Ridiculous captcha at GitHub to reset your password | Hacker News Reader

Ridiculous captcha at GitHub to reset your password

github.com

115 pointsbecks_benny75 comments

You need to reset your password of your github account? Good luck with that, the captcha will screw you over.

There are 6 pictures with each having 4 dices. You have to add up the dice count and find the picture whose dice count is equal to 14. It starts with 5 rounds, but after that you have to complete 5 more rounds. You need more than 5 seconds to solve a round? That is too slow, you have to start from the start again. A colleague had to reset his password, and it took 3 people in the zoom call and 3 tries until we were able to solve the captcha.

How can anyone think that this is a good idea?

That doesn't seem that difficult, why would you need 3 people for it?

Although, having to do it >5 times is a bit much.

Adding 4 digits is not difficult, but doing this fast enough to be accepted by the captcha system is really hard. I was not kidding when I said that if you need more then 5 seconds per round, you failed and must start again.

Five seconds is pretty crazy. It's not just an arithmetic problem, it's a visual recognition problem. There are plenty of ways this can go wrong, for plenty of disability reasons, many of which aren't even obvious to the person trying to solve them.

Is there a computer-based solver that can solve these, but always takes longer than five seconds?

Nah, this seems like a really basic CV problem that should be solvable in milliseconds. The hardest part would be rejecting the sides that don't face up, but even that isn't a huge deal.

> That doesn't seem that difficult, why would you need 3 people for it?

To know which one to click on, you have to add up all of the dice, in all of the six pictures, including upside-down/deliberately confusing numerics mixed amongst the dice.

You can do that in five seconds, for 5/10/15 rounds, without a single mistake?

Seems like a prototypical diversity problem: the bros at github that designed the challenge couldn't find anyone in the room to whom the challenge wasn't obvious, easy and brilliant. :-)

This is exactly the sort of problem increased workplace diversity helps to solve, and it's a great argument for an expansive definition of diversity, which includes traditional measures such as race and gender, but also non-traditional measures, such as socioeconomic background, education, etc. (To wit: The best engineering team I've ever worked on was three computer science grads, two boot-camp grads with backgrounds in chemistry and sports medicine, respectively, and myself, with a degree in English lit but extensive industry experience. We all brought different things to the table, and we produced robust, maintainable services.)

This anecdote doesn’t surprise me, there was a study done some years ago that looked at paper citations and there was a strong correlation with diversity of the team and citations. What I remember of the excerpt was that they didn’t just look at common things like gender and skin tone, but also tried to take into account class and economic diversity as well.

I didn’t scrutinize the paper as much as I probably should have, but it definitely fit with my personal experience that diverse teams tend to be better. (yay confirmation bias!)

I encountered this same problem in Rockstar's launcher. Lead me to refund RDR2 when I bought it last.

They're quite user-hostile.

> How can anyone think that this is a good idea?

I've always assumed that captchas like this are only used when they have already "Decided" never to let you in, so just feed you a constant stream of captchas to burn your time, and make you think that it's your fault

> I've always assumed that captchas like this are only used when they have already "Decided" never to let you in, so just feed you a constant stream of captchas to burn your time, and make you think that it's your fault

I think Google & Yandex have the cruelty of gaslighting down to an science. It's one captcha after another, no matter if you solve it.

Never-being-satisfied behavior is super familiar to anyone who's lived with an abusive narcissist.

eventually they let you in. i think its somewhat ip reputation based (with reputation being how many captches have been solved from that ip). i.e. I've temporarily "burnt" my local IP by doing too many captches in a short period of time so that it wont allow me in easily (i.e. captcha after captchas, probably spend a minute or 2 doing all of them before I get through). However, after some period of time, it resets and allows me in more easily

> eventually they let you in.

Often they don't. I've run Google out past 20 attempts and not gotten in. More common are 10x-15x rounds that dump me back to the Sorry page.

I've had that on rare occasions, but only when coming from a VPN IP that was really burnt. Never from my own, where it just seemed I did too many captchas in a short period of time.

Bingo--I sometimes have this experience if I visit a site with my VPN turned on.

5 seconds? lol, it takes me 5 seconds to just count one of the sums

I think OP was being hyperbolic. I've gotten similar captchas before and while there's a timeout eventually (eg. if you stepped away for a coffee), there's more than enough time allotted to count each of the options.

What's the accessibility-focused alternative? Those tend to be easier sometimes.

This is the exact CAPTCHA that led me to delete my AirBnb account. I was just trying to log in and finally gave up after 5 or 6 attempts. The next day I tried again and was able to log in after the 3rd try. From what I understand, this CAPTCHA is also time based too. I was so frustrated at what they made me go through to just log in, that I just deleted my account.

Counting dice should be a task for a computer, not a human.

Maybe if you did the capture the computer would be trained by now.

I'd like to see a captcha that shows you C code samples and you need to spot the memory corruption.

Or show social scenarios and make the user decide the appropriate behaviour. More challenging for the target market

Good way to lock out 80% of software engineers and bring the tech industry to a halt :)

Wouldn't it be great if they tailored the questions to software engineers?

Q. You find yourself at a party, but you forgot your pants. Do you:

a. Pretend that you have pants and hope nobody notices.

b. Accept that this is a dream and just go with it.

c. Go home and find your pants.

(correct answer: a or b)

The answer is lower left, but then again, you must be smart to understand that the other die is "6" not "9". This is ridiculous tbh.

Reading the post and OP's comment, I think he approaches it the wrong way and actually try to count when a quick glance would eliminate 4 out of 6 options. If you see 6+5+4 you just know it's too high or 1+2+2 is way to low. Not much serious counting needed.

However, that 6/9 really threw me off and came across as terrible design.

There's a line under the 6 for a reason. It tells you the correct orientation.

I was looking for that but the line isn't visible on my computer unless I zoom in far. Maybe more obvious when doing the captcha for real and not looking at a compressed image.

Easy to miss in a timed operation that is threatening to lock you out of an account you might need to do your job.

The line is barely visible due to the compression

Most folks aren't used to that kind of back-of-envelope mental arithmetic.

> Not much serious counting needed.

An optimal algorithm that solves the normie's problem by completely ignoring it.

I.E. "you're holding it wrong"

Would you offer this solution to a 13-year-old using GitHub for a school project? Or a 60-year-old trying to keep up with tech? Or a busy parent trying to catch up on things after a long day?

This utter lack of empathy saddens me.

Your incorrect assumption based on what I wrote and low expectations of others saddens me.

The comment speaks for itself: "I think he approaches it the wrong way," and the only problem is the ambiguous 6/9.

If there's something else you intended to say, I'd love to see a clarification.

> The answer is lower left

Not from my perspective. I'm asked to pick a dice pair. I can't find any two dice that add up to 14.

Dice is plural, and common games have you roll two dice at a time. So you’re looking for a pair of pairs.

Oof, I’ve never heard anyone say “dice pair” to mean four dice.

Well, clearly you aren’t human then. Next!

Now that's terrible design.

> Dice is plural

It's also a descriptive label we use when discussing numbered cubes. In the captcha's context, that's the meaning I've fixed in place - while I parse the rest of the text.

I'm seeing hints that the captcha also comes with a short time clock along with the usual locked-account punishment for failure-to-solve. Fast assumptions seem appropriate.

Uh, no, when you describe a pair you use the plural. “Pair of pants”, “pair of earrings”, “pair of socks” — these phrases do not refer to four of something.

You are right, though "pair of pants" is somewhat problematical as an example of this!

Dice is plural. Die is the singular.

A pair of earrings.

Earrings is plural, earring is the singular.

I play board games and rpgs, so I spend a lot of time with dice and reading about dice. I don’t think I have ever heard a dice pair to reference multiple pairs of dice. My mind was looking for some weird die with a top higher than 6 since you need a pair that adds up to 14. Dice is plural but pair implies 2.

They should have said just the group of dice whose top sides sum to 14.

Your way of counting things will ensure you cannot solve this captcha I'm afraid.

I agree the wording is terrible, but at that point you should realize they're asking for the sum of all dices, not of any 2 dices.

> you should realize they're asking for the sum of all dices, not of any 2 dices.

How many assumptions have we piled onto the user-victim here? I've lost count.

It's dice pair, not die pair. That means 4 die.

Guess I'm not smart lol. The 6/9 ambiguity actually crossed my mind when adding it up but I thought surely they wouldn't be fucking with us that much.

I always use the audio version of captcha. The visual ones are just way too ambiguous or in this case downright ridiculous. Usually in the audio version it's two or three words spoken over a bit of background noise. Much easier!

Not for me because I am Deaf.

I think people need to understand that everyone processes things a bit differently due to genetics (brain) + environment (education style, etc).

I'm slow at this type of thing as well, and the complaint about this was one I agreed with even tho I've never hit it before. I know people who could solve this at a glance because they're "smarter" (their brain is more optimized for this type of solution) and/or they've developed heuristics for it at some point in their life.

This is a complete accessibility failure on so many levels. People with visual or cognitive impairments would be screwed if not for the audio alternative. If you happen to also be deaf, you are at the mercy of support who will probably assume you're an attacker.

That's assuming you can even reach an actual human through support.

The future internet is just gonna be AIs talking to each other as more and more humans are excluded from participation.

Anyone have an explanation as to how this doesn’t occur? Other than something crazy like Worldcoin?

Governments just create some auth service linked to your ID. This would be pretty easy with the only downside of a total loss of privacy and the ability to have multiple accounts.

Technically it doesn't have to result in a loss of privacy (at least not much of it). It's possible to use some signature schemes that would let you create accounts from your government issued ID that can't actually be traced back to you, but this would require ordinary people manage secret keys and I don't think that's possible.

Maybe wishful thinking, but the ideal for me would be reverting back to small forums that are dedicated to specific topics. This would easier to moderate and more decentralized than the current model of only using a handful of social media sites.

Speaking of ridiculous captchas, I've just started getting captchas while chatting with ChatGPT. Took me a while to figure out what the hell they were asking, and for whatever reason I'm now getting one of these at least twice per hour. Anyone else seeing these? I'm a Pro subscriber too...

Anyone else bothered by the fact that it asks you to pick a pair, when there are clearly four dice in each pic? Did I miss something, or is this either broken or intentionally misleading?

Technically, there is no traditonal pair of 6-sided die that would meet that criteria.

I wish hard captchas were required to make an account in some communities. For instance, you could ask some leet code type questions for a software engineering community so that only really smart people can post there.

Well, nothing stops you from realizing your dreams! Go forth and create that community site!

Marketing and audience building stops the vast majority of my dreams.

https://mathchan.org

Ironically, this sounds like a great job for OpenCV.

Witnessed those, it sucks

AMEN!

It's easier with co-pilot.

If you hate resetting password I suggest migrating to WebAuthn:

https://webauthn.io/

The best password is no password.

I might get downvoted for saying so, but the internet is a dangerous place. If you aren’t alert enough to solve a captcha, much worse things can happen to you than having difficulty signing into GitHub. I’d prefer GitHub to remain secure, even if it’s hard for a negligible fraction of users who forget their passwords.

The complaints here are not about the existence of a CAPTCHA for that page.

The complaints are that this particular CAPTCHA is extraordinarily stupid.

I don’t find it particularly so. I sort of like that style captcha as it requires thought. One has to figure out to quickly estimate and not actually try to sum/count the exact numbers. Maybe you have to do it twice, but it’s not very hard for a lot of people, obviously or it wouldn’t be deployed in production.

Reply on news.ycombinator.com