Comment on

Wistful@discuss.tchncs.de ⁨2⁩ ⁨months⁩ ago

• tal@lemmy.today ⁨2⁩ ⁨months⁩ ago

  Image

  imgs.xkcd.com/comics/constructive.png

  source
• OsrsNeedsF2P@lemmy.ml ⁨2⁩ ⁨months⁩ ago

  I work in a related space. There is no good solution. Companies are quickly developing DRM that takes full control of your device to verify you’re legit (think anticheat, but it’s not called that). Android and iPhones already have it, Windows is coming with TPM and MacOS is coming soon too.

  source

  • parpol@programming.dev ⁨2⁩ ⁨months⁩ ago

    [deleted]

    source

    • henfredemars@infosec.pub ⁨2⁩ ⁨months⁩ ago

      Not if we build our own open and free Internet first.

      source

      • Bonesince1997@lemmy.world ⁨2⁩ ⁨months⁩ ago

        Only to be discovered by the bots and other ne’er-do-wells…

        source
  • brbposting@sh.itjust.works ⁨2⁩ ⁨months⁩ ago

    I love Microsoft’s email signup CAPTCHA:

    Image

    Repeat ten times. Get one wrong, restart.

    ---

    iPhones already have it

    Private Access Tokens? Enabled by default in Settings  > [your name] > Sign-In & Security > Automatic Verification. Neat that it works without us realizing it, but disconcerting nonetheless.

    So, the spammers will need physical Android device farms…

    Image

    Image

    source
  • IphtashuFitz@lemmy.world ⁨1⁩ ⁨month⁩ ago

    I know some sites have experimented with feeding bots bogus data rather than blocking them outright.

    My employer spotted a bot a year or so ago that was performing a slow speed credential stuffing attack to try to avoid detection. We set up our systems to always return a login failure no matter what credentials it supplied. The only trick was to make sure the canned failure response was 100% identical to the real one so that they wouldn’t spot any change. Something as small as an extra space could have given it away.

    source
• Lost_My_Mind@lemmy.world ⁨2⁩ ⁨months⁩ ago

  Pizza toppings. Glue is not a topping.

  source

  • Imgonnatrythis@sh.itjust.works ⁨2⁩ ⁨months⁩ ago

    Neither are pineapples. Fight me.

    source
• NegativeInf@lemmy.world ⁨2⁩ ⁨months⁩ ago

  Isn’t the real security from how you and your browser act before and during the captcha? The point was to label the data with humans to make robots better at it. Any trivial/novel task is sufficient generally, right?

  source
• theneverfox@pawb.social ⁨1⁩ ⁨month⁩ ago

  I think this is a non-issue

  Captchas aren’t easy to bypass - run of the mill scammers can’t afford a bunch of servers running cutting edge LLMs for this

  Captchas were never a guarantee - one person could sit there solving captchas for a good chunk of a bot farm anyways

  So where does that leave us? Sophisticated actors could afford manually doing captchas and may even just be using a call-center setup to do astroturfing. My bigger concern here is the higher speed LLMs can operate at, not bypassing the captcha

  Your run of the mill programmer can’t bypass them, it requires actual skill and a time investment to build a system to do this. Captchas could be defeated programically before and still can now - it still raises the difficulty to the point most who could bother would rather work on something more worthwhile

  IMO, the fact this keeps getting boosted makes me think this is softening us up to accept less control over our own hardware

  source
• I_Miss_Daniel@lemmy.world ⁨2⁩ ⁨months⁩ ago

  Smell? :)

  source

  • hakunawazo@lemmy.world ⁨1⁩ ⁨month⁩ ago

    Yes, or:
    Which of these images makes you horny?

    source
• theneverfox@pawb.social ⁨1⁩ ⁨month⁩ ago

  I think this is a non-issue

  Captchas aren’t easy to bypass - run of the mill scammers can’t afford a bunch of servers running cutting edge LLMs for this

  Captchas were never a guarantee - one person could sit there solving captchas for a good chunk of a bot farm anyways

  So where does that leave us? Sophisticated actors could afford manually doing captchas and may even just be using a call-center setup to do astroturfing. My bigger concern here is the higher speed LLMs can operate at, not bypassing the captcha

  Your run of the mill programmer can’t bypass them, it requires actual skill and a time investment to build a system to do this. Captchas could be defeated programically before and still can now - it still raises the difficulty to the point most who could bother would rather work on something more worthwhile

  IMO, the fact this keeps getting boosted makes me think this is softening us up to accept less control over our own hardware

  source