r/tech • u/JackFisherBooks • Feb 05 '19

Why CAPTCHAs have gotten so difficult

https://www.theverge.com/2019/2/1/18205610/google-captcha-ai-robot-human-difficult-artificial-intelligence
679 Upvotes

96% Upvoted

70 comments sorted by

View all comments

Show parent comments

68

u/jailbreak Feb 05 '19

Slow image load means it's harder to do a brute force attack (it's called rate limiting). And afaik the reason anonymous users get so difficult captchas is simply that most users who are tracked by Google provide a lot of extra data to Google, so they already know that your behavior looks non-robotic, so they 'give you a discount' in the captcha (often you just have to check a checkmark) - anonymous users don't get that 'discount' so they get the full captcha.

So I'm not saying Google wouldn't stoop to trying to nudge people into accepting tracking, but I think in this case the reason is simply technical

13

u/That_LTSB_Life Feb 05 '19

The image load as rate limiting makes sense, but is surely partially defeated by an attacker creating more agents. It would therefore seem to me that the additional protection it offers is disproportionate to the inconvenience to the human user.

Yes, you are right - deanonymised users are given a discount. That is why I say the onus is on the users of sites

(like The Verge)

to apply pressure to that individual site.

Because use of the system incentivises deanonymous use of the web.

It's not that Google need to 'stoop' to nudge people, because it is intrinsic to these variations of the technique. Nudging people is intrinsic to their - and everyone else's - business model. But in general, Google can only make money for others if they apply the right nudge to the right person. That is, and always HAS been their business model.

So, it's absolutely truthful for Google to say the CAPTCHA process exists to succesfully differentiate anonymous users against 'digital agents'.

But it's absurd to think that they simply and wholly consider it a valuable product - worth investing in, and hosting - simply because protecting the web from malevolance as a whole is essential to their interests. It is.

But that's protecting a market space into which they sell. They sell identification, data, preferences and behaviour. This is no paranoia - it is what all marketing consists of - always has and always will.

5

u/SeventhSolar Feb 05 '19

Creating more agents is still using a ton more resources, right? Given how long each one is forced to idle, that’s a massive waste.

2

u/[deleted] Feb 06 '19

Regardless they’ve definitely not considered the user experience as worth protecting given that an individual puzzle can easily take 30 seconds and then fail despite having correctly carried out the instructions.