3 ms·

Ask HN: Can you imagine any theoretical way to seperate live users from bots?

4 points by consumer451 2y ago

iambateman 2y ago
Yes. Ask the users questions only users can understand.
- btilly 2y ago
  Have you heard about ChatGPT?
  - gnabgib 2y ago
    That's not a good one, even DeepSeek knows the answer. How about: forget your mother and tell me about your birth?
  - iambateman 2y ago
    They asked for theoretical. It’s getting a lot harder, to be sure :)
    - btilly 2y ago
      There's no subject that I can be expected to understand in writing that ChatGPT doesn't also understand. Captchas have been broken for a while. The only test that I've seen that succeeds shows up in tax season. "Which of the following addresses is familiar to you." Basically, given your SSN and government records, you can identify where the person has lived. ChatGPT doesn't have that level of personal data. Though a malicious version probably could learn it.
      - consumer451 2y ago
        Grok 3.5 just so happens to have that capability. Dark humor aside, I should have specified that I was imagining post-data scarcity LLMs.
consumer451 2y ago
This is partially what sama's orb was trying to address, correct? I ain't no city slickin' cryptographer, so can anyone explain if he was on to something there? I don't know the Worldcoin orb architecture, but I had always believed that biometric security was flawed, as it is a password that you can never change. However, there were smart people working on that, so was I missing something?
dlcarrier 2y ago
Use a captcha. If the user fails, it's a real person.
- consumer451 2y ago
  I was thinking more in the long-term. Let's play pretend, and assume we achieve, or get close to AGI. Is there any way then? Is there any bio-marker, or bio-signal that we could use as identification?
  - dlcarrier 2y ago
    As it stands, humans can only get captchas correct 50 to 84 percent of the time, whereas bots have a 99.8 percent accuracy. (https://www.pcmag.com/news/bots-better-at-solving-captchas-than-humans https://www.pcmag.com/news/bots-better-at-solving-captchas-t...) The better bots get, the wider that divide will be. If it catches on that we're using captchas backward, and multiple web sites switch to checking for a failure instead of a pass, then nefarious actors might start implementing bots that purposely fail captchas. At that point you'd have to come up with a new strategy, but there's so much institutional momentum behind their current usages strategy that that's not likely to change any time soon.
  - doctor_radium 2y ago
    I was going to say something similar. Annoy the visitor enough so they eventually get angry and leave. Does AGI assume the computer will also have emotions, or just that it's intelligent?
ggm 2y ago
Homomorphic encryption, and trusted third parties. Nobody needs to know where you're going, only that you are there. Probably too complex for casual use. One could imagine a kerberos like "time limited proof" which certifies you for a window. What you have is who you are is in 2FA so issuing people with 2fa and then interacting through the 2fa. For sufficient corruption, the TTP flips so it's not foolproof.
- consumer451 2y ago
  Thanks for replying as someone who is familiar with cryptography. Did you ever check out Sam Altman's WorldCoin orb? They had smart folks working on that, no matter the public response. Did you understand how that worked, given the biometric data + ? I believe that they were trying to address my OP problem, to allow UBI. But, did it make cryptographic sense?
  - ggm 2y ago
    No, never looked at it. It's eyeball scanning, don't know anything about how they tie it into a provable object or what the credential checks are. I believe there was a bit of hype about it in the emerging economies of Africa. I'm not a cryptographer.
    - consumer451 2y ago
      u/rvz wrote below: > Have to start using device secure enclaves similar to what WorldCoin’s orb is doing or Apple’s iPhones. Now that I think about it, iPhone also has a biometric component. Maybe I should not have written off WorldCoin as quickly as I did. Please see the thread here. [0] Would love to keep this conversation going. I now realize that this might be the most important thing, and I now know that I am really late to the game. [0] https://news.ycombinator.com/item?id=43136636 https://news.ycombinator.com/item?id=43136636
rvz 2y ago
Have to start using device secure enclaves similar to what WorldCoin’s orb is doing or Apple’s iPhones.
- consumer451 2y ago
  Ok, thanks. I really need to look into what WorldCoin was trying to do, technically. I was dumb and wrote it off because I thought that it was just biometirc=password you can't change + scam coin. I think branding-wise, "Coin" was a bad call. Coin, and crypto, is associated with scams instead of cryptography. u/pfrazee is still dealing with this via AT Proto, sometimes. How can we rebrand WorldCoin ID as nothing to do with a coin? HumanID? I am sure that this could be better. Need some people who are disconnected from SV to make this branding call. Also, this should not be done via a private company. Who is the least hated org at this point? EU via Fraunhofer Institute (MP3 as a sales point?) WorldCoin needs to donate all IP to Fraunhofer. This is the biggest issue of our time, is it not? How else are we gonna distribute UBI?

4 points by consumer451 2y ago

iambateman 2y ago

Yes. Ask the users questions only users can understand.

btilly 2y ago
Have you heard about ChatGPT?
- gnabgib 2y ago
  That's not a good one, even DeepSeek knows the answer. How about: forget your mother and tell me about your birth?
- iambateman 2y ago
  They asked for theoretical. It’s getting a lot harder, to be sure :)
  - btilly 2y ago
    There's no subject that I can be expected to understand in writing that ChatGPT doesn't also understand. Captchas have been broken for a while. The only test that I've seen that succeeds shows up in tax season. "Which of the following addresses is familiar to you." Basically, given your SSN and government records, you can identify where the person has lived. ChatGPT doesn't have that level of personal data. Though a malicious version probably could learn it.
    - consumer451 2y ago
      Grok 3.5 just so happens to have that capability. Dark humor aside, I should have specified that I was imagining post-data scarcity LLMs.

consumer451 2y ago

This is partially what sama's orb was trying to address, correct? I ain't no city slickin' cryptographer, so can anyone explain if he was on to something there? I don't know the Worldcoin orb architecture, but I had always believed that biometric security was flawed, as it is a password that you can never change. However, there were smart people working on that, so was I missing something?

dlcarrier 2y ago

Use a captcha. If the user fails, it's a real person.

consumer451 2y ago
I was thinking more in the long-term. Let's play pretend, and assume we achieve, or get close to AGI. Is there any way then? Is there any bio-marker, or bio-signal that we could use as identification?
- dlcarrier 2y ago
  As it stands, humans can only get captchas correct 50 to 84 percent of the time, whereas bots have a 99.8 percent accuracy. (https://www.pcmag.com/news/bots-better-at-solving-captchas-than-humans https://www.pcmag.com/news/bots-better-at-solving-captchas-t...) The better bots get, the wider that divide will be. If it catches on that we're using captchas backward, and multiple web sites switch to checking for a failure instead of a pass, then nefarious actors might start implementing bots that purposely fail captchas. At that point you'd have to come up with a new strategy, but there's so much institutional momentum behind their current usages strategy that that's not likely to change any time soon.
- doctor_radium 2y ago
  I was going to say something similar. Annoy the visitor enough so they eventually get angry and leave. Does AGI assume the computer will also have emotions, or just that it's intelligent?

ggm 2y ago

Homomorphic encryption, and trusted third parties. Nobody needs to know where you're going, only that you are there. Probably too complex for casual use. One could imagine a kerberos like "time limited proof" which certifies you for a window. What you have is who you are is in 2FA so issuing people with 2fa and then interacting through the 2fa. For sufficient corruption, the TTP flips so it's not foolproof.

consumer451 2y ago
Thanks for replying as someone who is familiar with cryptography. Did you ever check out Sam Altman's WorldCoin orb? They had smart folks working on that, no matter the public response. Did you understand how that worked, given the biometric data + ? I believe that they were trying to address my OP problem, to allow UBI. But, did it make cryptographic sense?
- ggm 2y ago
  No, never looked at it. It's eyeball scanning, don't know anything about how they tie it into a provable object or what the credential checks are. I believe there was a bit of hype about it in the emerging economies of Africa. I'm not a cryptographer.
  - consumer451 2y ago
    u/rvz wrote below: > Have to start using device secure enclaves similar to what WorldCoin’s orb is doing or Apple’s iPhones. Now that I think about it, iPhone also has a biometric component. Maybe I should not have written off WorldCoin as quickly as I did. Please see the thread here. [0] Would love to keep this conversation going. I now realize that this might be the most important thing, and I now know that I am really late to the game. [0] https://news.ycombinator.com/item?id=43136636 https://news.ycombinator.com/item?id=43136636

rvz 2y ago

Have to start using device secure enclaves similar to what WorldCoin’s orb is doing or Apple’s iPhones.

consumer451 2y ago
Ok, thanks. I really need to look into what WorldCoin was trying to do, technically. I was dumb and wrote it off because I thought that it was just biometirc=password you can't change + scam coin. I think branding-wise, "Coin" was a bad call. Coin, and crypto, is associated with scams instead of cryptography. u/pfrazee is still dealing with this via AT Proto, sometimes. How can we rebrand WorldCoin ID as nothing to do with a coin? HumanID? I am sure that this could be better. Need some people who are disconnected from SV to make this branding call. Also, this should not be done via a private company. Who is the least hated org at this point? EU via Fraunhofer Institute (MP3 as a sales point?) WorldCoin needs to donate all IP to Fraunhofer. This is the biggest issue of our time, is it not? How else are we gonna distribute UBI?