Hacker News Reader

Comment by Zababa | Hacker News Reader

Being asked by a machine to prove that you are human is sometimes really humiliating, especially if you fail the captcha a few times in a row.

View on HN

My favorite is finding errors on their side. I was tasked with finding the parking meters, and being told I was missing one. The "one" was an image of a mailbox, not a parking meter. Selecting the mailbox allowed it to say I was a human

I think I got that exact same one, and had the exact same problem with it. Maybe reasoning that it was confusing the mailbox for a parking meter was how I proved that I was a human to it.

The reason this happens is that captchas are not localized. Most countries don't have mail boxes, only US, Canada, Australia, NZ have them so people from outside those countries may not think to distinguish mailboxes from parking meters and will just click every square that matches their mental model of a parking meter (a pole with something on top or a big box)

> Most countries don't have mail boxes (only US, Canada, Australia, NZ)

They do, they just look different. At least that's how it is in France.

They're not the same as the classic US mailbox (). In the US you can use such a mailbox to send mail as well. In Europe you typically have private letterboxes for incoming mail and big, public post boxes for sending.

> classic US mailbox ()

Missing link? In NZ, and presumably other countries, personal letterboxes in rural areas can be used to send too, which I'm guessing is the same as what you're referring to.

Yes NZ is one of the four countries that use this style of full duplex mailbox. It hasn't caught on outside US/CA/AU/NZ, probably because (speculating here) it's not secure against theft and doubles the workload for the mailman.

Darn, the parentheses originally contained a mailbox emoji but I forgot HN does not support them.

but that's not what the challenge is. it's more likely the database of training data is wrong. we've seen that to be very true from posts here on HN. some of the data was so horribly mis-identified, it's a wonder it works at all

Is a Bicycle a motorcycle? Will I kill one or the other by mis-categorizing it for the AI?

I mean, if we're just going to start saying "you know what I meant", then why use words that have meaning for anything?

Honestly, as a driver, when I see a bicycle, I make sure to provide as much room around them as possible. When I see a motorcycle from behind, I have no idea what the thought processes of the rider will be and just continue on in a straight line and allow them to make a decision. A bicycle in my rearview mirror poses no threat as they cannot keep up. A motorcycle can easily overtake in way ordinary cars cannot (between lanes, etc). They are much more difficult to predict. (not even taking into consideration the tendancy of motorcycle drivers being less risk averse).

So, if you want to teach the AI that a bicycle and a motorcycle are the same thing, then yes, you might inadvertantly lead to an AI making the wrong decision leading to a death. I wouldn't necessarily blame you for picking the wrong image in a captcha, but I'd definitely blame the devs for not sanitizing user input.

It's really hard to know sometimes which frames humans generally classify as 'bicycle' or 'traffic light'. The bottom third of a tire? The supporting pole of an extra set of signals in the background? I sometimes have no idea whose intelligence I'm supposed to emulate.

I’ve heard that before and I don’t really understand how people have so much trouble with this. But I guess knowing the rules helps me with this:

The machine doesn't know the answer so it doesn't really matter. You need to emulate the crowd and also realize you are contributing to the crowd. So you can actually pollute it with wrong answers to delay the robot uprising. Or at least cripple it when they keep running into fire hydrants they didn't see.

They can just use the data and see "50% of verified humans clicked this" and know that it is debatable or not obviously a match but not a verified not-match.

I understand why websites need to use captcha. I do not understand why websites that have user accounts cannot offer the option of 2FA TOTP, or even SMS login to avoid captcha.

Hilton.com is a big annoyance.

SMS is expensive.

It's less expensive than losing customers due to a bad UX.

But more measurable.

TOTP is free, and can simply be made an option to avoid CAPTCHA.

It's amazing that they still charge for something smaller than an average packet.

A bot can trivially generate TOTP tokens from a shared secret and receive/process incoming SMS to extract the code.

Then use the fact that I am a paying customer of Hilton’s for years to mark my account as a human. I have the Hilton credit card, I am a Diamond member, what else do they want?

I know why they force me though, I use content blockers on macOS and iOS to block tracking and ads, but that is not a good reason.

Can you share those content blockers? I recently acquired my first iOS device and have been suffering through the ads.

I use Wipr. Firefox Focus is a free one for iOS though.

Not who you asked, but I use Firefox Focus as a content blocker. Since iOS only has Safari and WebViews (Safari in different clothes), you enable content blockers by going to Settings > Safari > Content Blockers.

AdGuard is where it’s at on iOS.

I can think of few behaviours more human-like than using a content blocker. :)

I really hate giving my phone number to any service, especially since i might need a second account there, or they might sell my data (or get hacked).

I also hate sites that force you to do so... eg. twitter, where it decides it won't let you register without a phone number (making a new twitter account for a project), then won't allow you to use the phone number, because you already used it for your primary account.

Coincidentally I just made my first Twitter account. I can't remember the exact boxes you need to click but there is a way to sign up without giving out your phone number.

The issue is that it may flag your account as more suspicious. After three days I had my account flagged. I couldn't view tweets or use the account in any way. On log in it would redirect me and ask for my phone number for "verification". Funny how they can verify something they never received. It took about ten days for support to correct but my account is active again and they still don't know my phone number.

I don't understand why they need it when they've already accepted and verified a login request, just need captcha to finish it off? (i.e. you don't get the captcha with bad creds)

I mean, maybe I can see/accept an argument for that. But when I have a recent order? When I'm logging in from the link you just emailed me?

Sometimes I end up failing them deliberately. I can't boycott them because they're often in the way of important sites. So my small, practically invisible protest is to never click more than 3 times. If you want me to pick out all the bicycles, you better have 3 or less. I'm only clicking 3.

I fully understand this isn't going to have any effect. Maybe if a million of us were doing it, it would. But it still makes me feel better.

True civil disobedience would be clicking the non-bikes.

Back when captchas were about optical character recognition, it was obvious which words came from actual books. Plenty of people would input offensive words instead of the correct answer. I hope it had an effect but it probably didn't.

Someone who isn't me hung around on 4chan a lot back in the day. Indeed, there was an effort across the boards to disseminate heuristics to determine which one was the already-known word and which one was to be parsed by humans. The agreed-upon procedure was identify the latter as "penis".

> The agreed-upon procedure was identify the latter as "penis".

I remember far worse...

So you want us to DDoS the captcha networks? Hmm is that even legal? But it would be somewhat cool if millions of people starting failing captcha on purpose it would be something like decentralized volunteer mass ddos attack.

Wouldn't be a DDoS. At least, I don't think it would.

It would just be simply people refusing to work on captchas more than a certain amount. Basically, if you make me hunt for bikes and there's more than 3 of them, then I'm not doing it. More akin to a deliberate labor slowdown than a DDoS, or even a strike.

How do you know how many bikes are out there in total? And what is a purpose of a deliberate labor slowdown if you are going to get more captcha work if you do not finish your current one.

I mentioned DDOS because every time you fail to satisfy captcha criteria website requests a new batch of captcha for you; in that way you would be constantly requesting a new captcha if you would be deliberately failing your current one or as you described imposing a "hunt limit" upon yourself.

Good point on the DDOS. Didn't think of it that way.

> Being asked by a machine to prove that you are human is sometimes really humiliating

In a quite a few instances, I find it flattering, because it implies "we haven't sucked enough data on you already to know if you are a human, so we need to be sure."

I find it infuriating because it pits me against other people without explaining what the rules are.

If it says "select a sign" and I see there's also a sign far away in the distance only a few pixels in size, I select it because it is a sign. I think most people don't because I frequently get many tests after, because I'm not human enough for them.

It's actually a sign of bad ergonomics and disrespect for your time and effort. There are already sites that know you're human by your mouse/touch behaviour. Only if js is blocked do they need to resort to those ridiculous multi-level games they make you play.

My surprise if the sites that do those things turned out to be using humans for free labeling of images would be an exact, unsigned zero.

> Only if js is blocked do they need to resort to those ridiculous multi-level games they make you play.

In all fairness, i usually do that.

Reply on news.ycombinator.com