6 ms·

Remember that from hCaptcha's point of view, by this point they've probably dealt with hundreds of other people claiming that they are blind when they really ar

by jerf 2y ago

Remember that from hCaptcha's point of view, by this point they've probably dealt with hundreds of other people claiming that they are blind when they really aren't, so their bots will work. This isn't a defense, just an explanation... but it is also an explanation of why the entire idea of "we'll not give blind people a way past the CAPTCHA but just give a pass to 'real' blind people so we can pass ADA", which is that it should have been transparently obvious that this approach is completely infeasible and unscalable. As big as Google, Facebook, or Amazon are, they would struggle under the load of trying to create a system for determining who is "truly" blind... and that's still true if we ignore questions like exactly what "blind" is anyhow. This shouldn't have gotten deployed and then become a problem; it should have been a 5 minute diversion in the meeting where it was proposed to analyze it's completely infeasible and never made it to so much as the design phase, let alone the deployment phase. If you had a system for completely accurately identifying characteristics like "who is blind" in the presence of extremely hostile attacks on the system, you'd have something far more valuable than the CAPTCHA system itself! The whole idea intrinsically depends on having a stronger solution to the problems CAPTCHAs are meant to solve than the CAPTCHA system itself provides... it's fundamentally a logically unsound idea.

anotherhue 2y ago
> If you had a system for completely accurately identifying characteristics like "who is blind" in the presence of extremely hostile attacks on the system, you'd have something far more valuable than the CAPTCHA system itself! You are unfortunately describing worldcoin.
- KETHERCORTEX 2y ago
  Worldcoin? Government issued auth service is a viable option too. Just get some flag like "isBlind" in it. Disabled status is granted by the government after all.
Swizec 2y ago
> something far more valuable than the CAPTCHA system itsel In terms of CAPTCHAs being valuable – the other day I couldn’t for the life of me solve a captcha. It was one of those “Solve the implicit question in the picture” kind where it can be hard to tell what it’s even asking you to do. So I took a screenshot and put it in chatgpt. Got it right immediately. The real detection mechanism is that you’re moving your mouse, thinking, and generally being slower than a bot anyway. The captcha itself is just a pointless annoyance.
Workaccount2 2y ago
This is a problem so chronic across so many fields that I wish there was single term to describe it. User POV :"Wow, provider is a really shitty entity and had no respect for my legitimate problem." Provider POV: "We get a huge number of illegitimate claims identical to legitimate ones regularly, the system would collapse if we didn't do heavy triage, the problem is the level of abuse, not a moral bankruptcy on our part." I suppose "this is why we can't have nice things" captures some of it.
- RandomThoughts3 2y ago
  The actual problem is that Provider real POV is actually: "We already do the bare minimum required by the law and you are too insignificant to damage our reputation. It would actually cost our shareholders money to do more so please go die in silence somewhere else and stop bothering us. Replying to you costs us money too." This kind of article is actually useful because it raises the risk of actual reputational damage thus encouraging companies to do more.
- rwmj 2y ago
  This is just an indication that their process is wrong. (Or in this case, their entire reason to exist is wrong.)
- cwillu 2y ago
  “Moral bankruptcy” seems like a quite apt description of the state of affairs of being unable to afford to operate morally at a given level of scale. Scaling is not a right.
  - danaris 2y ago
    > Scaling is not a right. God I wish this could be plastered in letters 1000 feet high above Silicon Valley.
- account42 2y ago
  In cases like this the provider is someone I don't want to have any business with in the first place. I don't care how hard reliable CAPTCHAs are to implement and as a user I shouldn't have to.
michaelt 2y ago
> As big as Google, Facebook, or Amazon are, they would struggle under the load of trying to create a system for determining who is "truly" blind... and that's still true if we ignore questions like exactly what "blind" is anyhow. In several countries, the government issues certificates of blindness [1] which grant access to certain extra types of support. We don't want severely vision-impaired people being forced to drive, after all! So there are legal standards for what exactly blind is, and certificates. The question is whether tech companies are inclined to hire enough people to wrangle the paperwork involved in checking such certificates, worldwide. [1] https://www.mass.gov/info-details/benefits-for-people-who-are-legally-blind https://www.mass.gov/info-details/benefits-for-people-who-ar...
- inetknght 2y ago
  > So there are legal standards for what exactly blind is, and certificates. In the USA, people are not yet required to provide identification when signing up for "free" services. There are real concerns around privacy. A certification of blindness is exactly one of those privacy concerns, being a medical issue. You think it would be a good idea to give that private information to the criminal organizations of big tech?
  - Scarblac 2y ago
    These are already users that want to let the company know that they are blind in order to qualify for special treatment. In that case showing the certificate doesn't seem to be much of an extra privacy issue to me.
    - RobMurray 2y ago
      Accessibility isn't special treatment! As I said before I would never provide proof of identity to simply access a website.
      - kelnos 2y ago
        > Accessibility isn't special treatment! Perhaps not in all cases, but it can be. This article is literally about special treatment for accessibility purposes. It's of course debatable if this is how things should be, but that's another discussion.
RobMurray 2y ago
I am perfectly happy with having to prove that I am blind to get my bus pass, but if It was necessary to access a website I would just not use that site. Lets hope it never gets that bad. There's always Anticaptcha to fall back on, but I hate their business model.
miki123211 2y ago
What is your suggested alternative? Audio captchas are inherently discriminatory to those with hearing issues or those that don't speak the 5 supported languages. They're also somewhat easy to solve with ASR models now. Text captchas are incredibly easy to solve with LLMs. The only other alternative I see is some incredible tracking / surveillance machine (think an actual non-browser app that you have to run on your computer), but is that really what we want?
- jabroni_salad 2y ago
  I'm actually pretty okay with the zero click cloudflare dealios and prosopo PoW captchas. You can make websites that simply do not have visual puzzles on them at all. Every now and then turnstile does get a little borked but I can honestly say that I would rather just do without whatever I was trying to do than click 7 motorcycles. Hcaptcha and recaptcha are becoming my personal brown M&M indicator for additional bad user experiences in a given web property.

by jerf 2y ago

anotherhue 2y ago

> If you had a system for completely accurately identifying characteristics like "who is blind" in the presence of extremely hostile attacks on the system, you'd have something far more valuable than the CAPTCHA system itself! You are unfortunately describing worldcoin.

KETHERCORTEX 2y ago
Worldcoin? Government issued auth service is a viable option too. Just get some flag like "isBlind" in it. Disabled status is granted by the government after all.

Swizec 2y ago

> something far more valuable than the CAPTCHA system itsel In terms of CAPTCHAs being valuable – the other day I couldn’t for the life of me solve a captcha. It was one of those “Solve the implicit question in the picture” kind where it can be hard to tell what it’s even asking you to do. So I took a screenshot and put it in chatgpt. Got it right immediately. The real detection mechanism is that you’re moving your mouse, thinking, and generally being slower than a bot anyway. The captcha itself is just a pointless annoyance.

Workaccount2 2y ago

This is a problem so chronic across so many fields that I wish there was single term to describe it. User POV :"Wow, provider is a really shitty entity and had no respect for my legitimate problem." Provider POV: "We get a huge number of illegitimate claims identical to legitimate ones regularly, the system would collapse if we didn't do heavy triage, the problem is the level of abuse, not a moral bankruptcy on our part." I suppose "this is why we can't have nice things" captures some of it.

RandomThoughts3 2y ago
The actual problem is that Provider real POV is actually: "We already do the bare minimum required by the law and you are too insignificant to damage our reputation. It would actually cost our shareholders money to do more so please go die in silence somewhere else and stop bothering us. Replying to you costs us money too." This kind of article is actually useful because it raises the risk of actual reputational damage thus encouraging companies to do more.
rwmj 2y ago
This is just an indication that their process is wrong. (Or in this case, their entire reason to exist is wrong.)
cwillu 2y ago
“Moral bankruptcy” seems like a quite apt description of the state of affairs of being unable to afford to operate morally at a given level of scale. Scaling is not a right.
- danaris 2y ago
  > Scaling is not a right. God I wish this could be plastered in letters 1000 feet high above Silicon Valley.
account42 2y ago
In cases like this the provider is someone I don't want to have any business with in the first place. I don't care how hard reliable CAPTCHAs are to implement and as a user I shouldn't have to.

michaelt 2y ago

> As big as Google, Facebook, or Amazon are, they would struggle under the load of trying to create a system for determining who is "truly" blind... and that's still true if we ignore questions like exactly what "blind" is anyhow. In several countries, the government issues certificates of blindness [1] which grant access to certain extra types of support. We don't want severely vision-impaired people being forced to drive, after all! So there are legal standards for what exactly blind is, and certificates. The question is whether tech companies are inclined to hire enough people to wrangle the paperwork involved in checking such certificates, worldwide. [1] https://www.mass.gov/info-details/benefits-for-people-who-are-legally-blind https://www.mass.gov/info-details/benefits-for-people-who-ar...

inetknght 2y ago
> So there are legal standards for what exactly blind is, and certificates. In the USA, people are not yet required to provide identification when signing up for "free" services. There are real concerns around privacy. A certification of blindness is exactly one of those privacy concerns, being a medical issue. You think it would be a good idea to give that private information to the criminal organizations of big tech?
- Scarblac 2y ago
  These are already users that want to let the company know that they are blind in order to qualify for special treatment. In that case showing the certificate doesn't seem to be much of an extra privacy issue to me.
  - RobMurray 2y ago
    Accessibility isn't special treatment! As I said before I would never provide proof of identity to simply access a website.
    - kelnos 2y ago
      > Accessibility isn't special treatment! Perhaps not in all cases, but it can be. This article is literally about special treatment for accessibility purposes. It's of course debatable if this is how things should be, but that's another discussion.

RobMurray 2y ago

I am perfectly happy with having to prove that I am blind to get my bus pass, but if It was necessary to access a website I would just not use that site. Lets hope it never gets that bad. There's always Anticaptcha to fall back on, but I hate their business model.

miki123211 2y ago

What is your suggested alternative? Audio captchas are inherently discriminatory to those with hearing issues or those that don't speak the 5 supported languages. They're also somewhat easy to solve with ASR models now. Text captchas are incredibly easy to solve with LLMs. The only other alternative I see is some incredible tracking / surveillance machine (think an actual non-browser app that you have to run on your computer), but is that really what we want?

jabroni_salad 2y ago
I'm actually pretty okay with the zero click cloudflare dealios and prosopo PoW captchas. You can make websites that simply do not have visual puzzles on them at all. Every now and then turnstile does get a little borked but I can honestly say that I would rather just do without whatever I was trying to do than click 7 motorcycles. Hcaptcha and recaptcha are becoming my personal brown M&M indicator for additional bad user experiences in a given web property.