4 ms·
Why are captchas even a thing still? If folks want to scrape something or build an automation around something, then why not let them do it? They still have to
by isodev 2y ago
Why are captchas even a thing still?
If folks want to scrape something or build an automation around something, then why not let them do it? They still have to respect the system they're logging in. Not to mention the privacy perk of not exposing your visitors to some captcha service with a dozen or more data subprocessors.
- dewey 2y agoCaptchas are used for many things, and the reason they are still a thing is because they mostly work. Especially fingerprinting invisible captchas. Try having a login form without a captcha and you'll realize you are capturing 100s of users every day that require you to send out a "please confirm your email address" email for each of them for no good reason. > They still have to respect the system they're logging in. Your trust in people is admirable, but in my experience running anything on the internet you'll realize that intentionally or not people will bombard your system until it falls over.
- isodev 2y agoI think folks forget that we can add many of the safeguards a captchas provide as part of whatever "form serving app" is needed without torturing our visitors to prove they can count bicycles.
- dewey 2y agoI think the times of the "count bicycles" type of captcha are already counted just because of the bad user experience. Now everything is about fingerprinting, as paying to get captchas solved by humans or AI is already used everywhere if it's worth it.
- nraynaud 2y agothey don't work, robots have a higher speed and success rate than humans.
- dewey 2y agoNot everything is black and white. If it's cutting down 50% of the spam that does not have captcha solving robots because the effort is not worth it, that's already something. There's a reason many site still have very basic captchas...it's good enough for their use case.
- stanmancan 2y agoI had to add a captcha to a registration page a couple years ago. Bots were signing up for thousands of fake accounts with other people’s email addresses. The email confirmation we sent would then get reported as spam since the recipient didn’t sign up for our service. Our email provider suspended our account for high spam reports.
- Spivak 2y agoI hope the other lesson was the good email verification hygiene of making the user take an affirmative action and click a "verify email" button rather then send it unsolicited. You essentially had an open public unauthed form that would send an email to any address you typed in it. Surely that alone raises some eyebrows.
- toast0 2y agoHow do you authenticate a verify email button?
- klez 2y agoIt took me a while to understand what GP was trying to say, but I suppose they're thinking of one of those sites where they let you create an account, will let you in and then nag you for a while about "verifying your email address" by clicking a link that will actually send you an email. An unsophisticated spambot won't probably care enough to click through that.
- binarycoffee 2y agoNot a solution. Verification emails alone got a small web site I set up to be blacklisted within days. Most of the unwilling recipients presumably couldn't understand the language the verification email was written in and reported it as spam.
- stanmancan 2y agoHow would adding an extra button change anything? Right now when they register we send a “verify email address” email. Adding an extra step of “click a button” makes no meaningful difference.
- Nextgrid 2y agoBecause despite ZIRP being long over, there are still plenty of people/companies making money off "engagement" - aka wasting a human's time. Automation/scraping/etc would go around that.
- spacebanana7 2y agoThere're also more good faith use cases like stopping credit card testing, ticket reselling and forum spam.
- isodev 2y agoI feel folks forget that whatever captchas do (or a large portion of), can be a library without the need for a strange, inaccessible 3rd party service call.
- hifromwork 2y agoI assume you never tried to add a contact form to your website. Explanation: I did, and within a few days bots started sending me spam using that form. I just added a trivial captcha (hardcoded '2+3=' question), but if my scale was bigger that would be untenable. Think also of PM spam, autoregistering accounts to abuse free tiers, etc.
- Spivak 2y agoI guess I just wouldn't have an open unauthed form and require a CC to use the free-tier. The contact-me form can just be a mailto: link and let the spammers go through the spam filter like everyone else. There are places where captchas is all you can really do but it's not like common use-cases don't have other options.
- hluska 2y agoYou want to put a credit card form in front of a contact form?
- graemep 2y agoThere are less annoying alternatives. Things like honeypot fields are worked for me so far. There are more dynamic variations on your maths question.
- bongodongobob 2y agoIf you have any input forms they will be overrun by bots immediately. At my last job, marketing built a website and didn't tell IT. They had a "contact us" form without any kind of captcha. Took about a month to be completely flooded by bot spam.
- slightwinder 2y ago> Why are captchas even a thing still? Because it works, to some degree. It keeps away the annoying cheap bots and stupid kids. Smarter or more dedicated actors can still circumvent it, but even they are least slowed down to some degree. But thinking about, maybe just putting a 20 second pause after which you have to push a button might be already good enough for all this. And every stupid bot avoiding it will get banned.
- grishka 2y agoSimple distorted-characters captchas still do a good job of catching unsophisticated bots, which is most of them. They work even better when combined with hidden form fields because these bots don't support CSS. Targeted attacks though? You're making your legitimate users suffer only so that you defeat 99% of bots instead of 95%.