6 ms·

There are still plenty of good captcha approaches left, they're just more invasive. Things like "please type your credit card number here and pay a 1 cent fee"

There are still plenty of good captcha approaches left, they're just more invasive. Things like "please type your credit card number here and pay a 1 cent fee". Or "send us a selfie with your passport". Or "Get 5 friends to vouch for you". Or "please log into a government website and oauth this app" Or "please log in with a gmail account that is at least 5 years old".

JimtheCoder 3y ago
Are we just making lists of things I'll never do?
- stjohnswarts 3y ago
  Yeah talk about just finding another way to spend time after work :) . Guess I'd get more into my wood working or reading more books.
_8j50 3y ago
Or "turn on your webcam and say/do stuff" I have a feeling other humans verifying you mechanicalturk style one time is the future. But imho, the payment route makes sense and also this is the problem as random paywalled sites and web monetization. A cash equivalent bearer of token payment method is what is needed. 1) verify+lock funds 2) get bearer to pay funds or funds unlock in x minutes, cancelling the payment 3) token is presented to payment processor who will revoke the token, issue funds to payee with a new token matching that value paid 4) anyone holding that token can pay for stuff, you can just email or move tokens with usb drives or store them im a secure vault service I believe the main obstacle to solve so many web issues are KYC laws and lack of constitution amendment level laws that give the people right to trade using a bearer token (cash or not) and transfer funds peer-to-peer without a third party or disclosing their personal info (again, all like cash).
- mattnewton 3y ago
  > Or "turn on your webcam and say/do stuff" Probably <1 year away from beating automated detection of this reliably and 2-3 in fooling humans a high % of the time economically. I was at siggraph recently where I think I saw a whole room of papers of people’s approaches to doing just this problem of photorealistic faces saying arbitrary things.
  - sarchertech 3y ago
    If you're asking people to perform arbitrary actions on camera (not just speaking), generating that to a degree that is indistinguishable from video in real-time is much more than 2 to 3 years away.
    - mattnewton 3y ago
      Who’s verifying it though? 3d rendering won’t fool humans but could be tuned to fool bots. Unless you have a massive library of possible actions these can be pre-rendered too.
      - sarchertech 3y ago
        The OP you responded to said "I have a feeling other humans verifying you mechanicalturk style one time is the future." I don't know if that's feasible, but that's the premise. >Unless you have a massive library of possible actions these can be pre-rendered too. Combinatorial explosion gives you a massive amount of actions. Hold your right ring finger between your left thumb and pinky and move it around in a circle. There's tools that you could use to limit what you had to prerender and it would be a cat and mouse game like captcha is today, but I think until we're at the point where you can completely replace an actor, and then you can do that in real time, picking out a real human will be possible.
        mattnewton 3y ago
        I’d take the other side of that bet if it was stipulated that the 1 year start after this became a common captcha technique. People are working on generating animation on a rig from text prompts: https://www.motorica.ai/ https://www.motorica.ai/ It would be easier if we knew the prompts ahead of time and then we just render transitions. Real time-ness and a good deal of rendering fidelity can be mitigated by pretending to have crappy network connection once the prompt is given, unless you are comfortable excluding people without reliable internet. I think the bigger issue is probably with the premise though. This kind of video rendering is much more taxing but it’s also much more taxing on the verification side. I can’t imagine a company being able to do this at scale the way captchas are to defend against bots, you’d need an automated system on the frontline.
mattnewton 3y ago
Bots can do credit card transactions today, generate selfies that would fool automated detection (unless you are having humans in the loop, in which case they can easily generate them cheaper than they are to verify and ddos you that way), and pretend to be friends once 5 real people have vouched for them. Having an older gmail is going to do a good job making sure only the millenials and their botnets get in today, but also plenty of real customers in most domains will be blocked. All of these might work today just because they aren’t widely used yet. Once they are and are understood they’ll be cracked. The government oauth is maybe the most interesting; it probably just kicks the can to a government site which is going to have all the same problems, but could potentially benefit from a secure national id. But now the government has a database of all the sites you are logging into; forget privacy of library records, that’s a massive loss to the 4th amendment in practice. No need for prism or other NSA exploit nonsense when sites are literally pinging a government server to verify citizen network activity.
- microtonal 3y ago
  Why? Put a signing key pair on a secure element (e.g. in the passport). Let the government sign the public key. This way sites can check if it’s a government-approved keypair. You can prove that you own the key pair using the private key. No site ever has to contact the government for authentication. The only issue is that it could lead to cross-site tracking because you are reusing the same public key everywhere. But maybe cryptography experts have a solution?
  - jlokier 3y ago
    > But maybe cryptography experts have a solution? They do! The field of zero-knowledge cryptography targets exactly this sort of use case, proving things to a recipient without revealing other things. In this case, you might send a zero-knowledge proof that you have the private key corresponding to a government-signed public key, without revealing either key and, importantly, without communicating with the government or sending correlatable information on each transaction. (If you were ok communicating with the government you could just get it to sign a random public key for each transaction without needing zero-knowledge cryptography). You can do a lot more, for example proving "I am 18+ [attested by gov signature]" without revealing your age, birthday or identity, or "I have security clearance level 2 [attested by gov signature]" without revealing anything else, or "I have a driving license [attested by gov signature] and current paid-up insurance [attested by insurer signature]" etc. The field has advanced technically a lot in the last few years, to the point that those sorts of zero-knowledge proofs are now easy to implement technically and reasonably fast to compute.
sarchertech 3y ago
The complete solution is a trusted 3rd party that verifies you in person. In most countries that would be the government. In the US it could a private entity like banks. Then websites site rate limit each authenticated person.
- lotsofpulp 3y ago
  The US has long verified you in person at United States Postal Service locations for the purpose of verifying your identity for US passports.
  - sarchertech 3y ago
    For sure, and you could probably build off of that by just having a digital identify tied to the passport. But what I was getting at was that people freak out whenever anyone discusses a national identify card.
    - lotsofpulp 3y ago
      Yes, and I was getting at that a national identity card in the US has existed for many years, called a passport, so people are freaking out for no reason. Also, it could be made opt in so the people freaking out would have nothing to object to, and then whoever wants to participate, can.
- lost_tourist 3y ago
  With the added plus of being tracked absolutely everywhere and everything you do.
  - sarchertech 3y ago
    You can architect it in a way that let's the person choose what they want to share with 3rd parties. The most basic is just, this is an actual human. Then make it illegal for companies to share tracking data based on your passport id with anyone. You can also architect it so that the government doesn't know who is trying to authenticate you. It does prevent you from making multiple accounts with the same company though.
hardware2win 3y ago
Good luck thinking im gonna give my paasport to random website
naturalauction 3y ago
>Get 5 friends to vouch for you This approach is used by wechat, you can't make your own account and can only be invited by an existing user. I suspect that wechat has reached enough market penetration that this is now worth it.
- IshKebab 3y ago
  Also Lobste.rs, which is why I am commenting here and not there.
- yieldcrv 3y ago
  It was easy for me to find a Chinese national in San Francisco to verify me for WeChat There are tricky requirements for Americans
ben_w 3y ago
> Or "send us a selfie with your passport". Bet that's vulnerable to Stable Diffusion in-painting.
jandrese 3y ago
Isn't this what Wechat does? On the mainland you have to give them your bank account information, have a friend vouch for you (and that friend will also be kicked off if you misbehave), do it on a real phone that you can shake in a specific way when asked, and have a government ID.

JimtheCoder 3y ago

Are we just making lists of things I'll never do?

stjohnswarts 3y ago
Yeah talk about just finding another way to spend time after work :) . Guess I'd get more into my wood working or reading more books.

_8j50 3y ago

Or "turn on your webcam and say/do stuff" I have a feeling other humans verifying you mechanicalturk style one time is the future. But imho, the payment route makes sense and also this is the problem as random paywalled sites and web monetization. A cash equivalent bearer of token payment method is what is needed. 1) verify+lock funds 2) get bearer to pay funds or funds unlock in x minutes, cancelling the payment 3) token is presented to payment processor who will revoke the token, issue funds to payee with a new token matching that value paid 4) anyone holding that token can pay for stuff, you can just email or move tokens with usb drives or store them im a secure vault service I believe the main obstacle to solve so many web issues are KYC laws and lack of constitution amendment level laws that give the people right to trade using a bearer token (cash or not) and transfer funds peer-to-peer without a third party or disclosing their personal info (again, all like cash).

mattnewton 3y ago
> Or "turn on your webcam and say/do stuff" Probably <1 year away from beating automated detection of this reliably and 2-3 in fooling humans a high % of the time economically. I was at siggraph recently where I think I saw a whole room of papers of people’s approaches to doing just this problem of photorealistic faces saying arbitrary things.
- sarchertech 3y ago
  If you're asking people to perform arbitrary actions on camera (not just speaking), generating that to a degree that is indistinguishable from video in real-time is much more than 2 to 3 years away.
  - mattnewton 3y ago
    Who’s verifying it though? 3d rendering won’t fool humans but could be tuned to fool bots. Unless you have a massive library of possible actions these can be pre-rendered too.
    - sarchertech 3y ago
      The OP you responded to said "I have a feeling other humans verifying you mechanicalturk style one time is the future." I don't know if that's feasible, but that's the premise. >Unless you have a massive library of possible actions these can be pre-rendered too. Combinatorial explosion gives you a massive amount of actions. Hold your right ring finger between your left thumb and pinky and move it around in a circle. There's tools that you could use to limit what you had to prerender and it would be a cat and mouse game like captcha is today, but I think until we're at the point where you can completely replace an actor, and then you can do that in real time, picking out a real human will be possible.
      - mattnewton 3y ago
        I’d take the other side of that bet if it was stipulated that the 1 year start after this became a common captcha technique. People are working on generating animation on a rig from text prompts: https://www.motorica.ai/ https://www.motorica.ai/ It would be easier if we knew the prompts ahead of time and then we just render transitions. Real time-ness and a good deal of rendering fidelity can be mitigated by pretending to have crappy network connection once the prompt is given, unless you are comfortable excluding people without reliable internet. I think the bigger issue is probably with the premise though. This kind of video rendering is much more taxing but it’s also much more taxing on the verification side. I can’t imagine a company being able to do this at scale the way captchas are to defend against bots, you’d need an automated system on the frontline.

mattnewton 3y ago

Bots can do credit card transactions today, generate selfies that would fool automated detection (unless you are having humans in the loop, in which case they can easily generate them cheaper than they are to verify and ddos you that way), and pretend to be friends once 5 real people have vouched for them. Having an older gmail is going to do a good job making sure only the millenials and their botnets get in today, but also plenty of real customers in most domains will be blocked. All of these might work today just because they aren’t widely used yet. Once they are and are understood they’ll be cracked. The government oauth is maybe the most interesting; it probably just kicks the can to a government site which is going to have all the same problems, but could potentially benefit from a secure national id. But now the government has a database of all the sites you are logging into; forget privacy of library records, that’s a massive loss to the 4th amendment in practice. No need for prism or other NSA exploit nonsense when sites are literally pinging a government server to verify citizen network activity.

microtonal 3y ago
Why? Put a signing key pair on a secure element (e.g. in the passport). Let the government sign the public key. This way sites can check if it’s a government-approved keypair. You can prove that you own the key pair using the private key. No site ever has to contact the government for authentication. The only issue is that it could lead to cross-site tracking because you are reusing the same public key everywhere. But maybe cryptography experts have a solution?
- jlokier 3y ago
  > But maybe cryptography experts have a solution? They do! The field of zero-knowledge cryptography targets exactly this sort of use case, proving things to a recipient without revealing other things. In this case, you might send a zero-knowledge proof that you have the private key corresponding to a government-signed public key, without revealing either key and, importantly, without communicating with the government or sending correlatable information on each transaction. (If you were ok communicating with the government you could just get it to sign a random public key for each transaction without needing zero-knowledge cryptography). You can do a lot more, for example proving "I am 18+ [attested by gov signature]" without revealing your age, birthday or identity, or "I have security clearance level 2 [attested by gov signature]" without revealing anything else, or "I have a driving license [attested by gov signature] and current paid-up insurance [attested by insurer signature]" etc. The field has advanced technically a lot in the last few years, to the point that those sorts of zero-knowledge proofs are now easy to implement technically and reasonably fast to compute.

sarchertech 3y ago

The complete solution is a trusted 3rd party that verifies you in person. In most countries that would be the government. In the US it could a private entity like banks. Then websites site rate limit each authenticated person.

lotsofpulp 3y ago
The US has long verified you in person at United States Postal Service locations for the purpose of verifying your identity for US passports.
- sarchertech 3y ago
  For sure, and you could probably build off of that by just having a digital identify tied to the passport. But what I was getting at was that people freak out whenever anyone discusses a national identify card.
  - lotsofpulp 3y ago
    Yes, and I was getting at that a national identity card in the US has existed for many years, called a passport, so people are freaking out for no reason. Also, it could be made opt in so the people freaking out would have nothing to object to, and then whoever wants to participate, can.
lost_tourist 3y ago
With the added plus of being tracked absolutely everywhere and everything you do.
- sarchertech 3y ago
  You can architect it in a way that let's the person choose what they want to share with 3rd parties. The most basic is just, this is an actual human. Then make it illegal for companies to share tracking data based on your passport id with anyone. You can also architect it so that the government doesn't know who is trying to authenticate you. It does prevent you from making multiple accounts with the same company though.

hardware2win 3y ago

Good luck thinking im gonna give my paasport to random website

naturalauction 3y ago

>Get 5 friends to vouch for you This approach is used by wechat, you can't make your own account and can only be invited by an existing user. I suspect that wechat has reached enough market penetration that this is now worth it.

IshKebab 3y ago
Also Lobste.rs, which is why I am commenting here and not there.
yieldcrv 3y ago
It was easy for me to find a Chinese national in San Francisco to verify me for WeChat There are tricky requirements for Americans

ben_w 3y ago

> Or "send us a selfie with your passport". Bet that's vulnerable to Stable Diffusion in-painting.

jandrese 3y ago

Isn't this what Wechat does? On the mainland you have to give them your bank account information, have a friend vouch for you (and that friend will also be kicked off if you misbehave), do it on a real phone that you can shake in a specific way when asked, and have a government ID.