3 ms·

I'd say you're too pedantic. Given both computer work (calculating hashes) and human labor (filling out reCAPTCHA) have a price point, it is only a matter of ma

I'd say you're too pedantic. Given both computer work (calculating hashes) and human labor (filling out reCAPTCHA) have a price point, it is only a matter of making automated actions more expensive to scale. It's only natural then that the word definition has shifted. Let's just declare that captcha now stands for Completely Automated Public Thingy to Make Spammers And Fraudsters Life A Bit Harder.

throwawayadvsec 3y ago
large scale spammers are just going to use free cloud credits they got for pennies on the dollar, it won't stop anyone
1116574 3y ago
But it doesn't catch fraudsters! Point fo captcha is to make sure that there is a human eg. writing this comment or creating account. If I used this (admitedly cool and useful) rate limiter instead of real captcha I would have 1000s of ai generated posts and 100s of new accounts. Yes, it would be rate limited and spread over a day or week, and servers would easly handle it, but that's not the point. I don't want this fake activity at all - that's the point! This seems like a good alternative/addition to cloudflare and their anti ddos features though (?)
- thayne 3y ago
  But a traditional captcha doesn't solve that either. Even if the captcha really is too hard for a bot, you can pay other humans to solve captchas for you at a click farm. Or even just generate content and automate everything except the captcha, and solve those yourself.
  - smohare 3y ago
    [dead]
  - Dylan16807 3y ago
    A dead comment thinks you're making a no true Scotsman argument, but you're right. The key is that the workarounds you're listing are very cheap and easy, not just possible.
- kaba0 3y ago
  There are no easy/non-annoying tasks left that could easily differentiate between a human and a bot, and any that may exist will only work for a short time. The only thing left, as mentioned, is to move the price point for an automated attack: I'm sure creating a fake account on your site is not worth, say, 1000$ for those 1000 accounts. Remember, a troll can also register by hand 10-20 accounts, with any kind of captcha, so it's not zero sum either.

throwawayadvsec 3y ago

large scale spammers are just going to use free cloud credits they got for pennies on the dollar, it won't stop anyone

1116574 3y ago

But it doesn't catch fraudsters! Point fo captcha is to make sure that there is a human eg. writing this comment or creating account. If I used this (admitedly cool and useful) rate limiter instead of real captcha I would have 1000s of ai generated posts and 100s of new accounts. Yes, it would be rate limited and spread over a day or week, and servers would easly handle it, but that's not the point. I don't want this fake activity at all - that's the point! This seems like a good alternative/addition to cloudflare and their anti ddos features though (?)

thayne 3y ago
But a traditional captcha doesn't solve that either. Even if the captcha really is too hard for a bot, you can pay other humans to solve captchas for you at a click farm. Or even just generate content and automate everything except the captcha, and solve those yourself.
- smohare 3y ago
  [dead]
- Dylan16807 3y ago
  A dead comment thinks you're making a no true Scotsman argument, but you're right. The key is that the workarounds you're listing are very cheap and easy, not just possible.
kaba0 3y ago
There are no easy/non-annoying tasks left that could easily differentiate between a human and a bot, and any that may exist will only work for a short time. The only thing left, as mentioned, is to move the price point for an automated attack: I'm sure creating a fake account on your site is not worth, say, 1000$ for those 1000 accounts. Remember, a troll can also register by hand 10-20 accounts, with any kind of captcha, so it's not zero sum either.