9 ms·
> New approaches are needed, like more dynamic approaches using behavioural analysis Does this set off alarm bells for anyone else? Of course the best way to k
by esperent 3y ago
> New approaches are needed, like more dynamic approaches using behavioural analysis
Does this set off alarm bells for anyone else? Of course the best way to know if a visitor is a human or a bot is to deeply analyze their behavior. But that's at odds with the right of us humans not to be analyzed by every website we visit. What happens if we do reach a standoff where the bots become good enough at mimicking human behavior that the only way to tell us apart is unacceptable and illegal behavioral analysis?
- araes 3y agoI recently wondered whether the good reviews on WWW shopping sites, are actually written by the bots. The market for astroturfing is so competitive, that the paid reviews probably learned a long time ago you need to leave quality reviews to get repeat customers. They also 'care' more than actual customers in many cases. Real customer -> "Stop sending me review reminders. It was a comb. Block." Bot -> "Dutifully review all kinds of products. 500 words on the life changing experience of hair brushing with this comb. A+ reviewer." I find it difficult to believe that the bot networks would not have just immediately rolled every single generative AI advance into their networks (write convincing reviews, generate convincing product examples without buying, beat captchas more reliably, automated screen clicking, human eye scan impersonation). Need to be better than every other group doing paid reviews. Need to be better than actual humans. They might write critical reviews. Also, lot of sites already doing some behavioral analysis. Popup every time you consider clicking 'leave' on websites lately? "Before you go..."
- runnerup 3y ago> I recently wondered whether the good reviews on WWW shopping sites, are actually written by the bots. Probably, but if these are just like, Amazon reviews/etc, they likely violate FTC regulations. Enforcement is lacking, but I'd still be very hesitant to break the law.
- clucas 3y agoObligatory: https://xkcd.com/810/ https://xkcd.com/810/
- wepple 3y agoThere are the recently announced hardware root of trust solutions[1] that aren’t behavior driven. But they just trade one privacy issue for potentially another, depending on your view It does seem sadly unavoidable. Perhaps the internet has to go full circle and we need real identities if we want to ensure we’re not talking to machines? [1] https://blog.cloudflare.com/eliminating-captchas-on-iphones-and-macs-using-new-standard/ https://blog.cloudflare.com/eliminating-captchas-on-iphones-...
- Jon_Lowtek 3y agoIt is not only a privacy issue, "certified by entrenched gatekeeper mega-corporation" is a nightmare for user freedom. The first ones who will be impacted are the minority who root their devices and compile their own software, but in the long run there are detrimental effects of a monopoly at the gate, like the ease to implement surveillance, censorship and drm, that will apply to everyone.
- wepple 3y agoYeah, at second glance it actually (as proposed - huge caveat) might even be better for privacy. I’m can’t begin to theorize how the future will play out if you need a PAT to access most web destinations. Do cloudflare or Apple engineers use Linux machines ever? Surely they do, and either know this is bad or have some plan to make it work?
- JohnFen 3y ago> Perhaps the internet has to go full circle and we need real identities if we want to ensure we’re not talking to machines? If that's the case, then I'll be done using the web entirely.
- wepple 3y agoYeah, I think I might be too. I mean, I’m headed that way to a degree anyhow. Although arguably most major web players already 100% know who you are - just maybe not your name.
- throwawaaarrgh 3y agoThen we require a phone number for everything (it's not easy to make unlimited new phone numbers) and use OIDC to authenticate to one of a couple providers. You won't be able to do anything on the internet without logging in first, but the login is safe at the identity provider. If you think about it this is no different than showing your ID to get into a bar.
- aio2 3y agoThe problem is that this time, it's not a bar, it's just any store (or really, anywhere) you go.
- datadrivenangel 3y agoand they're recording your ID number and sharing that with other stores to track your purchases.
- 1337biz 3y agoI trust any bar more about privacy than anyone on the internet. Their incentive to maximize consent to stalk me and my behavior is close to non-existing.
- remram 3y agoPhone numbers are a cheap and reusable resource. Pushing the problem on another site with OIDC doesn't help either, if their CAPTCHAs have the same limitation.
- flangola7 3y ago"Real" cellular phone numbers are a very finite pool and require nontrivial amounts of money, a physical phone (with a burned-in hardware identifier), an in-person interaction, and government ID that validated against a state database.
- KomoD 3y agoSome places might require all that but a lot don't need in-person, id card. And there's also sms verification services that charge you a few cents per verification, and they use "real" numbers.
- jasonjayr 3y agoThey are working on that: See the Web Integrity API. One of the goals was to separate the humans from the robots.
- rhyme-boss 3y agoIt's also short-sighted because any behavior analysis that is stored in a database somewhere could be used to train a new AI model.
- GuB-42 3y agoMaybe the ultimate solution is to make people pay. As in microtransactions Human or bot is not really the problem, spam is the problem, and bots makes spam so cheap that admins can't deal with it. So, bots are banned. Human spammers can still get in, and you can pay people to solve captcha, but humans are more expensive, so there are less of them and moderators can deal with them. If we had people (or bots) pay a few cents to access a service, it could be enough to keep spam to a manageable level. The problem is, people don't like to pay, and unlike with phone numbers, the web doesn't have a good microtransaction architecture so behavioral analysis it is.
- JuanPosadas 3y agoSpammers will have more disposable funds than me and more utility from making payments to spread their message than I will. Essentially this is more likely to exclude poor people while waving spammers on in through the ticket gate. Not to mention credit card fees making sub $1 payments a no-go and crypto being it's own barrel of nightmares.
- SketchySeaBeast 3y agoYeah, I don't think anyone is going to pay 5 cents to see a website. That number is likely to get big real fast if you like news aggregation sites.
- ericd 3y agoNo fundamental reason a micro transaction has to be more than a tiny fraction of a penny.
- GuB-42 3y agoThe idea is not to make people pay 5 cents to see a website. Instead replacing captchas with a toll for about how much it would cost to have a human solve the captcha for you.
- nottorp 3y agoIf you just open HN once per day and open all promising links in a new window you're already out a lot of cents. This will only work with mechanisms that let you pay like 0.05 cents. Should be enough to deter bots that practically run for free these days. Too bad any intermediary will want 0.30 dollars per transaction for the 0.05 cents :)
- wesapien 3y agoGeorge Hotz is correct in that we all need our own AI. This is the only way to give us a fighting chance against bad actors.
- spondylosaurus 3y ago> What happens if we do reach a standoff where the bots become good enough at mimicking human behavior that the only way to tell us apart is unacceptable and illegal behavioral analysis? Sophisticated bots are already good enough at this that a variety of behavioral-based bot analysis tools exist and are in semi-widespread use. They're not illegal.
- esperent 3y agoCan you give any examples of these tools?
- spondylosaurus 3y agohttps://datadome.co/resources/forrester-wave-bot-management-q2-2022/ https://datadome.co/resources/forrester-wave-bot-management-...
- amadeuspagel 3y agoThankfully, soon we will have the web integrity API to verify that a visitor is human. Apple devices already support something like this when connecting to websites behind cloudflare and fastly, and as cloudflare explains this "vastly improves privacy by validating without fingerprinting"[1]. https://blog.cloudflare.com/eliminating-captchas-on-iphones-and-macs-using-new-standard/ https://blog.cloudflare.com/eliminating-captchas-on-iphones-...
- hurutparittya 3y agoPlease tell me you are not honestly cheering that atrocity on.