Hacker News Reader

Comment by aphroz | Hacker News Reader

While proving you are a human becomes more and more difficult. And I am really tired of having to recognize cars, boats and bikes for every website I visit.

View on HN

You'd think that with the number of 'click all squares with traffic lights' type challenges we've had to endure, Waymo would be running entirely on camera feeds by now.

I take these tests very seriously, I don't want a car to crashes because I missed a traffic light.

systems also need noisy labels..

I intentionally mislabel one or two every time. It's not my job and not my responsibility to help someone recognize these, and they shouldn't be relying on internet strangers correctly labeling stuff for the security of our road systems.

I remember when Google was using it to digitize and publish freely available books and it felt like a useful, clever thing to do. Now it just feels like being a unpaid worker.

I remember when google was doing that and there were people exploiting it for both fun and profit.

On the "fun" side, a bunch of 4chaners were intentionally poisoning the results with swear words.

It's exactly how I feel whenever I am forced to use a self checkout line.

I've seen alot of comments along the lines that if you're not stealing when using self checkout lanes then you're being scammed. I'm a little swayed by the opinion, to be honest. It didn't used to be that there was only two lanes (out of 12) open during prime time shopping in all grocery stores, but it is now. Grocery stores found out they could just offload that part of the job onto customers for free.

I don't agree on that front. Checking out of the store is not automatically someone else's job - it's work that needs to be done for the relationship to be ethical. Just like people clean after themselves, they can also mark their own items and pay what is owed.

You're compensated with the time you would have had to spend waiting in line.

Versus the time I have to spend scanning and bagging my own goods, waiting for the attendant to come over and punch in some magic code every time the machine whacks out over the weight, getting a manager to come over and provide an override for coupons, or to purchase alcohol or tobacco? Yeah no, self-checkout lines are a special kind of hell.

Maybe the average HN'er doesn't do any serious grocery shopping, say to feed a large family, but there's no way I am taking a cart full of groceries to a self checkout line, I'd rather wait. Sure, for buying 10 items or less, they are OK.

I prefer cashiers who are paid well to do their jobs, rather than subsidizing companies that refuse to pay living wages and just threw in the towel. Try checking out an ALDIs sometime to see how truly blissful being rung up at their checkout lines are.

I would never attempt to ring up a $500 cart of groceries for feeding a family on my own. And I do buy those. Also, I generally prefer the cashier experience.

However, I do occasionally need to get just an item or two. If I'm at a store that has a self-checkout, it seems to be faster for that.

Also, the checkout at ALDI is an impressive demonstration of efficiency. CostCo seems to have a similar philosophy.

Myself included. Ill mislabel things that look like they could be, but are obviously not. If im asked to “Tag motorcyles” ill tag bikes as well.

Also, i dont want self driving cars. Not until all the social issues are resolved.

my man, you're bragging about being one of those social issues

Imagine if they waited for all social issues to be resolved before putting cars on the road in the first place, or if Uber waited for better laws, etc. It would have never happened. Putting something out there and getting people used to it before curmudgeonly beurocrats and other naysayers can catch up is the best way to do things in these cases.

Imagine [...] if Uber waited for better laws, etc. It would have never happened.

Ah… thanks for this second of imagination, that was some quality time.

Uber is one of the best things to happen to transportation in a long time, hemming and hawing about the pay or their practices aside.

I'm always happy when my intentionally-mislabeled solution is accepted. A lot get rejected.

Not to be a party pooper, but that’s part of their threat model. They expect some % of users to mislabel, intentionally or not.

To really cause problems, you would have to incentivize a large number of other web users to also mislabel the same images.

I'm under no false impressions - these dark patterns are used because they work. I still don't think it's good, I don't feel compelled to cooperate, and I certainly don't think we should consider that this is an acceptable way to conduct this type of work/research.

That’s a great bit :)

https://xkcd.com/1897/

Is the main purpose of these really to prove that you are human, or to improve their ML datasets?

Yeah, its actually for their dataset.

Whichever saves/makes them more money.

Neither. Nowadays it is only one part of a large scoring system using a bunch of device and user fingerprinting, and it's primary use seems to be tarpitting bots who score low on the other metrics (as well as any users unfortunate or privacy-conscious enough to be misidentified as a bot).

I'm pretty sure that's sufficiently shown by the fact that captcha v3 doesn't even have any inputs.

These days most sites do it by requiring a phone number. Since most countries require ID for a phone number and functional burner numbers are really hard to get, the system works well.

> functional burner numbers are really hard to get

For SMS verification at least there are quite a few sites dedicated to verify you for a few cents.

AFAIK they buy real prepaid sim cards and allow reuse by different customers on different sites.

But then anyone can reset your account’s password by using the same service?

Technically yes, practically there should be no way to know which account has which phone number.

The bigger problem is if the site requires you to re-verify your phone for whatever reason (for ex. paypal does when you access it from a strange IP or sth) and the number you used may not be available anymore.

> works well

For everyone except the user who now has no privacy, is trivially hacked by SMS interception, can’t create multiple accounts (e.g., to segregate their activities on a chat platform), ... .

^This when I run into a site that whats my phone number I simple don't bother anymore.

>can’t create multiple accounts

This is usually the intent of sms verification. I hate it just as much as you but I admit that there is no better method for preventing ban evasion. When accounts are trivial to create, moderators have no power.

> When accounts are trivial to create, moderators have no power.

Sounds ideal! Moderators are just power tripping gatekeepers. Community ranking of content is sufficient to get rid of trolls, spam…

Taking away people’s right to privacy just to empower moderators is quite dystopian.

Sms validation costs the spammer about 30c per validation. Maybe less in bulk. So it depends on how valuable the account is. A Nike snkrs account is worth 1-2$ so it’s still quite profitable

Do countries really require ID to get a phone number?

I can buy a prepaid sim card in our Hofer (=Aldi) for 2eur, no verification, no nothing,... they even have the same barcode on, so even Aldi does not know which is mine, and I can pay in cash. I can buy a refill there with cash too, but just to receive an sms, I don't need one, because receiving messages is free.

2€/account is still decent spam protection, and fair/affordable for a lot of the world population.

It's one thing the whole web can take out of the cryptocurrency transaction model. Costs can also be explicitly monetary and not just time-based through captchas.

Lots of countries do: https://blog.telegeography.com/liberty-vs-security-the-battl...

You also have to remember carriers will track the approximate position of a phone with an anonymously-purchased SIM-card, so better not take it home.

I know in Greece and many European countries you must show ID to get a SIM, nationals and foreigners alike.

Does the ID get recorded though?

If you went to a German Aldi on the other hand, they would let you buy a SIM, but before you can activate it you need to provide your personal information including a verification check that involves your Personalausweis in one way or another.

Does the ID get registered or do you just show it like when buying alcohol?

It is registered. The account is fully bound you.

I had to provide my Passport and submit to a check in order to buy a simcard while on vacation in Berlin.

It was a bit of a surprise as I flew through Heathrow and saw simcard packs in vending machines.

I tried to set up a web account with the IRS (the American tax bureau) the other day. My perfectly legitimate mobile number, which works with every other two-factor authentication, was not sufficient for the IRS. Apparently you have to have a number with a certain set of major cell phone service providers like ATT and Verizon, not a minor service provider. They also require half of a credit card number or some other financial identifier like a mortgage. I rather wonder if the cell phone service provider requirement has to do with adding more surveillance capabilities to the IRS' already impressive financial surveillance ability.

A few things ...

I had to set up a web account with the IRS in the recent past and I just skipped the entire mobile validation by having them send the auth code to my mailing address. It arrived in two days and worked perfectly. YMMV.

I am, however, interested in what mobile carrier you use that had a "real" (not VOIP) mobile number and can receive SMS from "short codes", but did not work with the IRS ?

That's unexpected - basically every mobile number in the US is one of the big three or an MVNO operating with one of the big three networks ... can you share just a bit more about your setup ?

Republic Wireless mobile numbers often look like voip because it's a MVNO run by Bandwidth.com (a large wholesale voip carrier). It's apparently in the process of being sold to Dish Wireless though, so that may change.

I think the IRS may have access to customer names associated with mobile phone accounts to confirm identity, but not all carriers have identity information for their customers, and I'd guess smaller carriers (or privacy focused carriers, if any exist) may not provide that access.

It's Xfinity mobile and can send and receive SMS from short codes including my banks, Amazon, etc. Also, I cannot use my mailing address for precisely the reason that I wanted to set up a web account: my accountant put the wrong city and zip code on all my tax returns (several EIN/TINs), and the IRS uses the address on the most recent filing for verification purposes.

How do we get all these spam calls in North America then?

VoIP

The phone company lets them put whatever number they want in their caller ID when they call you. It's a zero-security string. Receiving calls and texts doesn't work the same way.

The sites requiring a phone number are also now excluding VoIP known numbers such as Google Voice.

Problem. I don't have any other type of number. So while I added my older GV number to my Steam account, I can't update my number to my newer GV number because Valve won't accept non-LL or Cellular numbers for 2FA. So I have to keep a number I've changed from everywhere else... or not have a number on my account anymore.

> And I am really tired of having to recognize cars, boats and bikes for every website I visit.

And you are performing work without being compensated for it. In many countries this seems to be illegal - you have to pay at least a minimum wage.

I hate hcapcha. A bot can solve it in 2-3 seconds it takes me 5-6 i can’t keep up

I wonder how such countries' laws define "work". If my interactions with a website are used in an A/B test, am I an unpaid tester? If I sit in a restaurant in winter and the thermal radiation of my body saves them some of their heating costs, is that work that I should be paid for?

I'm curious why they collect fire hydrants. Is it important for self driving?

Reply on news.ycombinator.com