Hacker News Reader

Hacker News

Comment by Scoundreller | Hacker News Reader

Parent Full thread

Scoundreller

> think of the captcha/ML rat race we are in

Google and my employer deal with massive amounts of spam emails and gets it right 99.9999999% of the time.

There’s a reason why Google captcha me on their own properties.

(It’s inexplicable why EBay captchas me AFTER I submit 2FA…)

We know who the bots are, but if you want your visitors to do some free work for my training models, so be it.

The captchas need some work though. If you want me to select all photos with carS, I’m not going to choose the photos with one car only.

View on HN

The problem with modern captchas, especially recaptcha, is that they're becoming increasingly annoying and require way too much attention and thinking. You literally have to work to prove you're a human. It's no longer one second you'd spend typing some crooked numbers, it could well be a minute or two clicking through crosswalks and traffic lights and storefronts because you had the nerve to block Google from following you around the internet. (is it even legal to make a website without Google Analytics any more?)

I have to do it every month to pay my electricity bill and I absolutely despise it.

On the other hand, I'm looking forward to the moment when AI/ML becomes good enough that there simply won't be a way to make a captcha that would reliably tell humans and machines apart.

> increasingly annoying and require way too much attention and thinking

Possible robot.

> my electricity bill

Probable robot.

> looking forward to the moment when... there simply won't be a way to make a captcha that would reliably tell humans and machines apart

Definite robot.

I think the fact that I'm a human leads them to giving me more captcha. One day a self-driving car is going to smash into a car and they're going to present to court that 52% of "humans" in 983475283475 captcha tests couldn't see it either.

> It’s inexplicable why EBay captchas me AFTER I submit 2FA…

Google does this too and it drives me nuts. What's makes it even more of a "fuck you" is they will do it to paying users, (business accounts)... if you refresh the page three times the captcha goes away, they are just trying their luck at using people for free ML training labour.

> The captchas need some work though. If you want me to select all photos with carS, I’m not going to choose the photos with one car only

If you're trying to get through these while spending the least amount of time on them, you want to answer "How would most people presented with this answer the following: _______ ?" as opposed to "What do you think is the most correct answer to the following ________ ?"

I know, it was an academic exercise. I wanted to see if the system would adapt or eventually accept me anyway. It did not.

So I bought the thing from another vendor.

> Google and my employer deal with massive amounts of spam emails and gets it right 99.9999999% of the time.

Emails are literal treasure troves of data and are easy to pull signals out of for determining spamminess. HTTP GET requests, on the other hand, aren't - and there's no way to associate them with other spam-connected properties (like you can with click-through domains in emails) besides by blocking entire IP ranges for the ASN not moderating their customer base.

I mean it's pretty easy. If you are seeing GET request in your logs for PHPadmin or Drupal URLs and you're not running those on your server, it's pretty clear they are up to no good and you can block that IP address.

That doesn't work well with CGNAT or VPNs/Tor. That's why the latter is captcha'd more often.

Pretty sure my IP+browser pairing hasn't changed in months. They know who I am.

Google spam filtering is much much less accurate than that, and it’s an easier problem.

agree - and was going to point out that blocking 99% is a shit metric if it also blocks 10% of non-spam - that's a super fail in my book - but most people don't know they are blocking legit mails - many don't check until I tell them on the phone that it's likely in the 'other box' - and they complain that google should not have done that and that they did not tell google to do that - meh.

Reply on news.ycombinator.com