Hacker News Reader

Comment by tpxl | Hacker News Reader

Captcha is nothing like a lock. It's a little guy that gives you a run around before you get to insert your key. It does very little to stop the bad actors (if there's a payday at the other end of the runaround, they'll do it), but annoys (and is a slap in the face for) every single legitimate user.

View on HN

It takes a script kiddy considerably more effort to circumvent a captcha than just automating a site via curl or chromium. This difference is the increase in cost of an attack. This is the security gain.

A script kiddie downloads a script that does it for them.

The hard work of solving captchas automatically was already done, for free (linked in this very thread).

Cool, invoke it from bash.

And then google changes something in the Captcha code and it stops working, then you change solve libraries and then you get it back up but need more complex hosting infra because solves take 10 seconds and you have to simulate human behaviour, then that goes down, then you have to use some new solve service which is a paid API, and then your VM is detected by Google as a bot and suddenly you are blocked across all websites using Recaptcha, so then you have to rebuild your infra...

Compared to 10 minutes and selenium.

It's now so trivial to solve them, and extremely cheap. You can install a chrome extension, give some solving service a $1 and basically never need to reload.

Still makes a ddos much more difficult

Captcha is like locks on soap shelves. It's friction on people who want to buy soap and can be trivially defeated if you want to steal the soap.

Not only that, but adding insult to injury - the whole captcha process is being abused by Google for their surveillance capitalism.

Just load a captcha-blocked page in a fresh browser with no google accounts every being used - you got like a 1% chance of getting through. Login to google, and BOOM you're in.

From the study:

"In terms of cost, we estimate that – during over 13 years of its deployment – 819 million hours of human time has been spent on reCAPTCHA, which corresponds to at least $6.1 billion USD in wages. Traffic resulting from reCAPTCHA consumed 134 Petabytes of bandwidth, which translates into about 7.5 million kWhs of energy, corresponding to 7.5 million pounds of CO2. In addition, Google has potentially profited $888 billion USD from cookies and $8.75-32.3 billion USD per each sale of their total labeled data set."

The $888 billion profit figure seems suspect - Google annual profit is currently $30.7B so that's almost 30 years of profit at current run-rate.

You could make the exact same argument about locks (which are trivially defeated) - add up all the time that people spend unlocking doors and I'm sure you'd end up with a huge amount of time; add up all the money that people spend on locks and keys and I'm sure you'd end up with a huge amount of money. Should we logically conclude that locks are just a giant grift by Big Key? I'm sympathetic to the ickiness of captchas, but the paper never addresses the counterfactual of what might happen if there were no captchas at all.

Locks protect the user, captcha protects the company.

Reply on news.ycombinator.com