It's worse than that. It fingerprints the browser, the OS, and a ton of other stuff.
I'd love to see a solution that's privacy-friendly.
I'd love to see a solution that's privacy-friendly.
There are three major categories of bots: 1) a combinatoric attack hoping to get lucky with an answer 2) employ some amount of smarts to fool the captcha (fetching lots of images without answering anything until they are sure of the answer, replay attacks to mimic human behavior, perceptual hashing of images etc) 3) Anti-Captcha (using people to solve captchas).
We can mostly recognize the first two kinds of attacks, but it is very difficult to stop the anti-captcha humans -- especially without tracking as many features as possible. One of the chief issues with most captchas is that they do not provide epidemic analysis and a webhook/endpoint to inform sites about a user after the initial sign-up. This also requires some amount of user tracking to recognize malicious behavior and retroactively tag and act upon it. Monetizing human activity can somewhat offset costs associated with dealing with these networks of bad accounts later and using privacypass gives the user a mechanism to bypass tracking their activity while also pricing out malicious account signup using anti-captcha.
A privacy-respecting captcha used for monetization also opens up an entirely different opportunity for publishers, offering a lower friction experience for users who want to support online content without privacy invasive advertisements and paywalls.
In the case of Google tracking you, they have your personal information and they are using your activity to show you ads -- we don't have either of those aspects to our business model; so our tracking is essentially anonymous.
the absolute best you could do is track on the site itself without google, but you still need to track user's data.
anything else you can think of can be beaten pretty easily or is going to really hurt your user experience to the point of severe loss of revenue
any CAPTCHA custom to a site will be broken very easily if your business takes off.
For me, this is an interesting and open question. I've taken the view that as long as it's easier to come up with new types of challenges than it is to create an automated means to solve those challenges, CAPTCHAs offer some protection. If you're ok with requiring JavaScript, mouse input, and images (e.g. you don't require your site to be accessible by sight-impaired users who cannot use a mouse), I think people can come up with varied enough challenges to present a problem to bots. How long will that be the case? I don't know.
Botters aren't just making passive income, they can fix their bot every day as long as it's making them money. Many sites try "random" questions which are really easy to pattern match with a little regex.
The amount of effort that goes into botting generally scales linearly with userbase size (not always). But once you're talking about a botter with a profit motive when your site has hundreds of thousands or millions of MAU, I think trying to come up with challenges to beat botters would be prohibitively time consuming.
> I think trying to come up with challenges to beat botters would be prohibitively time consuming.
I agree that is challenging, and I think this question will need to be settled empirically. Sub-questions include:
a) What is the threshold for bot operators to engineer custom CAPTCHA solutions? (e.g. for a large website, how much can a bot network make?)
b) Even if it were not possible to conclusively beat the bots, what is the threshold at which bot operators decide that they would rather make their money off of other sites instead?