Hacker News Reader

Comment by juujian | Hacker News Reader

Do CAPTCHAs in practice really serve to perfectly tell apart humans or robots, or just to thwart the laziest attempt of abusing a website? Everyone knows that a door lock, no matter how good, can be overcome if you a really determined. But the lock still thwarts off opportunists. Yes, the goal when we first developed CAPTCHAs may have been to tell apart humans and robots. Realistically now, if CAPTCHAs can still significantly reduce the traffic from bots then companies will keep using them.

View on HN

The difference with a door lock is, even if you are sufficiently determined and have a way of defeating particular kinds of door lock with 95% confidence, that doesn't mean that you can instantly break into 95% of houses that use that lock, because you are one person with a physical body.

If bots that can break CAPTCHAs become widespread, the volume of spam, scams, and other junk traffic is going to cause problems for many people and small websites.

For a long time now CAPTCHAs only make bots more expensive. There are plenty of (human-staffed) services that will solve your captchas for $0.001-$0.005 per solved captcha. Better AI lowers the cost, but it's not necessarily a massive change of the status quo.

In a way that is silly:

Increase the cost of having bots do it, while...

...also increasing the time wasted by humans. Time which is considered much more costly/valuable than whatever $ value spent on the bots.

So maybe the time has come to regard captcha's pointless, and just drop that nonsense.

That was true of early captchas but Google changed it from 'wasting humans time' to 'using humans time to train their machine learning algorirhms'

about to say the same - but to be clear, it is "training computer vision models" a specific use of machine learning

The difference between zero and nearly zero can be pretty large at scale.

I would legitimately pay for this. I hate doing captchas and the internet seems to hate Firefox.

Solving the puzzle is only of the requirement to getting past captchas. For better or worse most captchas use IP(subnet) based rate limiting and cross site tracking as well, so the physical body argument holds in captchas as well. Try using the web inside free VPN or Tor and see if you can break captchas.

CAPTCHA is about more than spam.

Big Tech built their empires on scraping and stealing data (How do you think LinkedIn or Facebook got started?) But when we try to scrape them they throw a massive hissy fit, and so they put a lot of engineering into CAPTCHA systems to keep their data locked away. Eventually, the pinnacle of bots will be something that reads the framebuffer, and manipulates a mouse and keyboard to scrape websites.

This has got these companies freaked out, because all the founders know the dirty secret of their origin story, and that someone else can come along and do exactly the same thing to them.

(This, of course, isn't how LinkedIn or Facebook got started)

Don't know about LinkedIn, but aren't the roots of Facebook traced back to scraping pictures of women off of Harvard's website?

https://youtu.be/BPazh2kDdvA

Not necessarily, if the messages are analyzed there's usually an intent (solicitation, scam, etc.) so you can filter based on the content similar to email. The shorter lead forms without a message to analyze are a bit different since you can only go based on IP, email, phone but it's possible.

No, because bots that handle spam get better as well:

https://thespamchronicles.stavros.io/welcome/

I wonder if part of the solution is for us to start designing the Internet for bots. We're entering a phase where websites are coded by bots, content of all stripes (text/video/audio/images) is generated by bots, and increasingly that fact doesn't necessarily mean that we want to block it.

The main tenets of apps that are resilient to bot spam are 1) scalability, so that they can handle huge quantities of traffic and bot-generated content, and 2) the ability to differentiate high quality from low quality content (regardless of whether it was created by a human). Ironically, AI is probably the solution to the second problem.

I think what you’re proposing applies to good bots.

But the bots I wrote to get unfair advantages in auctions or tickets are probably of the kind most bots are.

> or just to thwart the laziest attempt of abusing a website

Thus the XKCD CAPTCHA: https://xkcd.com/810/

I’ve seen that one before, but I got a fresh laugh out of it.

We’ll have to change the game again now that bots can beat humans at it.

Reply on news.ycombinator.com