7 ms·

> any CAPTCHA custom to a site will be broken very easily if your business takes off. For me, this is an interesting and open question. I've taken the view tha

> any CAPTCHA custom to a site will be broken very easily if your business takes off. For me, this is an interesting and open question. I've taken the view that as long as it's easier to come up with new types of challenges than it is to create an automated means to solve those challenges, CAPTCHAs offer some protection. If you're ok with requiring JavaScript, mouse input, and images (e.g. you don't require your site to be accessible by sight-impaired users who cannot use a mouse), I think people can come up with varied enough challenges to present a problem to bots. How long will that be the case? I don't know.

Kaveren 7y ago
The problem is coming up with challenges that are not trivial to automate and not annoyingly hard for users. Botters aren't just making passive income, they can fix their bot every day as long as it's making them money. Many sites try "random" questions which are really easy to pattern match with a little regex. The amount of effort that goes into botting generally scales linearly with userbase size (not always). But once you're talking about a botter with a profit motive when your site has hundreds of thousands or millions of MAU, I think trying to come up with challenges to beat botters would be prohibitively time consuming.
- fractalf 7y ago
  What if you had a community helping out, somehow gamify making new challenges? I dunno, just have the feeling if there was a proper project with enough bright minds behind it, it should work
  - majewsky 7y ago
    This sounds like a recipe for disaster when 4chan and friends find out about it.
- NetToolKit 7y ago
  > The problem is coming up with challenges that are not trivial to automate and not annoyingly hard for users. > I think trying to come up with challenges to beat botters would be prohibitively time consuming. I agree that is challenging, and I think this question will need to be settled empirically. Sub-questions include: a) What is the threshold for bot operators to engineer custom CAPTCHA solutions? (e.g. for a large website, how much can a bot network make?) b) Even if it were not possible to conclusively beat the bots, what is the threshold at which bot operators decide that they would rather make their money off of other sites instead?

Kaveren 7y ago

The problem is coming up with challenges that are not trivial to automate and not annoyingly hard for users. Botters aren't just making passive income, they can fix their bot every day as long as it's making them money. Many sites try "random" questions which are really easy to pattern match with a little regex. The amount of effort that goes into botting generally scales linearly with userbase size (not always). But once you're talking about a botter with a profit motive when your site has hundreds of thousands or millions of MAU, I think trying to come up with challenges to beat botters would be prohibitively time consuming.

fractalf 7y ago
What if you had a community helping out, somehow gamify making new challenges? I dunno, just have the feeling if there was a proper project with enough bright minds behind it, it should work
- majewsky 7y ago
  This sounds like a recipe for disaster when 4chan and friends find out about it.
NetToolKit 7y ago
> The problem is coming up with challenges that are not trivial to automate and not annoyingly hard for users. > I think trying to come up with challenges to beat botters would be prohibitively time consuming. I agree that is challenging, and I think this question will need to be settled empirically. Sub-questions include: a) What is the threshold for bot operators to engineer custom CAPTCHA solutions? (e.g. for a large website, how much can a bot network make?) b) Even if it were not possible to conclusively beat the bots, what is the threshold at which bot operators decide that they would rather make their money off of other sites instead?