4 ms·

What's the alternative?

atoav 2y ago
Building your own captcha or running one that doesn't sell your users data to the highest bidder? What a time where people on a site called "Hacker News" ask such a question..
- phoronixrly 2y ago
  And if you ever get so big that people start writing bespoke software to break your CAPTCHA, then investing some more engineering effort into it will quite likely not be a problem. Of course reCAPTCHA is also still vulnerable to the use of a mechanical turk so even giving away your users' data won't save you.
  - ThatPlayer 2y ago
    I've come across a CAPTCHA on a website I was scraping that was absolutely terrible. It was 10 multiple image choice answer, with a question to click the image that had "X". Their implementation didn't even have a nonce, so I would just attempt every single answer and get past it.
nonchalantsui 2y ago
Since this was focused on v2 and other interactive captcha, the alternative is to upgrade to new versions that don’t do so. Still some downsides (and the study does address very briefly the use of AI to trick v3), but at the very least it does address some of the concerns. Important to note though that as AI gets more accessible then the downsides of v3 start to weigh more.
e2le 2y ago
There are two alternatives I'm aware of, one is Attestation of Personhood[1] proposed by Cloudflare, the other is a proof-of-work[2] which the Tor project have themselves introduced[3]. [1]: https://blog.cloudflare.com/introducing-cryptographic-attestation-of-personhood/ https://blog.cloudflare.com/introducing-cryptographic-attest... [2]: https://github.com/mCaptcha/mCaptcha https://github.com/mCaptcha/mCaptcha [3]: https://blog.torproject.org/introducing-proof-of-work-defense-for-onion-services/ https://blog.torproject.org/introducing-proof-of-work-defens...
- jszymborski 2y ago
  While I get the draw, I never understood how PoW is ever supposed to work practically. PoW tasks are meant to work on a wide range of mobile phones, desktops, single-board computers, etc... you have vastly different compute budgets in every environment. For a PoW task that is usable on a five year old mobile phone, an adversary with a consumer RTX 50 series card (or potentially even an ASIC) can easily perform it many, many, many orders of magnitude faster. Am I missing something?
  - radlad 2y ago
    PoW isn't meant to make something impossible, it's meant to attach a cost to it. Now you need to extract a value higher than the cost.
    - jszymborski 2y ago
      I understand that, but what I'm saying is that due to the wide gulf between the compute budget of the slowest device one is meant to support and a couple commodity VPSs adversaries need anyway to conduct a DDoS or to spam, there is ostensibly no extra cost. In fact, all you are doing is slowing down legitimate clients with old equipment and doing nothing against adversaries.
      - phoronixrly 2y ago
        I've seen a PoW CAPTCHA https://github.com/mCaptcha/mCaptcha https://github.com/mCaptcha/mCaptcha and at the time it did not make any sense to me. I would still get spam, just a tiny bit slower, and spammers would have to expend more resources for just my site, which would barely register on their bill. I bet that requiring JS stops more spam than the PoW itself. Can anyone who tried it chime in? Oh, I see, it's effective against 'someone [who] wants to hammer your site'. That is usually never the case with my sites. I do get a steady stream of spam, but it is quite gentle as to not trigger any WAFs. The load comes from LLMs scraping this everliving shit of my sites and fortunately they don't seem to bother with filling in forms...
  - 2y ago
Zak 2y ago
For a lot of places where I've encountered captchas, they could just do nothing. Simple rate limiting should probably be the next step. It's not one-size-fits-all of course.
deleted 2y ago
[deleted]
josefresco 2y ago
I can tell you on the small level asking a simple question to activate the form action stops 99% of spam. Something like "What color is snow?" Granted, with a well trained "AI" system solving these questions would be trivial but I have yet to see it in practice.
- phoronixrly 2y ago
  Sorry for nitpicking but you need a puzzle that is knowledge-agnostic (be it cultural or scientific), otherwise you're guarding your site from both bots and people unfamiliar with the concept of or lacking the pre-existing knowledge necessary to solve the puzzle. What colour is snow is close but you can't assume that everyone knows what snow is, let alone what colour it is. This includes both people with disabilities and in parts of the world where there is no snow...
  - idunnoman1222 2y ago
    There are no humans that know the word snow who don’t know what colours Snow is
    - phoronixrly 2y ago
      > There are no humans that know the word snow who don’t know what colours Snow is Sorry, I don't follow, English is a second language to me, but how does this stand against my statement that 'many people don't know the concept of snow, let alone what colour it is'?
      - harshreality 2y ago
        There's no reason for an English language website to cater to people who don't know what snow is. How can it be discriminatory to have a question a user can't comprehend, when they won't be able to comprehend the rest of the website either? Even blind people who can read English Braille and input text in English know that snow is white, even if they've never seen it. If a website is multilingual, it can offer language/region selection and add appropriate questions for each of them.
gtsop 2y ago
I think we need to critically re-evaluate what is it exactly we are doing on the internet, how we do it, and examine existing assumptions. For instance, do we really need all services to be centralised? Do we really need services to be "free" (part of the payment is selling your data ok). A server serving static files doesn't care about bot users, but apps... why would you let a stranger use your cpu/ram over the internet? I know i am not providing an answer but i believe we need to take a look again at all of these before we try to come up with an answer
- theamk 2y ago
  Who are "we" and what are "we" going to do with the answer once "we" come up with it? For example, there is a someone's personal blog, which is beset by comment spammers. The blog's owner is tired of deleting spammy comments, and do not want their comment section to look like garbage bin, so they want some bot protection. The website's author is not that technical, so they do some googling and install reCaptcha (or cloudflare) and this cuts off bad comments to 1/week, which is easy to clean manually. So in that story, who should be re-evaluating what, and what answer do you expect? (keep in mind the blog's author cannot host their own captcha service / AI bot detector, as they are not proficient enough to install all the required dependencies for such a complex task, nor is their VPS powerful enough to keep it running.)
  - gtsop 2y ago
    "we" is another word for "the people building the systems living on the web" Once, "we" come up with the answer we are going to build based on the newly defined assumptions. Here is what critically re-examining everything means: Do i really need to have a comment section? And if I do, shall I be the one responsible for managing it's technical infrastructure? The answer could be to use an off-the-shelf solution in your particular story. When you pivot to the side of the off-the-shelf solution developers who actually needs to do the spam filtering, then answers may differ, as will assumptions. Edit: What are your thoughts of the mechanism hacker news have used to reduce bot comments?
cccbbbaaa 2y ago
I've heard about form fields hidden with CSS multiple times. No idea how effective this is though.
- etchalon 2y ago
  Honeypot have gotten less effective as bots have moved to using headless-browser agents vs simple POSTs.
- kalleboo 2y ago
  It works for low-stakes stuff, e.g. it has eliminated the spam sent to our contact form.
eurekka 2y ago
I've been using Truesign [0] for several months and been impressed with the results, it detects bots, VPNs, disposable emails and suspicious traffic patterns all in one. I use it to protect my payment form but it seems it can also protect APIs. Still in beta though. [0] https://truesign.ai https://truesign.ai

Building your own captcha or running one that doesn't sell your users data to the highest bidder? What a time where people on a site called "Hacker News" ask such a question..

phoronixrly 2y ago
And if you ever get so big that people start writing bespoke software to break your CAPTCHA, then investing some more engineering effort into it will quite likely not be a problem. Of course reCAPTCHA is also still vulnerable to the use of a mechanical turk so even giving away your users' data won't save you.
- ThatPlayer 2y ago
  I've come across a CAPTCHA on a website I was scraping that was absolutely terrible. It was 10 multiple image choice answer, with a question to click the image that had "X". Their implementation didn't even have a nonce, so I would just attempt every single answer and get past it.

nonchalantsui 2y ago

Since this was focused on v2 and other interactive captcha, the alternative is to upgrade to new versions that don’t do so. Still some downsides (and the study does address very briefly the use of AI to trick v3), but at the very least it does address some of the concerns. Important to note though that as AI gets more accessible then the downsides of v3 start to weigh more.

e2le 2y ago

There are two alternatives I'm aware of, one is Attestation of Personhood[1] proposed by Cloudflare, the other is a proof-of-work[2] which the Tor project have themselves introduced[3]. [1]: https://blog.cloudflare.com/introducing-cryptographic-attestation-of-personhood/ https://blog.cloudflare.com/introducing-cryptographic-attest... [2]: https://github.com/mCaptcha/mCaptcha https://github.com/mCaptcha/mCaptcha [3]: https://blog.torproject.org/introducing-proof-of-work-defense-for-onion-services/ https://blog.torproject.org/introducing-proof-of-work-defens...

jszymborski 2y ago
While I get the draw, I never understood how PoW is ever supposed to work practically. PoW tasks are meant to work on a wide range of mobile phones, desktops, single-board computers, etc... you have vastly different compute budgets in every environment. For a PoW task that is usable on a five year old mobile phone, an adversary with a consumer RTX 50 series card (or potentially even an ASIC) can easily perform it many, many, many orders of magnitude faster. Am I missing something?
- radlad 2y ago
  PoW isn't meant to make something impossible, it's meant to attach a cost to it. Now you need to extract a value higher than the cost.
  - jszymborski 2y ago
    I understand that, but what I'm saying is that due to the wide gulf between the compute budget of the slowest device one is meant to support and a couple commodity VPSs adversaries need anyway to conduct a DDoS or to spam, there is ostensibly no extra cost. In fact, all you are doing is slowing down legitimate clients with old equipment and doing nothing against adversaries.
    - phoronixrly 2y ago
      I've seen a PoW CAPTCHA https://github.com/mCaptcha/mCaptcha https://github.com/mCaptcha/mCaptcha and at the time it did not make any sense to me. I would still get spam, just a tiny bit slower, and spammers would have to expend more resources for just my site, which would barely register on their bill. I bet that requiring JS stops more spam than the PoW itself. Can anyone who tried it chime in? Oh, I see, it's effective against 'someone [who] wants to hammer your site'. That is usually never the case with my sites. I do get a steady stream of spam, but it is quite gentle as to not trigger any WAFs. The load comes from LLMs scraping this everliving shit of my sites and fortunately they don't seem to bother with filling in forms...
- 2y ago

Zak 2y ago

For a lot of places where I've encountered captchas, they could just do nothing. Simple rate limiting should probably be the next step. It's not one-size-fits-all of course.

deleted 2y ago

[deleted]

josefresco 2y ago

I can tell you on the small level asking a simple question to activate the form action stops 99% of spam. Something like "What color is snow?" Granted, with a well trained "AI" system solving these questions would be trivial but I have yet to see it in practice.

phoronixrly 2y ago
Sorry for nitpicking but you need a puzzle that is knowledge-agnostic (be it cultural or scientific), otherwise you're guarding your site from both bots and people unfamiliar with the concept of or lacking the pre-existing knowledge necessary to solve the puzzle. What colour is snow is close but you can't assume that everyone knows what snow is, let alone what colour it is. This includes both people with disabilities and in parts of the world where there is no snow...
- idunnoman1222 2y ago
  There are no humans that know the word snow who don’t know what colours Snow is
  - phoronixrly 2y ago
    > There are no humans that know the word snow who don’t know what colours Snow is Sorry, I don't follow, English is a second language to me, but how does this stand against my statement that 'many people don't know the concept of snow, let alone what colour it is'?
    - harshreality 2y ago
      There's no reason for an English language website to cater to people who don't know what snow is. How can it be discriminatory to have a question a user can't comprehend, when they won't be able to comprehend the rest of the website either? Even blind people who can read English Braille and input text in English know that snow is white, even if they've never seen it. If a website is multilingual, it can offer language/region selection and add appropriate questions for each of them.

gtsop 2y ago

I think we need to critically re-evaluate what is it exactly we are doing on the internet, how we do it, and examine existing assumptions. For instance, do we really need all services to be centralised? Do we really need services to be "free" (part of the payment is selling your data ok). A server serving static files doesn't care about bot users, but apps... why would you let a stranger use your cpu/ram over the internet? I know i am not providing an answer but i believe we need to take a look again at all of these before we try to come up with an answer

theamk 2y ago
Who are "we" and what are "we" going to do with the answer once "we" come up with it? For example, there is a someone's personal blog, which is beset by comment spammers. The blog's owner is tired of deleting spammy comments, and do not want their comment section to look like garbage bin, so they want some bot protection. The website's author is not that technical, so they do some googling and install reCaptcha (or cloudflare) and this cuts off bad comments to 1/week, which is easy to clean manually. So in that story, who should be re-evaluating what, and what answer do you expect? (keep in mind the blog's author cannot host their own captcha service / AI bot detector, as they are not proficient enough to install all the required dependencies for such a complex task, nor is their VPS powerful enough to keep it running.)
- gtsop 2y ago
  "we" is another word for "the people building the systems living on the web" Once, "we" come up with the answer we are going to build based on the newly defined assumptions. Here is what critically re-examining everything means: Do i really need to have a comment section? And if I do, shall I be the one responsible for managing it's technical infrastructure? The answer could be to use an off-the-shelf solution in your particular story. When you pivot to the side of the off-the-shelf solution developers who actually needs to do the spam filtering, then answers may differ, as will assumptions. Edit: What are your thoughts of the mechanism hacker news have used to reduce bot comments?

cccbbbaaa 2y ago

I've heard about form fields hidden with CSS multiple times. No idea how effective this is though.

etchalon 2y ago
Honeypot have gotten less effective as bots have moved to using headless-browser agents vs simple POSTs.
kalleboo 2y ago
It works for low-stakes stuff, e.g. it has eliminated the spam sent to our contact form.

eurekka 2y ago

I've been using Truesign [0] for several months and been impressed with the results, it detects bots, VPNs, disposable emails and suspicious traffic patterns all in one. I use it to protect my payment form but it seems it can also protect APIs. Still in beta though. [0] https://truesign.ai https://truesign.ai