4 ms·

> Skyvern understands how to solve CAPTCHAs to complete complicated workflows this seems like this could be used for abuse. the CAPTCHAs are specifically desig

> Skyvern understands how to solve CAPTCHAs to complete complicated workflows this seems like this could be used for abuse. the CAPTCHAs are specifically designed to stop botting on 3rd party websites. or this will just be another cat and mouse game where the next level of CAPTCHAs get more annoying and invasive to verify we are human

worldsayshi 3y ago
It seems to me that the logical conclusion for captcha is to connect it indirectly to electronic id. This could be done in a privacy respecting way. You could get some token from the website. It could include encrypted service name and policies, like rate limit, that the authority should enforce. The client passes the token to the eId authority. The authority signs it and adds timestamp, but no user info. Client gives token to the service. Something like that. This is a bad top of mind example. I think we'll need to rely a lot more on eID in the future. I think it can be done in a good way but then it needs to be thought through before it gets adopted. And we have to be able to trust the eId institutes.
- suchintan 3y ago
  2FA and logged-in experience is sort of a proxy for eID. I suspect that's why so many companies require that you log in with something that knows your identity (log in with google), or ask you for your phone number to confirm your account
- hirako2000 3y ago
  But it's the same problem all over again, spammers would get an id, auth, then spam. Anti spams are about detecting whether activities are spam. Binding an identity, is the naive mechanism that makes us think spam wouldn't happen. All it does is say ok we know it's pug35372 that teared the linens apart. We can put all measures to authenticate users, won't makes them not potentially bots running havoc right after a manual authentication. There are even farms, manually created accounts by gig seekers who would fill forms, email and phone number verification for less than a dollar.
  - worldsayshi 3y ago
    As I mentioned the exchanged token could include a number of policies, like rate limits. But I expect there could be more sophisticated policies as well. The service could send ban or lockout requests to the eId authority so that a misbehaving real life user could be locked out from the service even though the service doesn't know who they are (irl). I would guess it could even be designed so that the authority doesn't know which services a given user has been banned from either. And all the service would need to know is "This user has violated policy X at <timestamp>".
    - hirako2000 3y ago
      I see how issuing a token has its advantages, thanks.
suchintan 3y ago
Agreed. We didn't open source this functionality on purpose, and are very very specific about what use-cases we onboard that require it. That being said, we've gotten to learn a lot more about browser fingerprinting and captcha solving and it's a really interesting space. If you're curious about it, check out this blog post: https://antoinevastel.com/bot https://antoinevastel.com/bot detection/2018/01/17/detect-chrome-headless-v2.html
lm411 3y ago
Unfortunately, CAPTCHA's are already easy for bots to bypass or solve. There are quite a few services that will solve them in a few seconds, costing less than a dollar per 1000 solved tokens for most common CAPTCHA's (e.g ReCAPTCHA v2 and v3). I recently had to deal with an attacker doing credit card testing that was using one of these services. Related, I came across this last week, bypassing ReCAPTCHA with Selenium/Python/OpenAI Whisper API: https://www.youtube.com/watch?v=-TMNh64ubyM https://www.youtube.com/watch?v=-TMNh64ubyM
wutwutwat 3y ago
everyone seems to forget that stopping bots with google captcha was never the main goal... humans have been training google's ai models for a decade or more each and every time they answered a captcha at any rate, if someone wants to abuse your site, captcha, and even cloudflare won't help you > the next level of CAPTCHAs get more annoying and invasive to verify we are human like the solving puzzles ones? Or more advanced object identification, like selecting the correct orientation? Training more advanced AI now

worldsayshi 3y ago

It seems to me that the logical conclusion for captcha is to connect it indirectly to electronic id. This could be done in a privacy respecting way. You could get some token from the website. It could include encrypted service name and policies, like rate limit, that the authority should enforce. The client passes the token to the eId authority. The authority signs it and adds timestamp, but no user info. Client gives token to the service. Something like that. This is a bad top of mind example. I think we'll need to rely a lot more on eID in the future. I think it can be done in a good way but then it needs to be thought through before it gets adopted. And we have to be able to trust the eId institutes.

suchintan 3y ago
2FA and logged-in experience is sort of a proxy for eID. I suspect that's why so many companies require that you log in with something that knows your identity (log in with google), or ask you for your phone number to confirm your account
hirako2000 3y ago
But it's the same problem all over again, spammers would get an id, auth, then spam. Anti spams are about detecting whether activities are spam. Binding an identity, is the naive mechanism that makes us think spam wouldn't happen. All it does is say ok we know it's pug35372 that teared the linens apart. We can put all measures to authenticate users, won't makes them not potentially bots running havoc right after a manual authentication. There are even farms, manually created accounts by gig seekers who would fill forms, email and phone number verification for less than a dollar.
- worldsayshi 3y ago
  As I mentioned the exchanged token could include a number of policies, like rate limits. But I expect there could be more sophisticated policies as well. The service could send ban or lockout requests to the eId authority so that a misbehaving real life user could be locked out from the service even though the service doesn't know who they are (irl). I would guess it could even be designed so that the authority doesn't know which services a given user has been banned from either. And all the service would need to know is "This user has violated policy X at <timestamp>".
  - hirako2000 3y ago
    I see how issuing a token has its advantages, thanks.

suchintan 3y ago

Agreed. We didn't open source this functionality on purpose, and are very very specific about what use-cases we onboard that require it. That being said, we've gotten to learn a lot more about browser fingerprinting and captcha solving and it's a really interesting space. If you're curious about it, check out this blog post: https://antoinevastel.com/bot https://antoinevastel.com/bot detection/2018/01/17/detect-chrome-headless-v2.html

lm411 3y ago

Unfortunately, CAPTCHA's are already easy for bots to bypass or solve. There are quite a few services that will solve them in a few seconds, costing less than a dollar per 1000 solved tokens for most common CAPTCHA's (e.g ReCAPTCHA v2 and v3). I recently had to deal with an attacker doing credit card testing that was using one of these services. Related, I came across this last week, bypassing ReCAPTCHA with Selenium/Python/OpenAI Whisper API: https://www.youtube.com/watch?v=-TMNh64ubyM https://www.youtube.com/watch?v=-TMNh64ubyM

wutwutwat 3y ago

everyone seems to forget that stopping bots with google captcha was never the main goal... humans have been training google's ai models for a decade or more each and every time they answered a captcha at any rate, if someone wants to abuse your site, captcha, and even cloudflare won't help you > the next level of CAPTCHAs get more annoying and invasive to verify we are human like the solving puzzles ones? Or more advanced object identification, like selecting the correct orientation? Training more advanced AI now