8 ms·

I've used vultr.com for years with no problems. Recently it wouldn't let me login without solving a Google captcha. I tried private windows, etc and ended up

by prirun 13d ago

I've used vultr.com for years with no problems. Recently it wouldn't let me login without solving a Google captcha. I tried private windows, etc and ended up having to cancel my Vultr account and ask for a refund. Fortunately I only used them to spin up test VMs and didn't have any production stuff running there. I refuse to pay a company for service and then be required to identify motorcycles and traffic lights every time I sign in. I went a few rounds with Vultr customer service and they said (paraphrasing) "It's not something we can fix, you have to talk to Google about it". Right... Google forced you to put their captcha on your web site.

pixelesque 9d ago
I've had this for a few months trying to log into https://console.vultr.com/ https://console.vultr.com/... It does it for me if I use a VPN (Mullvad) - if I don't use a VPN then I haven't noticed I get them. But yeah, very annoying.
- basilikum 9d ago
  Most captchas are invisible as long as they like your IP and device. But they still do the fingerprinting in the background.
account42 9d ago
CAPTCHA for login should just be outright illegal, especially if it blocks important functionality like closing your account.
- PaoloBarbolini 9d ago
  A few years ago a service for which we had just implemented a scraper for (they had no API, and the customer needed info from 1000s of accounts) added a captcha right after we had implemented the scraper. We quickly figured out that the server didn't validate the captcha challenge code with Google. It worked for 3 years until they changed the system to send a code via email to validate your login, and limiting you to 1 session at-a-time. Now we have different problems to deal with...
- econ 9d ago
  Maybe if the number of failed logins per hour grows by 10000%
- gruez 8d ago
  >CAPTCHA for login should just be outright illegal How do you prevent credential stuffing attacks? >especially if it blocks important functionality like closing your account. That just falls under standard tort law, not to mention recent "click to cancel" legislation some states have been introducing.
  - JoshTriplett 8d ago
    > How do you prevent credential stuffing attacks? CAPTCHAs don't work anymore, at this point. AI can trivially solve them. Rate-limit the number of attempts, test accounts against known-password lists like HIBP, and support 2FA.
    - gruez 8d ago
      >CAPTCHAs don't work anymore, at this point. AI can trivially solve them. The point is to raise the cost, not to create some impenetrable barrier. A $5 vps can make hundreds of requests per second. IP bans and rate limiting forces people to use residential proxies, which are like $5/GB. That's much more expensive, but still cheap. Not sure about the token cost of AI is like, but captcha solving service used to charge around $0.002 per solve, which increases costs even more.
      - GoblinSlayer 8d ago
        For credential stuffing you need only one attempt.
        gruez 8d ago
        No, it's a numbers game on both sides. Attackers are after hundreds or thousands of accounts, not just one. Defenders knows that exactly 0 hacks are impossible to achieve, and they're just trying to limit losses from fraud, but also costs from anti-fraud.
        GoblinSlayer 8d ago
- dpifke 8d ago
  I never got a response when I wrote to the FTC, requesting formal guidance as to whether having to disable NoScript (a browser security measure) to complete a CAPTCHA to unsubscribe from email spam satisfies 16 CFR § 316: "Neither a sender nor any person acting on behalf of a sender may require that any recipient pay any fee, provide any information other than the recipient's electronic mail address and opt-out preferences, or take any other steps except sending a reply electronic mail message or visiting a single Internet Web page" https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-316/section-316.5 https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C... A simple reading says, no. But I guess they don't want to put that in writing.
downut 8d ago
Ok, debian forky, 155.0.1, successfully logged into vultr.com after a year inactive, added a credit card and a little credit. I do, however, still stupidly use google authenticator for 2FA. The captcha was just a checkbox. That said I have run into a number of unsolvable captchas lately on firefox. Had to use chromium on a healthcorp insurer site.
- GoblinSlayer 8d ago
  The captcha is not just a checkbox, it's recaptcha.
- prirun 8d ago
  I don't mind a checkbox. I don't even mind the "proof of work" types that take 10 seconds extra. But identifying traffic-y things over and over is way too much for me. I did do one screen, thinking it would let me in, but it just gave me another. I do use Firefox. And I couldn't cancel my account myself: had to request it via email since I couldn't login. They were good about doing it right away and said they issued a refund for the balance.

by prirun 13d ago

pixelesque 9d ago

I've had this for a few months trying to log into https://console.vultr.com/ https://console.vultr.com/... It does it for me if I use a VPN (Mullvad) - if I don't use a VPN then I haven't noticed I get them. But yeah, very annoying.

basilikum 9d ago
Most captchas are invisible as long as they like your IP and device. But they still do the fingerprinting in the background.

account42 9d ago

CAPTCHA for login should just be outright illegal, especially if it blocks important functionality like closing your account.

PaoloBarbolini 9d ago
A few years ago a service for which we had just implemented a scraper for (they had no API, and the customer needed info from 1000s of accounts) added a captcha right after we had implemented the scraper. We quickly figured out that the server didn't validate the captcha challenge code with Google. It worked for 3 years until they changed the system to send a code via email to validate your login, and limiting you to 1 session at-a-time. Now we have different problems to deal with...
econ 9d ago
Maybe if the number of failed logins per hour grows by 10000%
gruez 8d ago
>CAPTCHA for login should just be outright illegal How do you prevent credential stuffing attacks? >especially if it blocks important functionality like closing your account. That just falls under standard tort law, not to mention recent "click to cancel" legislation some states have been introducing.
- JoshTriplett 8d ago
  > How do you prevent credential stuffing attacks? CAPTCHAs don't work anymore, at this point. AI can trivially solve them. Rate-limit the number of attempts, test accounts against known-password lists like HIBP, and support 2FA.
  - gruez 8d ago
    >CAPTCHAs don't work anymore, at this point. AI can trivially solve them. The point is to raise the cost, not to create some impenetrable barrier. A $5 vps can make hundreds of requests per second. IP bans and rate limiting forces people to use residential proxies, which are like $5/GB. That's much more expensive, but still cheap. Not sure about the token cost of AI is like, but captcha solving service used to charge around $0.002 per solve, which increases costs even more.
    - GoblinSlayer 8d ago
      For credential stuffing you need only one attempt.
      - gruez 8d ago
        No, it's a numbers game on both sides. Attackers are after hundreds or thousands of accounts, not just one. Defenders knows that exactly 0 hacks are impossible to achieve, and they're just trying to limit losses from fraud, but also costs from anti-fraud.
        GoblinSlayer 8d ago
dpifke 8d ago
I never got a response when I wrote to the FTC, requesting formal guidance as to whether having to disable NoScript (a browser security measure) to complete a CAPTCHA to unsubscribe from email spam satisfies 16 CFR § 316: "Neither a sender nor any person acting on behalf of a sender may require that any recipient pay any fee, provide any information other than the recipient's electronic mail address and opt-out preferences, or take any other steps except sending a reply electronic mail message or visiting a single Internet Web page" https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-316/section-316.5 https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C... A simple reading says, no. But I guess they don't want to put that in writing.

downut 8d ago

Ok, debian forky, 155.0.1, successfully logged into vultr.com after a year inactive, added a credit card and a little credit. I do, however, still stupidly use google authenticator for 2FA. The captcha was just a checkbox. That said I have run into a number of unsolvable captchas lately on firefox. Had to use chromium on a healthcorp insurer site.

GoblinSlayer 8d ago
The captcha is not just a checkbox, it's recaptcha.
prirun 8d ago
I don't mind a checkbox. I don't even mind the "proof of work" types that take 10 seconds extra. But identifying traffic-y things over and over is way too much for me. I did do one screen, thinking it would let me in, but it just gave me another. I do use Firefox. And I couldn't cancel my account myself: had to request it via email since I couldn't login. They were good about doing it right away and said they issued a refund for the balance.