4 ms·

Question for web devs - are captchas effective any more? If Reddit required a captcha on every comment, would it actually decrease bot comments?

by janice1999 5mo ago

tardedmeme 5mo ago
There's a reason Google is switching to "scan this QR code on your phone with a Google-authorized TPM" kind of CAPTCHAs
- janice1999 5mo ago
  I've never seen a CAPTCHA like that. What's it used for? Google Cloud services?
  - Havoc 5mo ago
    It's a reference to this I think https://www.androidauthority.com/google-recaptcha-play-services-requirement-3664806/ https://www.androidauthority.com/google-recaptcha-play-servi...
    - janice1999 5mo ago
      Wow, that's bad. Looks like the warnings about TPM and remote attestation being a backdoor to total digital lockdown from the Stallman contingent were right.
      - seanw444 5mo ago
        The tin foil hatters are always told they're making slippery slope fallacies until they're proven right a few years later. Over and over again.
        pocksuppet 5mo ago
        Sometimes. Other times they're just wrong.
        MSFT_Edging 5mo ago
        Even if they're wrong, erring on the side of caution will have a net positive effect in this case. It's like someone saying "hey this war with Iran might be based in lies, remember Iraq?" then someone saying "no its different this time" and eventually needing to backtrack. Many try to be the voice of caution, while others are too trusting and then try to pretend they were always against <Obvious lie and trick>. Just like how getting scammed on a crypto rugpull is shameful and prevents people from speaking out, getting scammed by another obvious national security lie or walled garden lie makes folks feel like fools too.
  - hurfdurf 5mo ago
    https://news.ycombinator.com/item?id=48039362 https://news.ycombinator.com/item?id=48039362 https://cloud.google.com/blog/products/identity-security/introducing-google-cloud-fraud-defense-the-next-evolution-of-recaptcha/ https://cloud.google.com/blog/products/identity-security/int...
  - layer8 5mo ago
    It’s only just been announced: https://news.ycombinator.com/item?id=48039362 https://news.ycombinator.com/item?id=48039362
  - tardedmeme 5mo ago
    Aaand it's proven, only two days later. You cannot pass recaptcha if your device is degoogled. https://news.ycombinator.com/item?id=48067119 https://news.ycombinator.com/item?id=48067119
mr_toad 5mo ago
> Question for web devs - are captchas effective any more? They’re effective at annoying humans. Driving traffic away from your site. Reducing conversation rates.
- krapp 5mo ago
  And training LLMs.
sunaookami 5mo ago
Speaking from experience hosting a MediaWiki with a ReCaptcha: Those were never effective, they didn't stop any bots. Switching to a personalized captcha with questions that have to be answered (that can mostly be answered from the Wiki itself) was more effective and stopped 100% of bots (of course it can be trivially bypassed when a site-specific bot is coded but no one does it and same is true for ReCaptcha).

Question for web devs - are captchas effective any more? If Reddit required a captcha on every comment, would it actually decrease bot comments?

tardedmeme 5mo ago

There's a reason Google is switching to "scan this QR code on your phone with a Google-authorized TPM" kind of CAPTCHAs

janice1999 5mo ago
I've never seen a CAPTCHA like that. What's it used for? Google Cloud services?
- Havoc 5mo ago
  It's a reference to this I think https://www.androidauthority.com/google-recaptcha-play-services-requirement-3664806/ https://www.androidauthority.com/google-recaptcha-play-servi...
  - janice1999 5mo ago
    Wow, that's bad. Looks like the warnings about TPM and remote attestation being a backdoor to total digital lockdown from the Stallman contingent were right.
    - seanw444 5mo ago
      The tin foil hatters are always told they're making slippery slope fallacies until they're proven right a few years later. Over and over again.
      - pocksuppet 5mo ago
        Sometimes. Other times they're just wrong.
        MSFT_Edging 5mo ago
        Even if they're wrong, erring on the side of caution will have a net positive effect in this case. It's like someone saying "hey this war with Iran might be based in lies, remember Iraq?" then someone saying "no its different this time" and eventually needing to backtrack. Many try to be the voice of caution, while others are too trusting and then try to pretend they were always against <Obvious lie and trick>. Just like how getting scammed on a crypto rugpull is shameful and prevents people from speaking out, getting scammed by another obvious national security lie or walled garden lie makes folks feel like fools too.
- hurfdurf 5mo ago
  https://news.ycombinator.com/item?id=48039362 https://news.ycombinator.com/item?id=48039362 https://cloud.google.com/blog/products/identity-security/introducing-google-cloud-fraud-defense-the-next-evolution-of-recaptcha/ https://cloud.google.com/blog/products/identity-security/int...
- layer8 5mo ago
  It’s only just been announced: https://news.ycombinator.com/item?id=48039362 https://news.ycombinator.com/item?id=48039362
- tardedmeme 5mo ago
  Aaand it's proven, only two days later. You cannot pass recaptcha if your device is degoogled. https://news.ycombinator.com/item?id=48067119 https://news.ycombinator.com/item?id=48067119

mr_toad 5mo ago

> Question for web devs - are captchas effective any more? They’re effective at annoying humans. Driving traffic away from your site. Reducing conversation rates.

krapp 5mo ago
And training LLMs.

sunaookami 5mo ago

Speaking from experience hosting a MediaWiki with a ReCaptcha: Those were never effective, they didn't stop any bots. Switching to a personalized captcha with questions that have to be answered (that can mostly be answered from the Wiki itself) was more effective and stopped 100% of bots (of course it can be trivially bypassed when a site-specific bot is coded but no one does it and same is true for ReCaptcha).