7 ms·
>CAPTCHAs don't work anymore, at this point. AI can trivially solve them. The point is to raise the cost, not to create some impenetrable barrier. A $5 vps can
by gruez 11d ago
>CAPTCHAs don't work anymore, at this point. AI can trivially solve them.
The point is to raise the cost, not to create some impenetrable barrier. A $5 vps can make hundreds of requests per second. IP bans and rate limiting forces people to use residential proxies, which are like $5/GB. That's much more expensive, but still cheap. Not sure about the token cost of AI is like, but captcha solving service used to charge around $0.002 per solve, which increases costs even more.
- GoblinSlayer 11d agoFor credential stuffing you need only one attempt.
- gruez 11d agoNo, it's a numbers game on both sides. Attackers are after hundreds or thousands of accounts, not just one. Defenders knows that exactly 0 hacks are impossible to achieve, and they're just trying to limit losses from fraud, but also costs from anti-fraud.
- GoblinSlayer 11d agoThey have so many accounts broken daily? Then credential stuffing attacks are not prevented.
- olyjohn 10d agoThen you don't need to automate it, and you can just manually solve the captcha and log in.
- bellowsgulch 11d agoThere is no raised cost anymore. Every professional doing this work has perfect alignment with regular consumer heuristics. OS, browser, fingerprinting, networked bytes, residential address spaces. All of it is done.