4 ms·

Captcha _this_

16 points by leephillips 3y ago

version_five 3y ago
Couldn't agree more. I regularly cease business with sites that require a captcha and I usually try and email them to tell them why. I have only ever had lame excuses for why they have to. The absolute worst is when it's immediately before asking you to put your credit card info in. Even the worst designer must realize how bad an idea it is to add offensive friction at this point - although I'd expect that most people are such sheep they don't even question it.
- leephillips 3y ago
  This is what really bothers me. That the state of the web is training people to put up with a new layer of imposition and rudeness in their lives. To see it as inevitable. We must vote with our feet.
sdflhasjd 3y ago
ReCAPTCHA has an infuriating feature: when it detects you're not acting like a good Internet citizen (i.e not surrendering your every mote of privacy, or just not using a Chrome user agent) it deliberately slows down, you pick your crosswalk images and it takes 10 seconds for the selected images to fade out and the next round of monkey games to fade back in.
NoZebra120vClip 3y ago
I don't get it. I mean, I get kinda tired of CAPTCHAs, too, but they are there for our safety. I'm not sure it is comprehended here how service could be degraded unless administrators are able to detect and prevent bots. Does he comprehend the utter onslaught of attacks, 24/7, from all sides, that public web servers undergo? Does he understand that credential stuffing attacks, brute forces, and all manner of scraping attempts occur, and CAPTCHAs are a thin weak line of defense against all that? Now I've seen some CAPTCHA styles that don't even prompt me, the user, for anything, but they seem to protect just the same. And I am sure that if there were a better answer than CAPTCHAs, they would be implemented far and wide. And CAPTCHA is not a panacea when you can pay humans $0.03 an hour to solve CAPTCHAs all day from Thailand or something. But it's cat-and-mouse with the AIs already, and it may only get worse, so buckle your seat belts, and get used to proving that you're a human.
- leephillips 3y ago
  “Does he comprehend the utter onslaught” Yes (my 10 domains...). Sorry, they need to find another solution. Offloading their security problem onto me means I am finding another vendor. And the fact that other vendors offering the same service have found other solutions means that captchas are not necessary.
  - NoZebra120vClip 3y ago
    You know, I'm all ears, but has anyone besides CloudFlare implemented a viable successor and solution to this? Is that the answer, then? Migrate everyone to CloudFlare?
- version_five 3y ago
  > but they are there for our safety It's insane to me that anyone can think or say this with a straight face, about anything. They are there because of lazy design and a distain for customers. Any campaign to convince you something is "there for your safety" is an attempt to rob you of something and control you.
OkayPhysicist 3y ago
What does the Captcha even provide in this case? I (somewhat) understand when they're used to used to prevent the automated creation of free accounts or whatnot, but for a company I'm paying, they already have a much higher bar that I've passed: giving them money. A bot farm that is actively handing you money in order to use your service is the opposite of a problem.
- hakfoo 3y ago
  That was always my mentality on paid services. Effectively speaking, Visa has done the CAPTCHA for you. In general, people don't care that you're a robot, they care if you're a non-paying customer. OTOH, I wonder if they don't want bots because automation is a risk for them. If they make a terrible dark-patterns checkout process, you want real customers hitting it, not a bot that's already been programmed to avoid every upsell and gimmick. Or maybe their systems are simply not designed for even the modest load you'd get if customers started automating their legitimate workflows, and they can use the "bot protection" excuse to buy another year of life out of those Prescott cores.
predictabl3 3y ago
Can we compromise and let me disable captcha for my login if my only two-factor auth method is a hardware token? The only scenarios in which that chain is compromised... are not going to be helped by a Captcha. Actually now I'm even more annoyed at this, because maybe it IS helping them stop some perceived scraping? Even though my usage pattern of the one in mind is clearly not scraping behavior.

16 points by leephillips 3y ago

Couldn't agree more. I regularly cease business with sites that require a captcha and I usually try and email them to tell them why. I have only ever had lame excuses for why they have to. The absolute worst is when it's immediately before asking you to put your credit card info in. Even the worst designer must realize how bad an idea it is to add offensive friction at this point - although I'd expect that most people are such sheep they don't even question it.

leephillips 3y ago
This is what really bothers me. That the state of the web is training people to put up with a new layer of imposition and rudeness in their lives. To see it as inevitable. We must vote with our feet.

sdflhasjd 3y ago

ReCAPTCHA has an infuriating feature: when it detects you're not acting like a good Internet citizen (i.e not surrendering your every mote of privacy, or just not using a Chrome user agent) it deliberately slows down, you pick your crosswalk images and it takes 10 seconds for the selected images to fade out and the next round of monkey games to fade back in.

NoZebra120vClip 3y ago

I don't get it. I mean, I get kinda tired of CAPTCHAs, too, but they are there for our safety. I'm not sure it is comprehended here how service could be degraded unless administrators are able to detect and prevent bots. Does he comprehend the utter onslaught of attacks, 24/7, from all sides, that public web servers undergo? Does he understand that credential stuffing attacks, brute forces, and all manner of scraping attempts occur, and CAPTCHAs are a thin weak line of defense against all that? Now I've seen some CAPTCHA styles that don't even prompt me, the user, for anything, but they seem to protect just the same. And I am sure that if there were a better answer than CAPTCHAs, they would be implemented far and wide. And CAPTCHA is not a panacea when you can pay humans $0.03 an hour to solve CAPTCHAs all day from Thailand or something. But it's cat-and-mouse with the AIs already, and it may only get worse, so buckle your seat belts, and get used to proving that you're a human.

leephillips 3y ago
“Does he comprehend the utter onslaught” Yes (my 10 domains...). Sorry, they need to find another solution. Offloading their security problem onto me means I am finding another vendor. And the fact that other vendors offering the same service have found other solutions means that captchas are not necessary.
- NoZebra120vClip 3y ago
  You know, I'm all ears, but has anyone besides CloudFlare implemented a viable successor and solution to this? Is that the answer, then? Migrate everyone to CloudFlare?
version_five 3y ago
> but they are there for our safety It's insane to me that anyone can think or say this with a straight face, about anything. They are there because of lazy design and a distain for customers. Any campaign to convince you something is "there for your safety" is an attempt to rob you of something and control you.

OkayPhysicist 3y ago

What does the Captcha even provide in this case? I (somewhat) understand when they're used to used to prevent the automated creation of free accounts or whatnot, but for a company I'm paying, they already have a much higher bar that I've passed: giving them money. A bot farm that is actively handing you money in order to use your service is the opposite of a problem.

hakfoo 3y ago
That was always my mentality on paid services. Effectively speaking, Visa has done the CAPTCHA for you. In general, people don't care that you're a robot, they care if you're a non-paying customer. OTOH, I wonder if they don't want bots because automation is a risk for them. If they make a terrible dark-patterns checkout process, you want real customers hitting it, not a bot that's already been programmed to avoid every upsell and gimmick. Or maybe their systems are simply not designed for even the modest load you'd get if customers started automating their legitimate workflows, and they can use the "bot protection" excuse to buy another year of life out of those Prescott cores.

predictabl3 3y ago

Can we compromise and let me disable captcha for my login if my only two-factor auth method is a hardware token? The only scenarios in which that chain is compromised... are not going to be helped by a Captcha. Actually now I'm even more annoyed at this, because maybe it IS helping them stop some perceived scraping? Even though my usage pattern of the one in mind is clearly not scraping behavior.