Hacker News Reader

Comment by Closi | Hacker News Reader

> We explore the cost and security of reCAPTCHAv2 and conclude that it has an immense cost and no security. Overall, we believe that this study's results prompt a natural conclusion: reCAPTCHAv2 and similar reCAPTCHA technology should be deprecated.

Not sure I 100% agree with the conclusion. IMO they currently still offer some level of security against unsophisticated actors, not no security.

And something can be bad and still be the best choice - we probably need some valid alternatives before we abandon captcha entirely - although i'm not sure what that alternative would be.

IMO the conclusion is a little bit like 'if lockpicks exist, locks offer no security and should be depreciated' - but at the moment locks and captcha still offer a level of security against unsophisticated actors.

View on HN

Captcha is nothing like a lock. It's a little guy that gives you a run around before you get to insert your key. It does very little to stop the bad actors (if there's a payday at the other end of the runaround, they'll do it), but annoys (and is a slap in the face for) every single legitimate user.

It takes a script kiddy considerably more effort to circumvent a captcha than just automating a site via curl or chromium. This difference is the increase in cost of an attack. This is the security gain.

A script kiddie downloads a script that does it for them.

The hard work of solving captchas automatically was already done, for free (linked in this very thread).

And then google changes something in the Captcha code and it stops working, then you change solve libraries and then you get it back up but need more complex hosting infra because solves take 10 seconds and you have to simulate human behaviour, then that goes down, then you have to use some new solve service which is a paid API, and then your VM is detected by Google as a bot and suddenly you are blocked across all websites using Recaptcha, so then you have to rebuild your infra...

Compared to 10 minutes and selenium.

Cool, invoke it from bash.

It's now so trivial to solve them, and extremely cheap. You can install a chrome extension, give some solving service a $1 and basically never need to reload.

Still makes a ddos much more difficult

Captcha is like locks on soap shelves. It's friction on people who want to buy soap and can be trivially defeated if you want to steal the soap.

Not only that, but adding insult to injury - the whole captcha process is being abused by Google for their surveillance capitalism.

Just load a captcha-blocked page in a fresh browser with no google accounts every being used - you got like a 1% chance of getting through. Login to google, and BOOM you're in.

From the study:

"In terms of cost, we estimate that – during over 13 years of its deployment – 819 million hours of human time has been spent on reCAPTCHA, which corresponds to at least $6.1 billion USD in wages. Traffic resulting from reCAPTCHA consumed 134 Petabytes of bandwidth, which translates into about 7.5 million kWhs of energy, corresponding to 7.5 million pounds of CO2. In addition, Google has potentially profited $888 billion USD from cookies and $8.75-32.3 billion USD per each sale of their total labeled data set."

The $888 billion profit figure seems suspect - Google annual profit is currently $30.7B so that's almost 30 years of profit at current run-rate.

You could make the exact same argument about locks (which are trivially defeated) - add up all the time that people spend unlocking doors and I'm sure you'd end up with a huge amount of time; add up all the money that people spend on locks and keys and I'm sure you'd end up with a huge amount of money. Should we logically conclude that locks are just a giant grift by Big Key? I'm sympathetic to the ickiness of captchas, but the paper never addresses the counterfactual of what might happen if there were no captchas at all.

Locks protect the user, captcha protects the company.

Yes, it's shit and annoying, just trash it already. There are much better and much more enjoyable captchas around. Like spin the panda around until it reflects the one shown on the image.

Reply on news.ycombinator.com