5 ms·

Breaking captcha is bad, mkay :)

by Goranek 14y ago

daeken 14y ago
No more so than finding security vulnerabilities. Captchas that are trivial to break are going to be broken no matter what, so it's better for someone non-malicious to break it and make it well known, so that people don't use the captcha, than for it to go unnoticed.
hcarvalhoalves 14y ago
If you're using a CAPTCHA, you're doing it wrong already.
- brownbat 14y ago
  Yeah, all these CAPTCHA stories are definitely making me think there's no refuge left of simple tasks humans can do that machines can't. What's the replacement? Tying every account to a mobile phone or credit card?
  - hcarvalhoalves 14y ago
    The thing is, CAPTCHAs are used to validate it's a human operating the interface, not a robot. That's a stupid idea, based on some weird assumption that it's somehow safe to give access to your system for a user, but not for a robot. If the only thing stopping people from messing your system is automation, you should rethink it from the get go.
    - brownbat 14y ago
      > weird assumption that it's somehow safe to give access to your system for a user, but not for a robot. Nice point. > If the only thing stopping people from messing your system is automation, you should rethink it from the get go. Are there systems that can't be abused through automation, or where that's much less of a concern? (Serious question, not intended as snark.) Maybe throttling activity is a better approach... it's volume that is harmful to the system, not interactions with programs per se. Don't know how you throttle spammers distributing activity across a number of accounts and IP addresses though...
      - hcarvalhoalves 14y ago
        > Are there systems that can't be abused through automation, or where that's much less of a concern? Let's analyze. One place CAPTCHA has been used a lot is in comment forms. It increases the opportunity cost of posting a comment via automation by introducing a complicated challenge. Fair enough. But that doesn't solve the underlying problem (abusive comments). You'll still have abuse and spam, it will just come from humans instead of robots. If I'm a blackhat SEO with a budget, I pay people to solve CAPTCHAs all day and spam the internet (that's what happens). If you design the comment system to fight abuse from the ground up (e.g., markov chain spam filters, user flagging), you don't need to care anymore wether it's a human or a robot behind the POST, because all the spam actually improves your training set. You defeat spammers with their own data.

Breaking captcha is bad, mkay :)

by Goranek 14y ago

Breaking captcha is bad, mkay :)

No more so than finding security vulnerabilities. Captchas that are trivial to break are going to be broken no matter what, so it's better for someone non-malicious to break it and make it well known, so that people don't use the captcha, than for it to go unnoticed.

hcarvalhoalves 14y ago

If you're using a CAPTCHA, you're doing it wrong already.

brownbat 14y ago
Yeah, all these CAPTCHA stories are definitely making me think there's no refuge left of simple tasks humans can do that machines can't. What's the replacement? Tying every account to a mobile phone or credit card?
- hcarvalhoalves 14y ago
  The thing is, CAPTCHAs are used to validate it's a human operating the interface, not a robot. That's a stupid idea, based on some weird assumption that it's somehow safe to give access to your system for a user, but not for a robot. If the only thing stopping people from messing your system is automation, you should rethink it from the get go.
  - brownbat 14y ago
    > weird assumption that it's somehow safe to give access to your system for a user, but not for a robot. Nice point. > If the only thing stopping people from messing your system is automation, you should rethink it from the get go. Are there systems that can't be abused through automation, or where that's much less of a concern? (Serious question, not intended as snark.) Maybe throttling activity is a better approach... it's volume that is harmful to the system, not interactions with programs per se. Don't know how you throttle spammers distributing activity across a number of accounts and IP addresses though...
    - hcarvalhoalves 14y ago
      > Are there systems that can't be abused through automation, or where that's much less of a concern? Let's analyze. One place CAPTCHA has been used a lot is in comment forms. It increases the opportunity cost of posting a comment via automation by introducing a complicated challenge. Fair enough. But that doesn't solve the underlying problem (abusive comments). You'll still have abuse and spam, it will just come from humans instead of robots. If I'm a blackhat SEO with a budget, I pay people to solve CAPTCHAs all day and spam the internet (that's what happens). If you design the comment system to fight abuse from the ground up (e.g., markov chain spam filters, user flagging), you don't need to care anymore wether it's a human or a robot behind the POST, because all the spam actually improves your training set. You defeat spammers with their own data.