6 ms·

I do wonder if ProductHunt uses any CAPTCHA solution. In spite of the flack that CAPTCHAs usually get, I still think they have a lot of value in fighting the m

by imiric 2y ago

I do wonder if ProductHunt uses any CAPTCHA solution. In spite of the flack that CAPTCHAs usually get, I still think they have a lot of value in fighting the majority of these spam attacks. The common criticisms are: - They impact usability, accessibility and privacy. Users hate them, etc. These are all issues that can be improved. In the last few years there have been several CAPTCHAs that work without user input at all, and safeguard user privacy. - They're not good enough, sophisticated (AI) bots can easily bypass them, etc. Sure, but even traditional techniques are useful at stopping low-effort bots. Sophisticated ones can be fought with more advanced techniques, including ML. There are products on the market that do this as well. - They're ineffective against dedicated attackers using mechanical turks, etc. Well, sure, but these are entirely different attack methods. CAPTCHAs are meant to detect bots, and by definition, won't be effective against attackers who decide to use actual humans. Websites need different mechanisms to protect against that, but those are also edge cases and not the main cause of the spam we see today.

Terr_ 2y ago
Lately I've been pondering how one might create a "probably a human"/skin-in-the-game system. For example, imagine visiting an "attestor" site where you can make a one-time donation of $5 to a charity of your choice, and in exchange it gives you some proof-you-spent-money tokens. Those tokens can be spent (burned) by some collaborating site (e.g. HN) to mark your account there as likely a human, or at least a bot whose owner will feel pain if it is banned. This would be far more privacy-preserving that dozens of national-ID lookup systems, and despite the appearance of "money for speech" it could actually be _cheaper_ than whatever mix of time and bus-fare and paperwork in a "free" system. ____________ I imagine the big problems would be things like: * How to handle fraudulent payments, e.g. someone buying tokens with a stolen credit card. Easiest fix would be some long waiting-period before the token becomes usable. * How to protect against a fraudulent attestor site that just takes your money, or one whose tokens are value-less. * How to protect against a fraudulent destination site that secretly harvests your proof-token for its own use, as opposed to testing/burning it properly. Possible social fix: Put in a fake token, if the site "accepts" then you know it's misbehaving. * Handling decentralization, where multiple donation sites may be issuing their own tokens and multiple account-sites that may only want to support/trust a subset of those tokens.
- doctorpangloss 2y ago
  > Lately I've been pondering how one might create a "probably a human"/skin-in-the-game system. This has the same energy as the "we need benchmarks for LLMs" startups. Like sure it's obvious and you can imagine really complex cathedrals about it. But nobody wants that. They "just" want Apple and Google to provide access to the same APIs their apps and backends use, associating authentic phone activity with user accounts. You already get most of the way there by supporting iCloud login, which should illuminate to you what you are really asking for is to play outside of Apple's ecosystem, a totally different ask.
- tim333 2y ago
  There is the much slagged off but maybe effective Worldcoin.
  - LoganDark 2y ago
    Nothing like this or Worldcoin ever will be useful in any capacity for qualifying non-fraudsters, because fraudsters will have an infinite supply from people they tricked while non-fraudsters will only have what they've personally been given. So it'll basically do the opposite of what you want.
    - tim333 2y ago
      Worldcoin IDs are one per person and I've not heard of people tricked to give them away. Some have been bought for cash but there's a limit to how many of those will be available. In practice they are no good for verifying humans on blogs and the like though because only about 0.0003% of humans have one. But maybe something a bit like that that's easier to get?
      - LoganDark 2y ago
        > I've not heard of people tricked to give them away. People can be tricked to give anything away. > In practice they are no good for verifying humans on blogs and the like though because only about 0.0003% of humans have one. Even if every human had one it'd still be useless.
m463 2y ago
I wonder if this is like the recent article about people not buying from locked display cabinets: https://news.ycombinator.com/item?id=41630482 https://news.ycombinator.com/item?id=41630482 how many humans does captcha send away?
- imiric 2y ago
  You're thinking of the traditional CAPTCHA that requires an active effort from the user. Those do present a barrier to entry where some users give up. But there's a new breed of them that work behind the scenes and are transparent to the user. It's likely that by the time the user has finished interacting with the form, or with whatever is being protected, that the CAPTCHA has already determined whether the user is a bot or not. They only block the action if they have reasons to suspect the user is a bot, in which case they can show a more traditional puzzle. How effective this is depends on the implementation, but this approach has received good feedback from users and companies alike.
  - LorenPechtel 2y ago
    And all too often said systems call humans bots. Especially if you load a page in another tab while remaining on the page you were on.
    - imiric 2y ago
      I left a reply here[1] that also applies to your comment. [1]: https://news.ycombinator.com/item?id=41717214 https://news.ycombinator.com/item?id=41717214
class3shock 2y ago
As someone that already often runs into them due to vpn use being flagged please no more. Think about how much human time has been wasted on these things.
- imiric 2y ago
  The detection rules ultimately depend on each site. If you're using a VPN known to be the source of bot activity, you're likely being grouped with that traffic. Ideally the detection can be sophisticated enough to distinguish human users from bots based on other signals besides just their source IP, but sometimes this is not the case. All these usability issues are solvable. They're not a reason to believe that the problem of distinguishing bots from humans can't be approached in a better way.
- fryry 2y ago
  I was researching CAPTCHA solving services yesterday that run on cheap 3rd world labour. I couldn't imagine a worst job than solving them all day.
  - throwaway48476 2y ago
    It's an inherently repetitive task which makes it easy to automate with ML without requiring anything like AGI.
capitainenemo 2y ago
Annoyingly these captchas that apparently safeguard user privacy make websites completely unusable when using Firefox fingerprinting protection.
- imiric 2y ago
  I'm not claiming that these systems are perfect. Those edge cases should be resolved. But if we want the internet to remain usable, our best chance is to fight back and improve our bot detection methods, while also improving all the other shortcomings people have associated with CAPTCHAs. Both are solvable technical problems. The alternatives of annoying CAPTCHAs that don't work well, or no protection at all, are far worse in comparison.
  - capitainenemo 2y ago
    Well, so far it's being solved by fingerprinting everyone uniquely, and punishing people who use anti-fingerprinting with essentially unusable websites. So, the captcha is essentially window dressing.
    - imiric 2y ago
      I get that argument, as someone who uses those privacy-preserving methods. I've dealt with annoying CAPTCHAs for many years. The problem is that a CAPTCHA by definition is unable to do its job unless it can gather as much information as possible about the user. There are obvious privacy concerns here, but companies that operate under regulations like the GDPR are generally more conscious about this. So what should be the correct behavior if the CAPTCHA can't gather enough information? Should it default to assuming the user is a bot or a human? I think this decision should depend on each site, depending on how strict they want the behavior to be. So it's a configuration setting, rather than a CAPTCHA problem. In a broader sense, think about the implications of not using a CAPTCHA. The internet is overrun with bots; they comprise an estimated 36% of global traffic[1]. Cases like ProductHunt are not unique, and we see similar bot statistics everywhere else. These numbers will only increase as AI gets more accessible, making the current web practically unusable for humans. If you see a better alternative to CAPTCHAs I'd be happy to know about it, but to me it's clear that the path forward is for websites to detect who is or isn't a bot, and restrict access accordingly. So working on improving these tools, in both detection accuracy and UX, should be our main priority for mitigating this problem. [1]: https://investors.fastly.com/news/news-details/2024/New-Fastly-Threat-Research-Reveals-91-of-Cyberattacks-Targeted-Multiple-Organizations-Using-Mass-Scanning-to-Uncover-and-Exploit-Vulnerabilities/default.aspx https://investors.fastly.com/news/news-details/2024/New-Fast...
throwaway48476 2y ago
The problem is that website owners want to have their cake and eat it too. They want to make data public but not so public that it can be copied. It's the same problem as DRM which doesn't work. It's an inherent contradiction. Web devs also bloat the hell out of sites with MB of Javascript and overcomplicated design. It would be far cheaper to just have a static site and use CDN.
- imiric 2y ago
  CAPTCHAs can protect public resources as well. But the main problem here is about preventing generated spam content, not scraping. This can be mitigated by placing CAPTCHAs only on pages with signup/login and comment forms.
  - throwaway48476 2y ago
    >This can be mitigated by placing CAPTCHAs only on signup/login and comment forms. If only... Algorithmic turing test is a more interesting problem. https://xkcd.com/810/ https://xkcd.com/810/ Traditional captcha solving ability has already been surpassed by the bots which is now why there's so many new and creative different CAPTCHAs. Until someone trains a model to solve them that is.
    - imiric 2y ago
      It's a never-ending arms race. CAPTCHA services are improving just as the attackers are. Just because they're not 100% accurate or effective doesn't mean they're worthless. They're just the first line of defense.
      - pixl97 2y ago
        Just don't forget the scale doesn't stop at zero. They can be less than worthless and cost you actual humans visiting your site.
- kamray23 2y ago
  That'd be a nice way of looking at it, if serving content was cheap. It is not. I want to put my CV online, but I'm not willing to shill out tens of thousands every year to have it scraped for gigabytes per day. Doesn't happen, you say? Didn't before, definitely. Now there's so many scrapers building data sets that I've certainly had to block entire ranges of IPs due to repeated wasting of money. It's like the classic "little lambda thing" that someone posts on HN and finds a $2 million invoice in their inbox a couple weeks later. Except instead of going viral your achievements get mulched by AI.
nkrisc 2y ago
There's a nearly fool-proof solution: manually verify every submission. You can use automated systems as a first line of defense against spam, and then hire people to manually verify every submission that makes it through. You can even use that as opportunity to ensure a certain quality of submission, even if it was submitted by a person. Any legitimate submissions that get caught in the initial spam filter can use a manual appeal process (perhaps emailing and pleading their case which will go into a queue to be manually reviewed). Sure, it's not necessary easy and submissions may take some time to appear on the site, but there would be essentially zero spam and low-quality content.
- qup 2y ago
  The bots are commenting and voting, not submitting products.
- bitwizeshift 2y ago
  The article never talked about bot-generated products, only bot generated comments and upvotes. How does manual review address this exactly?
- mschuster91 2y ago
  > You can use automated systems as a first line of defense against spam, and then hire people to manually verify every submission that makes it through. You can even use that as opportunity to ensure a certain quality of submission, even if it was submitted by a person. The problem is, once you do manual upfront moderation, you lose a lot of the legal protections that UGC-hosting sites enjoy - manual approval means you are accepting the liability for anything that is published.
  - nkrisc 2y ago
    That's a good point, and perhaps a flaw in safe-harbor laws for UGC. It's a bit all or nothing, isn't it?
animal531 2y ago
Bots can apparently now beat 100% of road sign captchas, so unless if you can cycle them around its not going to do much.
a2128 2y ago
There is a whole industry of CAPTCHA solving services that mostly use humans in places where labor is cheap. Prices per reCAPTCHA vary somewhere between $0.001 to $0.002 on one of the popular ones. It doesn't require much sophistication to use it. For around $50/year you can spam a website with 100 comments per day, assuming it requires a CAPTCHA to be solved per comment. This pricetag may leave the average script kiddie out of the game, but if your spam is earning you money somehow then this becomes easily profitable. I don't believe these services are "edge cases"
- imiric 2y ago
  I'm aware of that, but CAPTCHAs are still a hurdle for most low-effort operations. I'm not so certain that ones using mechanical turks are not edge cases, since they would typically target the largest and most popular/profitable sites, and wouldn't bother with smaller websites. Besides, CAPTCHAs shouldn't be the only protection against spam. There should still be content moderation tools, whether they're automated or not, to protect when/if CAPTCHAs don't work. Larger websites should know this and have the resources to mitigate it. So saying that CAPTCHAs aren't worth it because they're not 100% accurate or effective is the wrong way of looking at this. They're just the first line of defense.
  - a2128 2y ago
    It's not about having to be 100% effective, it just has to be worth it considering the trade-off of introducing a hurdle for every legitimate user using your website. I would probably value my time, spent solving an annoying reCAPTCHA tapping on slowly fading pictures of what an American would consider a school bus before being asked to try again, more than a fraction of a cent. Of course reCAPTCHA probably considers me an edge case using Firefox with tracking protection and not being signed into Google, but it's just rude to require users to deal with this on a common basis. A local government website here requires me to solve a reCAPTCHA every time to view or refresh a timetable even though it's already locked behind an identity verification step involving logging in through my bank. It would be smart to put some sort of CAPTCHA or other verification step to a website when signing up with just an email, because otherwise the cost for someone to automate making a million accounts would be $0.00. But it should at least be properly implemented, I've run into websites that use the invisible reCAPTCHA v3 and when my Firefox browser inevitably fails the check, it doesn't even give me a challenge of any sort, just an error message and I can't sign up or even sign in to my previously made account. A literal hurdle I can't get past as a legitimate user. If I were a spammer though apparently it would only cost less than a quarter of a cent to get past it.
fastfuture 2y ago
[dead]
creer 2y ago
> These are all [CAPTCHA] issues that can be improved. No. This is not a new issue. The problems have been there for many years. You can't claim "working on it" - which is not even what you are claiming. By now, recognize that if the users themselves are fighting this crap or avoiding the sites and companies that use them, it's entirely deserved. By setting CAPTCHAs, you attack your users. (Witnessed in 2024, an insurance claims form which demands that a CAPTCHA be solved but shows no CAPTCHA. This crap is now so common it can now be used to delay insurance claims!)
- imiric 2y ago
  > You can't claim "working on it" - which is not even what you are claiming. I can, actually. :) I'm part of the team at https://friendlycaptcha.com/ https://friendlycaptcha.com/ and we agree that most CAPTCHAs suck. But we also believe that these issues can be improved, if not outright solved—at least the UX aspects. I was doing my best to avoid bringing up my employment, since these are my own opinions and I didn't want to promote anything, but I might as well mention that there are people working on this. There are similar solutions from Cloudflare, DataDome, and others. If you're having an annoying CAPTCHA experience in 2024, that's mostly due to the particular website choosing to use an annoying CAPTCHA implementation, or not configuring it properly. As I've said numerous times in this thread, distinguishing bots from humans will never be 100% accurate, but the alternative of not doing that is far worse. So we'll have to live with this if we want the internet to remain usable, and our efforts should be directed towards making it as painless as possible for actual humans.

by imiric 2y ago

Terr_ 2y ago

Lately I've been pondering how one might create a "probably a human"/skin-in-the-game system. For example, imagine visiting an "attestor" site where you can make a one-time donation of $5 to a charity of your choice, and in exchange it gives you some proof-you-spent-money tokens. Those tokens can be spent (burned) by some collaborating site (e.g. HN) to mark your account there as likely a human, or at least a bot whose owner will feel pain if it is banned. This would be far more privacy-preserving that dozens of national-ID lookup systems, and despite the appearance of "money for speech" it could actually be _cheaper_ than whatever mix of time and bus-fare and paperwork in a "free" system. ____________ I imagine the big problems would be things like: * How to handle fraudulent payments, e.g. someone buying tokens with a stolen credit card. Easiest fix would be some long waiting-period before the token becomes usable. * How to protect against a fraudulent attestor site that just takes your money, or one whose tokens are value-less. * How to protect against a fraudulent destination site that secretly harvests your proof-token for its own use, as opposed to testing/burning it properly. Possible social fix: Put in a fake token, if the site "accepts" then you know it's misbehaving. * Handling decentralization, where multiple donation sites may be issuing their own tokens and multiple account-sites that may only want to support/trust a subset of those tokens.

doctorpangloss 2y ago
> Lately I've been pondering how one might create a "probably a human"/skin-in-the-game system. This has the same energy as the "we need benchmarks for LLMs" startups. Like sure it's obvious and you can imagine really complex cathedrals about it. But nobody wants that. They "just" want Apple and Google to provide access to the same APIs their apps and backends use, associating authentic phone activity with user accounts. You already get most of the way there by supporting iCloud login, which should illuminate to you what you are really asking for is to play outside of Apple's ecosystem, a totally different ask.
tim333 2y ago
There is the much slagged off but maybe effective Worldcoin.
- LoganDark 2y ago
  Nothing like this or Worldcoin ever will be useful in any capacity for qualifying non-fraudsters, because fraudsters will have an infinite supply from people they tricked while non-fraudsters will only have what they've personally been given. So it'll basically do the opposite of what you want.
  - tim333 2y ago
    Worldcoin IDs are one per person and I've not heard of people tricked to give them away. Some have been bought for cash but there's a limit to how many of those will be available. In practice they are no good for verifying humans on blogs and the like though because only about 0.0003% of humans have one. But maybe something a bit like that that's easier to get?
    - LoganDark 2y ago
      > I've not heard of people tricked to give them away. People can be tricked to give anything away. > In practice they are no good for verifying humans on blogs and the like though because only about 0.0003% of humans have one. Even if every human had one it'd still be useless.

m463 2y ago

I wonder if this is like the recent article about people not buying from locked display cabinets: https://news.ycombinator.com/item?id=41630482 https://news.ycombinator.com/item?id=41630482 how many humans does captcha send away?

imiric 2y ago
You're thinking of the traditional CAPTCHA that requires an active effort from the user. Those do present a barrier to entry where some users give up. But there's a new breed of them that work behind the scenes and are transparent to the user. It's likely that by the time the user has finished interacting with the form, or with whatever is being protected, that the CAPTCHA has already determined whether the user is a bot or not. They only block the action if they have reasons to suspect the user is a bot, in which case they can show a more traditional puzzle. How effective this is depends on the implementation, but this approach has received good feedback from users and companies alike.
- LorenPechtel 2y ago
  And all too often said systems call humans bots. Especially if you load a page in another tab while remaining on the page you were on.
  - imiric 2y ago
    I left a reply here[1] that also applies to your comment. [1]: https://news.ycombinator.com/item?id=41717214 https://news.ycombinator.com/item?id=41717214

class3shock 2y ago

As someone that already often runs into them due to vpn use being flagged please no more. Think about how much human time has been wasted on these things.

imiric 2y ago
The detection rules ultimately depend on each site. If you're using a VPN known to be the source of bot activity, you're likely being grouped with that traffic. Ideally the detection can be sophisticated enough to distinguish human users from bots based on other signals besides just their source IP, but sometimes this is not the case. All these usability issues are solvable. They're not a reason to believe that the problem of distinguishing bots from humans can't be approached in a better way.
fryry 2y ago
I was researching CAPTCHA solving services yesterday that run on cheap 3rd world labour. I couldn't imagine a worst job than solving them all day.
- throwaway48476 2y ago
  It's an inherently repetitive task which makes it easy to automate with ML without requiring anything like AGI.

capitainenemo 2y ago

Annoyingly these captchas that apparently safeguard user privacy make websites completely unusable when using Firefox fingerprinting protection.

imiric 2y ago
I'm not claiming that these systems are perfect. Those edge cases should be resolved. But if we want the internet to remain usable, our best chance is to fight back and improve our bot detection methods, while also improving all the other shortcomings people have associated with CAPTCHAs. Both are solvable technical problems. The alternatives of annoying CAPTCHAs that don't work well, or no protection at all, are far worse in comparison.
- capitainenemo 2y ago
  Well, so far it's being solved by fingerprinting everyone uniquely, and punishing people who use anti-fingerprinting with essentially unusable websites. So, the captcha is essentially window dressing.
  - imiric 2y ago
    I get that argument, as someone who uses those privacy-preserving methods. I've dealt with annoying CAPTCHAs for many years. The problem is that a CAPTCHA by definition is unable to do its job unless it can gather as much information as possible about the user. There are obvious privacy concerns here, but companies that operate under regulations like the GDPR are generally more conscious about this. So what should be the correct behavior if the CAPTCHA can't gather enough information? Should it default to assuming the user is a bot or a human? I think this decision should depend on each site, depending on how strict they want the behavior to be. So it's a configuration setting, rather than a CAPTCHA problem. In a broader sense, think about the implications of not using a CAPTCHA. The internet is overrun with bots; they comprise an estimated 36% of global traffic[1]. Cases like ProductHunt are not unique, and we see similar bot statistics everywhere else. These numbers will only increase as AI gets more accessible, making the current web practically unusable for humans. If you see a better alternative to CAPTCHAs I'd be happy to know about it, but to me it's clear that the path forward is for websites to detect who is or isn't a bot, and restrict access accordingly. So working on improving these tools, in both detection accuracy and UX, should be our main priority for mitigating this problem. [1]: https://investors.fastly.com/news/news-details/2024/New-Fastly-Threat-Research-Reveals-91-of-Cyberattacks-Targeted-Multiple-Organizations-Using-Mass-Scanning-to-Uncover-and-Exploit-Vulnerabilities/default.aspx https://investors.fastly.com/news/news-details/2024/New-Fast...

throwaway48476 2y ago

The problem is that website owners want to have their cake and eat it too. They want to make data public but not so public that it can be copied. It's the same problem as DRM which doesn't work. It's an inherent contradiction. Web devs also bloat the hell out of sites with MB of Javascript and overcomplicated design. It would be far cheaper to just have a static site and use CDN.

imiric 2y ago
CAPTCHAs can protect public resources as well. But the main problem here is about preventing generated spam content, not scraping. This can be mitigated by placing CAPTCHAs only on pages with signup/login and comment forms.
- throwaway48476 2y ago
  >This can be mitigated by placing CAPTCHAs only on signup/login and comment forms. If only... Algorithmic turing test is a more interesting problem. https://xkcd.com/810/ https://xkcd.com/810/ Traditional captcha solving ability has already been surpassed by the bots which is now why there's so many new and creative different CAPTCHAs. Until someone trains a model to solve them that is.
  - imiric 2y ago
    It's a never-ending arms race. CAPTCHA services are improving just as the attackers are. Just because they're not 100% accurate or effective doesn't mean they're worthless. They're just the first line of defense.
    - pixl97 2y ago
      Just don't forget the scale doesn't stop at zero. They can be less than worthless and cost you actual humans visiting your site.
kamray23 2y ago
That'd be a nice way of looking at it, if serving content was cheap. It is not. I want to put my CV online, but I'm not willing to shill out tens of thousands every year to have it scraped for gigabytes per day. Doesn't happen, you say? Didn't before, definitely. Now there's so many scrapers building data sets that I've certainly had to block entire ranges of IPs due to repeated wasting of money. It's like the classic "little lambda thing" that someone posts on HN and finds a $2 million invoice in their inbox a couple weeks later. Except instead of going viral your achievements get mulched by AI.

nkrisc 2y ago

There's a nearly fool-proof solution: manually verify every submission. You can use automated systems as a first line of defense against spam, and then hire people to manually verify every submission that makes it through. You can even use that as opportunity to ensure a certain quality of submission, even if it was submitted by a person. Any legitimate submissions that get caught in the initial spam filter can use a manual appeal process (perhaps emailing and pleading their case which will go into a queue to be manually reviewed). Sure, it's not necessary easy and submissions may take some time to appear on the site, but there would be essentially zero spam and low-quality content.

qup 2y ago
The bots are commenting and voting, not submitting products.
bitwizeshift 2y ago
The article never talked about bot-generated products, only bot generated comments and upvotes. How does manual review address this exactly?
mschuster91 2y ago
> You can use automated systems as a first line of defense against spam, and then hire people to manually verify every submission that makes it through. You can even use that as opportunity to ensure a certain quality of submission, even if it was submitted by a person. The problem is, once you do manual upfront moderation, you lose a lot of the legal protections that UGC-hosting sites enjoy - manual approval means you are accepting the liability for anything that is published.
- nkrisc 2y ago
  That's a good point, and perhaps a flaw in safe-harbor laws for UGC. It's a bit all or nothing, isn't it?

animal531 2y ago

Bots can apparently now beat 100% of road sign captchas, so unless if you can cycle them around its not going to do much.

a2128 2y ago

There is a whole industry of CAPTCHA solving services that mostly use humans in places where labor is cheap. Prices per reCAPTCHA vary somewhere between $0.001 to $0.002 on one of the popular ones. It doesn't require much sophistication to use it. For around $50/year you can spam a website with 100 comments per day, assuming it requires a CAPTCHA to be solved per comment. This pricetag may leave the average script kiddie out of the game, but if your spam is earning you money somehow then this becomes easily profitable. I don't believe these services are "edge cases"

imiric 2y ago
I'm aware of that, but CAPTCHAs are still a hurdle for most low-effort operations. I'm not so certain that ones using mechanical turks are not edge cases, since they would typically target the largest and most popular/profitable sites, and wouldn't bother with smaller websites. Besides, CAPTCHAs shouldn't be the only protection against spam. There should still be content moderation tools, whether they're automated or not, to protect when/if CAPTCHAs don't work. Larger websites should know this and have the resources to mitigate it. So saying that CAPTCHAs aren't worth it because they're not 100% accurate or effective is the wrong way of looking at this. They're just the first line of defense.
- a2128 2y ago
  It's not about having to be 100% effective, it just has to be worth it considering the trade-off of introducing a hurdle for every legitimate user using your website. I would probably value my time, spent solving an annoying reCAPTCHA tapping on slowly fading pictures of what an American would consider a school bus before being asked to try again, more than a fraction of a cent. Of course reCAPTCHA probably considers me an edge case using Firefox with tracking protection and not being signed into Google, but it's just rude to require users to deal with this on a common basis. A local government website here requires me to solve a reCAPTCHA every time to view or refresh a timetable even though it's already locked behind an identity verification step involving logging in through my bank. It would be smart to put some sort of CAPTCHA or other verification step to a website when signing up with just an email, because otherwise the cost for someone to automate making a million accounts would be $0.00. But it should at least be properly implemented, I've run into websites that use the invisible reCAPTCHA v3 and when my Firefox browser inevitably fails the check, it doesn't even give me a challenge of any sort, just an error message and I can't sign up or even sign in to my previously made account. A literal hurdle I can't get past as a legitimate user. If I were a spammer though apparently it would only cost less than a quarter of a cent to get past it.

fastfuture 2y ago

[dead]

creer 2y ago

> These are all [CAPTCHA] issues that can be improved. No. This is not a new issue. The problems have been there for many years. You can't claim "working on it" - which is not even what you are claiming. By now, recognize that if the users themselves are fighting this crap or avoiding the sites and companies that use them, it's entirely deserved. By setting CAPTCHAs, you attack your users. (Witnessed in 2024, an insurance claims form which demands that a CAPTCHA be solved but shows no CAPTCHA. This crap is now so common it can now be used to delay insurance claims!)

imiric 2y ago
> You can't claim "working on it" - which is not even what you are claiming. I can, actually. :) I'm part of the team at https://friendlycaptcha.com/ https://friendlycaptcha.com/ and we agree that most CAPTCHAs suck. But we also believe that these issues can be improved, if not outright solved—at least the UX aspects. I was doing my best to avoid bringing up my employment, since these are my own opinions and I didn't want to promote anything, but I might as well mention that there are people working on this. There are similar solutions from Cloudflare, DataDome, and others. If you're having an annoying CAPTCHA experience in 2024, that's mostly due to the particular website choosing to use an annoying CAPTCHA implementation, or not configuring it properly. As I've said numerous times in this thread, distinguishing bots from humans will never be 100% accurate, but the alternative of not doing that is far worse. So we'll have to live with this if we want the internet to remain usable, and our efforts should be directed towards making it as painless as possible for actual humans.