4 ms·

I absolutely refuse to use BigTech gatekeepers or useless CAPTCHAS (any sufficiently advanced bot can get around any CAPTCHA anyway). We solved this at our star

I absolutely refuse to use BigTech gatekeepers or useless CAPTCHAS (any sufficiently advanced bot can get around any CAPTCHA anyway). We solved this at our startup by running names through a simple LLM filter - if the name is gibberish like Px2846skxojw just block the signup. Worked surprisingly well. Of course this is easy to get around if the bot knows what you’re doing. But bots look for easy targets, as long as there are enough vibe coded crap targets on the internet they’re not going to bother with circumventing a carefully designed app.

mads_quist 7mo ago
Nice.
tholm 7mo ago
Using an LLM for this seems excessive when there are well established algorithms for detecting high entropy strings.
- znnajdla 7mo ago
  The high entropy string option led to lots of false positives. The LLM check seems to work fine with no complaints from real users.
snowe2010 7mo ago
Then you’re also blocking legitimate users that don’t want to be tracked and use services like iCloud Hide my Emails
- RobotToaster 7mo ago
  > that don’t want to be tracked >iCloud Except by apple I guess...
- rs_rs_rs_rs_rs 7mo ago
  Those users can take their business somewhere else.
imiric 7mo ago
So your solution is to deploy a black box that can be worked around with a basic lookup table for a single field? CAPTCHAs were never meant to work 100% of the time in all situations, or be the only security solution. They're meant to block lazy spammers and low-level attacks, but anyone with enough interest and resources can work around any CAPTCHA. This is certainly becoming cheaper and more accessible with the proliferation of "AI", but it doesn't mean that CAPTCHAs are inherently useless. They're part of a perpetual cat and mouse game. Like LLMs, they rely on probabilities that certain signals may indicate suspicious behavior. Sophisticated ones like Turnstile analyze a lot of data, likely using LLMs to detect pseudorandom keyboard input as well, so they would be far more effective than your bespoke solution. They're not perfect, and can have false positives, but this is unfortunately the price everyone has to pay for services to be available to legitimate users on the modern internet. I do share a concern that these services are given a lot of sensitive data which could potentially be abused for tracking users, advertising, etc., but there are OSS alternatives you can self-host that mitigate this.
steezeburger 7mo ago
This doesn't seem like a very good solution to be honest. And why use an LLM for this? What if I want a legit random ass string as my username?
- rs_rs_rs_rs_rs 7mo ago
  You're not owed anything, you can take your legit random ass string username to another company that allows it. I suspect any company would take this trade off, losing some customers but significantly lowering fraud.
  - bstsb 7mo ago
    then you have the bot picking Xbox-esque usernames like BluePanda72 instead
latexr 7mo ago
> useless CAPTCHAS (any sufficiently advanced bot can get around any CAPTCHA anyway). We solved this at our startup by (…). Of course this is easy to get around if the bot knows what you’re doing So, by your own admission, your solution doesn’t get around the “sufficiently advanced bot” problem.
- stanac 7mo ago
  I added custom captcha (simple math as slightly distorted pictures with audio alternative) on one of my forms, it prevents ~80% of spam submissions. less than 1% of spam passes, other ~20% are blocked on key words (like "sex", "passion", etc...).
  - latexr 7mo ago
    Not sure why you’re telling me that. I’m not criticising CAPTCHA, my parent comment was.
    - stanac 7mo ago
      I am just confirming that CAPTCHA still works against most basic bots.
- znnajdla 7mo ago
  Yes and I don’t claim to solve the problem completely. It’s an impossible to solve problem which BigTech wants you to pay mafia protection money to “solve”.
  - latexr 7mo ago
    The point I was making is that you’re criticising something while suggesting something else even easier to bypass.
avian 7mo ago
> We solved this at our startup by running names through a simple LLM filter - if the name is gibberish like Px2846skxojw just block the signup. I hope "LLM thinks your name is gibberish" won't become the new "your name can't include invalid characters".

mads_quist 7mo ago

Nice.

tholm 7mo ago

Using an LLM for this seems excessive when there are well established algorithms for detecting high entropy strings.

znnajdla 7mo ago
The high entropy string option led to lots of false positives. The LLM check seems to work fine with no complaints from real users.

snowe2010 7mo ago

Then you’re also blocking legitimate users that don’t want to be tracked and use services like iCloud Hide my Emails

RobotToaster 7mo ago
> that don’t want to be tracked >iCloud Except by apple I guess...
rs_rs_rs_rs_rs 7mo ago
Those users can take their business somewhere else.

imiric 7mo ago

So your solution is to deploy a black box that can be worked around with a basic lookup table for a single field? CAPTCHAs were never meant to work 100% of the time in all situations, or be the only security solution. They're meant to block lazy spammers and low-level attacks, but anyone with enough interest and resources can work around any CAPTCHA. This is certainly becoming cheaper and more accessible with the proliferation of "AI", but it doesn't mean that CAPTCHAs are inherently useless. They're part of a perpetual cat and mouse game. Like LLMs, they rely on probabilities that certain signals may indicate suspicious behavior. Sophisticated ones like Turnstile analyze a lot of data, likely using LLMs to detect pseudorandom keyboard input as well, so they would be far more effective than your bespoke solution. They're not perfect, and can have false positives, but this is unfortunately the price everyone has to pay for services to be available to legitimate users on the modern internet. I do share a concern that these services are given a lot of sensitive data which could potentially be abused for tracking users, advertising, etc., but there are OSS alternatives you can self-host that mitigate this.

steezeburger 7mo ago

This doesn't seem like a very good solution to be honest. And why use an LLM for this? What if I want a legit random ass string as my username?

rs_rs_rs_rs_rs 7mo ago
You're not owed anything, you can take your legit random ass string username to another company that allows it. I suspect any company would take this trade off, losing some customers but significantly lowering fraud.
- bstsb 7mo ago
  then you have the bot picking Xbox-esque usernames like BluePanda72 instead

latexr 7mo ago

> useless CAPTCHAS (any sufficiently advanced bot can get around any CAPTCHA anyway). We solved this at our startup by (…). Of course this is easy to get around if the bot knows what you’re doing So, by your own admission, your solution doesn’t get around the “sufficiently advanced bot” problem.

stanac 7mo ago
I added custom captcha (simple math as slightly distorted pictures with audio alternative) on one of my forms, it prevents ~80% of spam submissions. less than 1% of spam passes, other ~20% are blocked on key words (like "sex", "passion", etc...).
- latexr 7mo ago
  Not sure why you’re telling me that. I’m not criticising CAPTCHA, my parent comment was.
  - stanac 7mo ago
    I am just confirming that CAPTCHA still works against most basic bots.
znnajdla 7mo ago
Yes and I don’t claim to solve the problem completely. It’s an impossible to solve problem which BigTech wants you to pay mafia protection money to “solve”.
- latexr 7mo ago
  The point I was making is that you’re criticising something while suggesting something else even easier to bypass.

avian 7mo ago

> We solved this at our startup by running names through a simple LLM filter - if the name is gibberish like Px2846skxojw just block the signup. I hope "LLM thinks your name is gibberish" won't become the new "your name can't include invalid characters".