Hacker News Reader

Comment by kabacha | Hacker News Reader

You leave this implication that modern "hard-to-crack" Captchas are somehow different when in reality when reCaptcha and co are cracked to death and you can literally buy 5000 captcha solves for less than 5 USD.

Captchas in general are a bit of an illusion really. The best Captcha you can have is a home-made one as the attacker has to go through actual manual effort rather than enabling --solve-recaptcha flag on the bot script.

View on HN

I feel like there are orders of magnitude differences in cost and effort between “completely free because you downloaded a library” and “$5 per 5k and there’s a few HTTP requests in there too”

Is there though? Whom are you protecting yourself from? People who write curl scripts or serious attackers? Surely if someone wants to commit to an attack $5 is completely neglectible amount of money, right?

All you "protect" yourself from is casual script users and script kiddies which really can be solved by IP rate limit. If someone has access to thousands of IPs they can probably afford to drop $5 to solve the captchas too, right?

I think people who use CAPTCHAs know that they are protecting their site from script kiddies. Real attackers are going to find actual vulnerabilities to achieve much bigger damage than a script kiddie abusing the "comment" feature to write spam content, or otherwise making a large number of submissions for the webmaster to sift through.

> Is there though?

If there wasn’t, people wouldn’t use captchas

Having written code to bypass captchas, up to and including Google ReCaptcha: yes, there is a difference. A large difference.

$5 per request is not a negligible amount of money. In practice it doesn't cost anywhere near that amount to call a MechanicalTurk API which will solve ReCaptcha for you. But it's still significant for any nontrivial number of requests, such as in the use case of scraping.

You should adjust your priors here. You're focused on the narrow case where a win condition is achieved by spending n dollars to solve a single instance of ReCaptcha. People who use ReCaptcha are (in my professional experience) overwhelmingly more focused on requiring ReCaptcha to be solved for every individual request of a given type.

I have been in the position you speak of, where I had a revolving set of IP addresses, requesting servers and user agents, and $5 per request would have immediately shut my operation down. As it was, the actual ~$0.15 per request to solve ReCaptcha was sufficiently significant that I couldn't curate enough data for what I needed, despite having all the other resources you mention.

The cost mentioned upthread was $5 for 5000 requests, or 0.1 cent per request. Would that have allowed you to collect the data you wanted?

Possibly, I no longer do that work. But that was never the price I saw for the service. Cheapest I ever saw was still 10 times that, and requests frequently had to be resent due to spotty completion.

Seems like you really hadn't done your research. Deathbycaptcha has been around for probably a decade now and their rates were always something like $0.1 per captcha. That's not it though, captchas take profiles, so if you correctly configure your profiles then it becomes even less than $0.1 per solve as a profile might only get 1 captcha per 10 requests.

It's dead easy to get around captchas unless you're just a casual scripter that wants to `wget` that one article - then fuck that guy, right?

CAPTCHA is typically one of several defences, and you underestimate the cost they cause attackers. One of the main problems for an attacker is not really the dollar cost of buying a CAPTCHA solver, the real inconvenience is really the time it takes to solve on. The attackers go from less than a second to complete a request, to 30-60 seconds to complete a request, a significant slowdown.

Captchas are not "a bit of an illusion." In the past I ran very large, bespoke data mining campaigns, and ReCaptcha was continually a source of annoyance. My usual response to seeing ReCaptcha was to work on a different project or find a different dataset, because spending even a few cents per request to solve the captcha would make collecting the dataset unviable unless I was very certain it would pay off.

Reply on news.ycombinator.com