3 ms·

> Crawlers can’t parse the instructions What decade do you think it is? :) Depending on who you ask, captcha bots have become better at solving them than human

> Crawlers can’t parse the instructions What decade do you think it is? :) Depending on who you ask, captcha bots have become better at solving them than humans... There's almost nothing you can do that "AI" can't while keeping it easy enough for your average joe that wants to login. Especially considering "the grandma test"...

altairprime 1y ago
It’s trivial for them to solve this automatically. It’s also illegal under the computer fraud and abuse act, because then they’re knowingly and intentionally bypassing for profit (fraud) a clearly defined authorization barrier that explicitly prohibits their (ab)use. No joke, that’s an actual U.S. federal crime, and it would hold up well enough to reach a courtroom to be judged. (Can’t say what would happen after that — the law is not code, etc.) That’s why it’s so effective: it doesn’t matter that they can bypass it, it matters that they could be jailed if they do so, and corporations only take risks whose profits can pay for the penalties incurred. The cost of federal prison is well in excess of what most corporate leaders will tolerate :) ps. I learned assembly programming from my grandma. She would have loved to discuss this problem with me.
- fc417fc802 1y ago
  Just because it's called authentication doesn't mean that all possible applications of it qualify. Following directions provided by the owner isn't breaking into the system. Clicking "Yes I'm over 18" when you aren't isn't a violation of the CFAA any more than any other ToS violation is. What matters isn't the box presenting the challenge but rather the nature of the challenge itself.
  - altairprime 1y ago
    Perhaps! But for some weird reason, I bet you’ll find no one except e.g. Yandex is willing to code their AI scraper to attempt passwords at websites — because, as noted, only a courtroom can determine with certainty the exposure to legal risk here, and so long as usage isn’t widespread there’s no profit in accepting that risk.

altairprime 1y ago

It’s trivial for them to solve this automatically. It’s also illegal under the computer fraud and abuse act, because then they’re knowingly and intentionally bypassing for profit (fraud) a clearly defined authorization barrier that explicitly prohibits their (ab)use. No joke, that’s an actual U.S. federal crime, and it would hold up well enough to reach a courtroom to be judged. (Can’t say what would happen after that — the law is not code, etc.) That’s why it’s so effective: it doesn’t matter that they can bypass it, it matters that they could be jailed if they do so, and corporations only take risks whose profits can pay for the penalties incurred. The cost of federal prison is well in excess of what most corporate leaders will tolerate :) ps. I learned assembly programming from my grandma. She would have loved to discuss this problem with me.

fc417fc802 1y ago
Just because it's called authentication doesn't mean that all possible applications of it qualify. Following directions provided by the owner isn't breaking into the system. Clicking "Yes I'm over 18" when you aren't isn't a violation of the CFAA any more than any other ToS violation is. What matters isn't the box presenting the challenge but rather the nature of the challenge itself.
- altairprime 1y ago
  Perhaps! But for some weird reason, I bet you’ll find no one except e.g. Yandex is willing to code their AI scraper to attempt passwords at websites — because, as noted, only a courtroom can determine with certainty the exposure to legal risk here, and so long as usage isn’t widespread there’s no profit in accepting that risk.