5 ms·

What's the best captcha regarding accessibility?

burningChrome 2y ago
None. There are no "best" version of captcha. I've worked on several large scale projects where captcha was floated and then quickly abandoned in favor of other methods like Honeypot or using other methods to weed out bots and other 3rd party agents. If you have to use captcha the least worst are probably reCaptcha V2 and hCaptcha for accessibility.
- webspinner 2y ago
  I'm OK with reCAPTCHA, but uh... Just not a fan of Google!! I'm an expert reCAPTCHA solver.
- Gud 2y ago
  What were the chosen choices? Curious to know
  - consteval 2y ago
    By far the most effective way to prevent bots is to charge for an account or service. Facebook, for example, banned billions of bots. At just 1 dollar an account, such a situation would be completely untenable. Not to mention most views are worth fractions of a cent - paying for bots wouldn't be a return on investment, so nobody would do it. Bots are an inherent problem with free, advertisement-fueled web. If you want to get rid of them, it's trivial, but requires an re-understanding of how we use the web.
Saris 2y ago
Brave PoW captcha maybe? Because it requires no input/interaction from the user.
- jknoepfler 2y ago
  I don't understand why POW solutions aren't more popular.
  - Saris 2y ago
    I'd never heard of them before getting them while using Brave search sometimes, I'm not sure I entirely understand how they work and differentiate between a bot and human.
    - xelamonster 2y ago
      They don't differentiate. They just make it too expensive to be worth paying for the resources required to carry out a spam attack at any meaningful scale.
      - Saris 2y ago
        Oh that makes sense, neat way of doing it. Basically adds a delay while also costing CPU resources.
  - CodesInChaos 2y ago
    I don't think there is any PoW that results in acceptable performance for the user (especially on mobile) while also making the cost for an attacker high enough to deter them. Even renting the compute on AWS, it only costs $0.01 per minute for the equivalent of a decent desktop computer (c8g.4xlarge). While an attacker will likely either use a botnet, or hardware better suited for solving the PoW than the hardware the user is using. Though CAPTCHAs don't really work well anymore either, since solving services are quite cheap. Recaptcha is nowadays primarily based on other factors, like IP reputation, susceptibility to google tracking, and behavioral scoring.
  - marginalia_nu 2y ago
    Most people engage with web content on relatively low powered machines. If you tune them to be tolerable on a 4 year old mid-range android device, there isn't much cost incurred on a threadripper.

None. There are no "best" version of captcha. I've worked on several large scale projects where captcha was floated and then quickly abandoned in favor of other methods like Honeypot or using other methods to weed out bots and other 3rd party agents. If you have to use captcha the least worst are probably reCaptcha V2 and hCaptcha for accessibility.

webspinner 2y ago
I'm OK with reCAPTCHA, but uh... Just not a fan of Google!! I'm an expert reCAPTCHA solver.
Gud 2y ago
What were the chosen choices? Curious to know
- consteval 2y ago
  By far the most effective way to prevent bots is to charge for an account or service. Facebook, for example, banned billions of bots. At just 1 dollar an account, such a situation would be completely untenable. Not to mention most views are worth fractions of a cent - paying for bots wouldn't be a return on investment, so nobody would do it. Bots are an inherent problem with free, advertisement-fueled web. If you want to get rid of them, it's trivial, but requires an re-understanding of how we use the web.

Saris 2y ago

Brave PoW captcha maybe? Because it requires no input/interaction from the user.

jknoepfler 2y ago
I don't understand why POW solutions aren't more popular.
- Saris 2y ago
  I'd never heard of them before getting them while using Brave search sometimes, I'm not sure I entirely understand how they work and differentiate between a bot and human.
  - xelamonster 2y ago
    They don't differentiate. They just make it too expensive to be worth paying for the resources required to carry out a spam attack at any meaningful scale.
    - Saris 2y ago
      Oh that makes sense, neat way of doing it. Basically adds a delay while also costing CPU resources.
- CodesInChaos 2y ago
  I don't think there is any PoW that results in acceptable performance for the user (especially on mobile) while also making the cost for an attacker high enough to deter them. Even renting the compute on AWS, it only costs $0.01 per minute for the equivalent of a decent desktop computer (c8g.4xlarge). While an attacker will likely either use a botnet, or hardware better suited for solving the PoW than the hardware the user is using. Though CAPTCHAs don't really work well anymore either, since solving services are quite cheap. Recaptcha is nowadays primarily based on other factors, like IP reputation, susceptibility to google tracking, and behavioral scoring.
- marginalia_nu 2y ago
  Most people engage with web content on relatively low powered machines. If you tune them to be tolerable on a 4 year old mid-range android device, there isn't much cost incurred on a threadripper.