Hacker News Reader

Comment by robin_reala | Hacker News Reader

I’m quite proud of GOV.UK for banning CAPTCHAs from government services completely.[1] Have you ever tried to use the ‘accessible’ fallback for ReCAPTCHA? It’s literally impossible (my team had 0% passes trying it over and over again) so by implementing ReCAPTCHA you’re completely blocking an entire set of already disadvantaged users. At the same time, even a normal CAPTCHA is already harder for some users to solve than it is for some bots and you’re lining Google’s pockets by training their ML algorithms.

While this new version potentially helps things, it feels like the users with more automated interaction methods or those who want to reduce fingerprinting efforts will still fall foul of over-zealous site owners.

At the end of the day, all a CAPTCHA is is a method to externalise business costs onto your users.

[1] https://www.gov.uk/service-manual/technology/using-captchas

View on HN

I'd suggest CAPTCHA nay-sayers to come up with alternatives. The implied alternative is, by default, constant abuse, phishery, scrapping, automated login attempts, and DDoS. Which sometimes may be fine, and many times is just not acceptable.

If a CAPTCHA is the only thing keeping your site secure from abuse then I think you have larger problems.

It probably eliminates 90% of it for 90% of websites, like off-the-shelf spamware hitting your blog's comments.

The prevention measure you create for the remaining 10% (like a moderation queue + human review if you can afford it) is likely to only work because its workload is diminished 90% by a crude measure like ReCaptcha.

Your dismissal doesn't illuminate anything. It turns out that abuse prevention is hard and costly.

> It turns out that abuse prevention is hard and costly

This should come as Tshirt or coffee mug.

> If a CAPTCHA is the only thing keeping your site secure from abuse then I think you have larger problems.

This is one of those pithy remarks that add zero value to a discussion.

I'm curious how you would approach blocking automated access to various parts of your site?

Well usually ReCAPCHA is usually used on sign in pages. You can rate limit login attempts, exponentially increasing rate limit (or just locking out) IPs that exceed allowed login attempts and analyze your logs to ban abusive IPs.

Yeah, that's harder than ReCAPTCHA, but I think a lot of these big companies can afford to do these pretty basic steps.

If you just want to throw some comments on your free blog and not have to moderate the comments (and honestly, how many comments does your blog get that you can't read them?) then sure, throw ReCAPTCHA on there. But there are plenty of big companies that use ReCAPTCHA.

> You can rate limit login attempts, exponentially increasing rate limit (or just locking out) IPs that exceed allowed login attempts and analyze your logs to ban abusive IPs.

Rate limiting and bot blocking are two totally different things. Rate limiting only increases the cost of a bot attack. Either they need more IP's (which are dirt cheap in the black market) or they need more time--either way it is increased cost. But it won't stop a bot. Just slow it.

Banning IP's might have worked back in 2000, but these days it is useless. Bypassing an IP block is trivially easy for even a low-sophistication attacker.

> Bypassing an IP block is trivially easy for even a low-sophistication attacker.

Not easy for an average user though.

The average user can solve the captcha anyway.

You're not trying to block the average user, you're trying to block the people trying to abuse the system.

You could rate-limit at a higher limit based on username as well.

I guess a potential problem with that however is the login-blocking of high profile accounts with known usernames. Maybe only those accounts could be solved by a captcha to bypass the login-block. And if there is a solution like that, login-blocks will basically become useless & therefor also disappear.

Two-factor authentication, obviously, even e-mail based.

You've just lost 95% of your users.

Taking 10 minutes to solve one reCaptcha is also a good way to lose users. There are plenty of websites I refuse to use now because they have outrageous reCaptchas.

Same here, I HATE CAPTCHA's.

2FA requires you to be a registered user. That's a whole new level of user friction.

Cool, that solution works for one of the hegemonic governments of the world.

Now what about about literally every other entity in the world that has a website? The vast majority of which not being a business? Nor serving life-critical documentation to all of the country's disabled?

Reply on news.ycombinator.com