4 ms·

This is what I call the "captcha triangle". You can have a very hard captcha that bots cannot solve, but that discriminates against the disabled. This gives yo

This is what I call the "captcha triangle". You can have a very hard captcha that bots cannot solve, but that discriminates against the disabled. This gives you privacy and abuse-prevention, but not accessibility. You can have a very easy captcha (or possibly multiple alternative challenges), but bots can solve those easily. This gives you accessibility and privacy, but not abuse prevention. You can mostly have easy, accessible captchas, but rely on invasive tracking and fingerprinting, this gives you accessibility and abuse-prevention, but not privacy. There's no way to have all three. As AI gets better, traditional captchas get more and more useless, and you need more and more tracking. We'll probably reach a point where there's no task that computers can easily verify but AIs can't easily perform, except being "vouched for" by a company that the website owner trusts.

Dylan16807 2y ago
Vouching is onerous in some ways, but on the plus side it can be done anonymously so the vouching company doesn't know which sites you're visiting. Examples being privacy pass and private access tokens, though I haven't seen much mention of them recently.
mindslight 2y ago
Most captchas don't even come off as actual abuse protection, but rather seem to exist because someone wanted to check some box for more cargo cult "security". I can understand captchas being on login pages, ideally only after a few failed logins. But most usage seems to involve gating simple pages, often on sites that should want to be publishing their data far and wide (like ecommerce). And if your site implementation is that bloated that serving what should be static pages creates significant load, you should work on fixing that rather than adding band-aids that make your site even less usable.
- jart 2y ago
  Have you ever run a website or online service? Whenever I've put something online, there's inevitably at least one person out there who's bored and unemployed with technical chops, who makes it their full time mission to abuse it for months until I figure out how to outsmart them. The Internet is full of these micro-tyrants and I never see anyone complaining about them. Most operators just throw their hands up in the air and depend on protection services like reCAPTCHA to make the pain go away, which always want something in return. Google is like what Paul Erdos called the "Supreme Fascist" (SF) for that reason. Every time you do something bad on the web, Google gains a little more power.
  - techsupporter 2y ago
    > The Internet is full of these micro-tyrants and I never see anyone complaining about them. I'll complain about them. They're, at best, poorly-informed people who don't understand the ramifications of what they're doing as it winds up as abuse, or worst they're malicious actors who I hope are condemned to a life of a 300 baud modem over a rural telephone line in a lightning storm. The hiccup is, these are two different problems. I'm not the service administrator; I'm the user who has to put up with the absolutely onerous "bot prevention service." Frankly, if you're a private entity, I'm mostly of the mind of do what you like. If I encounter a CAPTCHA, I will probably just bounce off the page. Except, of course, that Google penalizes me for doing that, too, because I Might Be A Bot That Got Stymied(tm). Where my hackles are truly raised is when the government requires me to work through these moronic puzzles. I shouldn't have to do a CAPTCHA to log in to my transit pass or look up county records! Finally, it's everyone who will handwave away "well, it's inaccessible but whachagondo" without the acknowledgement that we are all on varying levels of "abled" and that level changes throughout our lives, and not just as it relates to age.
    - thayne 2y ago
      I've worked on implementing captcha in a few situations. In every case it was with great reluctance, and we tried to limit it to places that were absolutely necessary. But the alternative was to go down, or spend an order of magnitude more on abusive requests than legitimate ones, or allow spammers to use our commenting system to send emails. I don't like the situation any more than you do, but that transit site might have captcha to protect it from getting DDoSed and becoming unavailable. That county records site might have captcha to protect personal information from getting scraped for usage in phishing attacks and other unsavory activities. Sometimes there might be other ways to provide protection from bots, but those can have their own inconveniences for users. Or they could be prohibitively expensive. I'm not saying we shouldn't try to find better solutions, or that captchas are always necessary. But in many cases, they are there for a reason.
    - wizzwizz4 2y ago
      > without the acknowledgement that we are all on varying levels of "abled" I get this argument, and I even use it myself (it's great for getting through to people who find empathy hard), but shouldn't this be irrelevant? Even if 5% of people were born disabled, and the remaining 95% were abled for their entire lives, shouldn't disabled people still matter?
- Nextgrid 2y ago
  A lot of captchas are out there because their business model requires wasting human time - they call it "engagement". Captchas are there to ensure human time is wasted and can't be worked around by automated means. > often on sites that should want to be publishing their data far and wide (like ecommerce) Mismatched incentives within the companies mean this may not actually be the case. A situation where customers come in and buy on their own (because they've heard from elsewhere how good/cheap the products are) sounds great for business (and is great) but that's absolute doom for the marketing department for example because not only it's clear they're not actually needed, but they get little of that "engagement" they so desperately need to justify their careers/promotions if people just come in, buy and leave. With such a situation, the marketing/product department would rather have someone that buys very little but "engages" a lot than the other way around, as said engagement can be (mis?)represented in various ways to benefit their own careers, where as raw sales profit doesn't go into their pockets. Thus, captchas are one possible way to ensure this "engagement" is up, even if it overall leads to lower sales.
thayne 2y ago
It's possible for bots to bypass the "hard" captchas or tracking captchas too. Or even pay click farms to solve captchas for you. The only real value in captchas isn't to stop bots, but to make it more expensive, or slower, for an adversary to abuse your service at scale.
- BowBun 2y ago
  > The only real value in captchas isn't to stop bots, but to make it more expensive, or slower, for an adversary to abuse your service at scale. Replace 'bots' with 'bad actors', and isn't that security in a nutshell? It doesn't even have to be computers - every day I suffer having to lock my doors and carry keys because locks are how we deter people from theft. As an aside, this kind of thing is why I'm a misanthrope. What % of resources are spent on preventing bad actors doing the most basic, bad things? What a waste.
3np 2y ago
Where does memory-hard Proof-of-Work fall on this triangle? (In the typical meaning of PoW, as opposed to human attention-work)
EVa5I7bHFq9mnYK 2y ago
Can't we have some kind of a crypto scheme, which proves to the web site I am a good boy, without revealing my identity and without enabling the website to link my current visit to my previous visits or to visits on other websites?

Dylan16807 2y ago

Vouching is onerous in some ways, but on the plus side it can be done anonymously so the vouching company doesn't know which sites you're visiting. Examples being privacy pass and private access tokens, though I haven't seen much mention of them recently.

mindslight 2y ago

Most captchas don't even come off as actual abuse protection, but rather seem to exist because someone wanted to check some box for more cargo cult "security". I can understand captchas being on login pages, ideally only after a few failed logins. But most usage seems to involve gating simple pages, often on sites that should want to be publishing their data far and wide (like ecommerce). And if your site implementation is that bloated that serving what should be static pages creates significant load, you should work on fixing that rather than adding band-aids that make your site even less usable.

jart 2y ago
Have you ever run a website or online service? Whenever I've put something online, there's inevitably at least one person out there who's bored and unemployed with technical chops, who makes it their full time mission to abuse it for months until I figure out how to outsmart them. The Internet is full of these micro-tyrants and I never see anyone complaining about them. Most operators just throw their hands up in the air and depend on protection services like reCAPTCHA to make the pain go away, which always want something in return. Google is like what Paul Erdos called the "Supreme Fascist" (SF) for that reason. Every time you do something bad on the web, Google gains a little more power.
- techsupporter 2y ago
  > The Internet is full of these micro-tyrants and I never see anyone complaining about them. I'll complain about them. They're, at best, poorly-informed people who don't understand the ramifications of what they're doing as it winds up as abuse, or worst they're malicious actors who I hope are condemned to a life of a 300 baud modem over a rural telephone line in a lightning storm. The hiccup is, these are two different problems. I'm not the service administrator; I'm the user who has to put up with the absolutely onerous "bot prevention service." Frankly, if you're a private entity, I'm mostly of the mind of do what you like. If I encounter a CAPTCHA, I will probably just bounce off the page. Except, of course, that Google penalizes me for doing that, too, because I Might Be A Bot That Got Stymied(tm). Where my hackles are truly raised is when the government requires me to work through these moronic puzzles. I shouldn't have to do a CAPTCHA to log in to my transit pass or look up county records! Finally, it's everyone who will handwave away "well, it's inaccessible but whachagondo" without the acknowledgement that we are all on varying levels of "abled" and that level changes throughout our lives, and not just as it relates to age.
  - thayne 2y ago
    I've worked on implementing captcha in a few situations. In every case it was with great reluctance, and we tried to limit it to places that were absolutely necessary. But the alternative was to go down, or spend an order of magnitude more on abusive requests than legitimate ones, or allow spammers to use our commenting system to send emails. I don't like the situation any more than you do, but that transit site might have captcha to protect it from getting DDoSed and becoming unavailable. That county records site might have captcha to protect personal information from getting scraped for usage in phishing attacks and other unsavory activities. Sometimes there might be other ways to provide protection from bots, but those can have their own inconveniences for users. Or they could be prohibitively expensive. I'm not saying we shouldn't try to find better solutions, or that captchas are always necessary. But in many cases, they are there for a reason.
  - wizzwizz4 2y ago
    > without the acknowledgement that we are all on varying levels of "abled" I get this argument, and I even use it myself (it's great for getting through to people who find empathy hard), but shouldn't this be irrelevant? Even if 5% of people were born disabled, and the remaining 95% were abled for their entire lives, shouldn't disabled people still matter?
Nextgrid 2y ago
A lot of captchas are out there because their business model requires wasting human time - they call it "engagement". Captchas are there to ensure human time is wasted and can't be worked around by automated means. > often on sites that should want to be publishing their data far and wide (like ecommerce) Mismatched incentives within the companies mean this may not actually be the case. A situation where customers come in and buy on their own (because they've heard from elsewhere how good/cheap the products are) sounds great for business (and is great) but that's absolute doom for the marketing department for example because not only it's clear they're not actually needed, but they get little of that "engagement" they so desperately need to justify their careers/promotions if people just come in, buy and leave. With such a situation, the marketing/product department would rather have someone that buys very little but "engages" a lot than the other way around, as said engagement can be (mis?)represented in various ways to benefit their own careers, where as raw sales profit doesn't go into their pockets. Thus, captchas are one possible way to ensure this "engagement" is up, even if it overall leads to lower sales.

thayne 2y ago

It's possible for bots to bypass the "hard" captchas or tracking captchas too. Or even pay click farms to solve captchas for you. The only real value in captchas isn't to stop bots, but to make it more expensive, or slower, for an adversary to abuse your service at scale.

BowBun 2y ago
> The only real value in captchas isn't to stop bots, but to make it more expensive, or slower, for an adversary to abuse your service at scale. Replace 'bots' with 'bad actors', and isn't that security in a nutshell? It doesn't even have to be computers - every day I suffer having to lock my doors and carry keys because locks are how we deter people from theft. As an aside, this kind of thing is why I'm a misanthrope. What % of resources are spent on preventing bad actors doing the most basic, bad things? What a waste.

3np 2y ago

Where does memory-hard Proof-of-Work fall on this triangle? (In the typical meaning of PoW, as opposed to human attention-work)

EVa5I7bHFq9mnYK 2y ago

Can't we have some kind of a crypto scheme, which proves to the web site I am a good boy, without revealing my identity and without enabling the website to link my current visit to my previous visits or to visits on other websites?