with an ICO/airdrop. Suddenly the motivation is holding these coins because developers will need to make commits right? And the more developers that make commits the more the coin is worth, so surely you should buy and hold them right? This will be a feedback loop of endless money! Oh and it'll be a DAO so the more coins the more voting power you get too! ^ This is what I mean, where the focus is on collecting some "coin/token" - this leads to both a lack of focus on the actual problem being solved, and the problem of people associating it with a ponzi scheme. I'm not picking a fight with distributed graphs themselves, I don't like it when they're tightly coupled with "value" that can be traded as a fiat.
Zanni 3y ago
The IRS is already doing this. They used to have a password-based login system, but they're switching over to ID.me, which requires a scan of your ID and a matching selfie.
- doctor_radium 3y ago
  I believe the ID.me system went down in flames. Got snagged by this myself for 2021 but opted to call a number and speak to a person instead. Shortly afterwards I discovered an article suggesting my reaction wasn't unique.
  - almost_usual 3y ago
    The state of California uses ID.me now for EDD accounts.
  - zootboy 3y ago
    I wish it had, but unfortunately it seems like the IRS just waited out the storm and is now back at it. Their website implores you to "create an account with ID.me as soon as possible": https://sa.www4.irs.gov/secureaccess/ui/ https://sa.www4.irs.gov/secureaccess/ui/
dcow 3y ago
IDENA https://www.idena.io/ https://www.idena.io/
perryizgr8 3y ago
> who has a decent plan to create proof-of-human systems that are not only CAPTCHA based? Why do sites need human verification anyway? If the problem is load, then you just need proper rate-limiting in place. Captcha always seems to be mis-identifying the real issue.
- wizofaus 3y ago
  Ok, so how do you rate trigger on a particular bot such that it doesn't impact real users negatively? Further, bots that submit enough pseudo-random data have a decent chance of bypassing various security mechanisms, including for authorizing payments. Even at .0001% success rate given enough attempts they have a decent likelihood of eventually subverting existing security measures, and boosting those may be just as painful or inconvenient to users as CAPTCHA and similar mechanisms. The reality is bots don't have their own money to spend, humans do, and on its own that's enough reason to care. And what's next, bots being issued passports or mortgages etc.?
spaceman_2020 3y ago
A digital wallet tied to a real, authenticated identity should be a solution. You can sign any login and confirm that it is indeed you, a real person, logging in. Unfortunately crypto folks are too busy selling shitcoins and scams to build this product.

by sph 3y ago

RobotToaster 3y ago

I'm not really sure why anyone cares about bots. They've been part of the internet at least since search engines were invented. I guess spam is an issue currently, but if bots become advanced enough to avoid heuristics, by making insightful and useful comments, they are probably better than most human users. Proof of work captchas like mcaptcha can stop, or at least make very expensive, (d)dos attacks.

acdha 3y ago
Bots aren’t random, someone is running them for a reason. The problem isn’t the “insightful and useful comments”, it’ll be the ones which sound like that to any non-expert but are designed to sell products or push political outcomes. Historically the tell for things like that were things like copy-and-paste messages, poor grammar or spelling, etc. which LLMs are great at avoiding.
polygamous_bat 3y ago
> I'm not really sure why anyone cares about bots. They've been part of the internet at least since search engines were invented. It's all fun and games until foreign agencies are controlling who wins in your elections through misinformation and propaganda.

ribosometronome 3y ago

>provide your ID when you connect to the Internet, and we will guarantee you are a human. Or an AI using a human's ID?

flangola7 3y ago
Hard to do that if the ID is tied to a hardware token and rate limited in silicon. For extra strength require biometrics to activate the token.

troymc 3y ago

You might start here: https://scholar.google.com/scholar?hl=en&as_sdt=0%2C5&q=captcha&btnG= https://scholar.google.com/scholar?hl=en&as_sdt=0%2C5&q=capt...

sph 3y ago
I have explicitly asked if there is something that is not CAPTCHA. Because in the age of ever smarter AI do you really want to solve CAPTCHA more and more frequently, and not to show you're not a bot, but to prove you are human with a physical body borne from an ovum. It is not crazy to think we will eventually need to prove this fact somehow.

x-complexity 3y ago

> Serious question: who has a decent plan to create proof-of-human systems that are not only CAPTCHA based? > We will soon need this, and I feel government will gladly present a solution: provide your ID when you connect to the Internet, and we will guarantee you are a human.' I'm extremely hesitant to give any State the ability to track an individual user's online activity that intensely. It's been extensively documented that any State will fully utilize its size to violate an individual's personal privacy, with this often being done on a grand scale. > Who's actually working on this and has released papers I can study? Because all this AI nonsense will only accelerate us towards this total control of the Internet because the spam and AI bots have made it worse for everyone. The alternative is relatively straightforward: Utilize compute-intensive & memory-intensive tasks in CAPTCHAs. https://github.com/mCaptcha/mCaptcha https://github.com/mCaptcha/mCaptcha What would only take a few seconds for a single user would take hours for anyone seeking to establish a bot network spanning thousands of pseudo-users. With such tasks, it adds additional friction to the bots at minimal frustration to the user. these can be placed as periodic silent challenges when trying to watch an episode, taking up only a few seconds at the user's end where they wouldn't notice. https://news.ycombinator.com/item?id=32339902 https://news.ycombinator.com/item?id=32339902

notatoad 3y ago
this is the second plug i've seen today for mCaptcha. and i can see the utility, i've actually got a spot where it would be perfect and plan to implement it. but it's absolutely not a captcha: it is not a test to tell humans and computers apart. it's a test that can only be completed by a computer. its only utility is to be expensive. it's not a test to determine if there's a human behind the computer, it's only a test to determine if the computer has more resources than it currently needs, and can tolerate wasting some of them for a while.
hedora 3y ago
> What would only take a few seconds for a single user would take hours for anyone seeking to establish a bot network spanning thousands of pseudo-users. The claims on the mCaptcha site contradict this. They say it takes about 2 seconds worst case for a computer to do the work, which is hashing sha 256. Looking around, an unaccelerated celron is about 1/20th the speed of a single ryzen core, and gpus are much faster. Assuming the attacker has an 8 core ryzen with no gpu, they can hash 160 times faster than the person with an older machine. Assuming the 2 sec upper bound is correct, this means a sub $1000 desktop can create 80 accounts per second, or 4800 accounts per minute. If they are operating a botnet, then they presumably have access to more than one machine.

bakugo 3y ago

> We will soon need this, and I feel government will gladly present a solution: provide your ID when you connect to the Internet, and we will guarantee you are a human. Relevant: https://www.youtube.com/watch?v=-gGLvg0n-uY https://www.youtube.com/watch?v=-gGLvg0n-uY

TechBro8615 3y ago

I'm pretty sure this was (is?) the idea behind Sam Altman's creepy "World Coin" which IIRC basically involves stamping your retina on a federated blockchain with Microsoft controlling the supernodes.

w-ll 3y ago
Make an AI good enough to solve captchas, to make the world use your retina scanning blockchain. Ok its starting to make sense.

philistine 3y ago

The best attempt at solving the problem without providing government ID is Apple's system to get is of CAPTCHAs: https://techcrunch.com/2022/06/21/apple-is-introducing-new-tech-in-ios-16-to-let-you-skip-captchas/ https://techcrunch.com/2022/06/21/apple-is-introducing-new-t...

mplewis 3y ago

The only people who really can solve this problem are the government.

philihp 3y ago
Healthcare could also do it. Ultimately you need people to be incentivized to both have an UID in the system, and also not want more than one.

theaiquestion 3y ago

I'm not saying PGP or cryptocurrency because both of those have issues and the moment money is involved everything is foobar'd But essentially allowing people to make "identities" via cryptography and then use a reputation system. Preferably by allowing people to follow/whitelist/favorite people across websites. I like hacker new's method of making new people green. And I wish I could make it highlight the big names I recognize. The problem with this is that nobody has figured out the distribution system for how we communicate the keys - IMO blockchains are the closest but it's so difficult to mention them because 98% of them are money-grabs. PGP/GPG has struggled so hard pypi literally removed support for it. The second problem is that what will likely happen is sites like twitter will only allow very trusted accounts and never allow new ones - effectively locking you into one account.

flagrant_taco 3y ago
> IMO block gains are the closest but it's so difficult to mention them because 98% of them are money-grabs git is a really popular blockchain, though I guess GitHub seeking to Microsoft may further the money-grab argument
- theaiquestion 3y ago
  Sorry I should clarify, I don't mean append-only graphs, I mean what people call "blockchain" in the cryptocurrency sense as actual projects - there's so much stigma largely because the motivation of most of the projects appears to be "making money/investing" and not actually solving a technical problem appropriately. If github was like this there would be a "fee" for making making commits, this fee would be paid in some proprietary coin, initially created with an ICO/airdrop. Suddenly the motivation is holding these coins because developers will need to make commits right? And the more developers that make commits the more the coin is worth, so surely you should buy and hold them right? This will be a feedback loop of endless money! Oh and it'll be a DAO so the more coins the more voting power you get too! ^ This is what I mean, where the focus is on collecting some "coin/token" - this leads to both a lack of focus on the actual problem being solved, and the problem of people associating it with a ponzi scheme. I'm not picking a fight with distributed graphs themselves, I don't like it when they're tightly coupled with "value" that can be traded as a fiat.

Zanni 3y ago

The IRS is already doing this. They used to have a password-based login system, but they're switching over to ID.me, which requires a scan of your ID and a matching selfie.

doctor_radium 3y ago
I believe the ID.me system went down in flames. Got snagged by this myself for 2021 but opted to call a number and speak to a person instead. Shortly afterwards I discovered an article suggesting my reaction wasn't unique.
- almost_usual 3y ago
  The state of California uses ID.me now for EDD accounts.
- zootboy 3y ago
  I wish it had, but unfortunately it seems like the IRS just waited out the storm and is now back at it. Their website implores you to "create an account with ID.me as soon as possible": https://sa.www4.irs.gov/secureaccess/ui/ https://sa.www4.irs.gov/secureaccess/ui/

dcow 3y ago

IDENA https://www.idena.io/ https://www.idena.io/

perryizgr8 3y ago

> who has a decent plan to create proof-of-human systems that are not only CAPTCHA based? Why do sites need human verification anyway? If the problem is load, then you just need proper rate-limiting in place. Captcha always seems to be mis-identifying the real issue.

wizofaus 3y ago
Ok, so how do you rate trigger on a particular bot such that it doesn't impact real users negatively? Further, bots that submit enough pseudo-random data have a decent chance of bypassing various security mechanisms, including for authorizing payments. Even at .0001% success rate given enough attempts they have a decent likelihood of eventually subverting existing security measures, and boosting those may be just as painful or inconvenient to users as CAPTCHA and similar mechanisms. The reality is bots don't have their own money to spend, humans do, and on its own that's enough reason to care. And what's next, bots being issued passports or mortgages etc.?

spaceman_2020 3y ago

A digital wallet tied to a real, authenticated identity should be a solution. You can sign any login and confirm that it is indeed you, a real person, logging in. Unfortunately crypto folks are too busy selling shitcoins and scams to build this product.