Hacker News Reader

Comment by jfengel | Hacker News Reader

I'm kinda surprised captcha still exists. It's pretty clear that the robots have beaten it, and when they haven't you can hire armies of humans for the price of a latte.

Not that I want trillions of bots hitting up every resource on the Internet. But I don't see how to stop it at this point except by excluding a fair number of regular people.

View on HN

For big sites I agree, but for small to medium it's clear to me. The amount of shit thrown your way drops dramatically with a captcha in the way. It's enough to stop the barely interested scanners/attackers, which in my experience is a huge number of people.

Countering advanced bits is a game of economics. Sure, we know that they can solve the captchas, but they usually can’t do so for free. Eg. Typical captcha solver services are around $1/thousand solved. Depending on the unit economics of a particular bot that might be cheap or it might completely destroy the business model. I’ve definitely seen a lot of professionally operated bots where they invest a lot of effort into solving the fewest captchas possible to keep the cost down.

That captchas are completely useless is a popular myth.

That depends what problem you're trying to solve. I've seen web applications deal with someone throwing rockyou at hundreds of users on the logon form. This sort of large scale brute forcing was completely arrested by captcha, the workarounds just aren't worth it at the scale.

Captchas work on our site.

With it off our system is filled with spam and bots. With it in it drops to 0.

What else should we do instead?

There's proof of work schemes to slow the requests. People point out these would drain mobile batteries to fast but don't mobile devices usually leak so much data they don't need to solve captchas as often anyway?

> you can hire armies of humans for the price of a latte.

I’ve heard this before, but where does one actually hire these humans? Mturk is the only thing that comes to mind.

For example https://2captcha.com/ https://anti-captcha.com/ https://www.capsolver.com/ https://deathbycaptcha.com/ https://nextcaptcha.com/ seems like about $1 for 1000 solutions

I suspect these businesses do a first pass of ML in case the captcha is easy, before sending it to a human to be solved manually.

This argument might have flown a decade ago, but our current economic environment is largely characterized by ignoring reality - creating vibes for upper management and shareholders is what really matters. And telling them we implemented a CAPTCHA solution creates that vibe.

Reply on news.ycombinator.com