Sean CuttAug 22, 2023
Bruce Lawson ✅ ♫ ♿ ✌️♂️✊
AI bots are so good at mimicking the human brain and vision that CAPTCHAs are useless https://qz.com/ai-bots-recaptcha-turing-test-websites-authenticity-1850734350
"The bots’ accuracy is up to 15% higher than that of humans" - so get rid of them from your sites; they're often an accessibility disaster for actual humans.
AI bots are so good at mimicking the human brain and vision that CAPTCHAs are useless

The bots’ accuracy is up to 15% higher than that of humans

Quartz
Aug 22, 2023 at 2:37pmWeb
Show threadBruce Lawson ✅ ♫ ♿ ✌️♂️✊Aug 22, 2023
In 2019, 63% of UK web users with access needs cited CAPTCHAs as a barrier to using retail sites (PDF: https://www.clickawaypound.com/downloads/cap19final0502.pdf)
Show threadLonMAug 22, 2023
@brucelawson I don't currently have serious visual/mobility accessibility issues and even I've given up on sites because they've put up CAPTCHAs. That table on page 14 is pretty dismal.
Show threadroblosricosAug 22, 2023

@brucelawson

I'm vision impaired, and I regularly fail captchas.

Show threadLord Caramac the Clueless, KSCAug 22, 2023
@brucelawson With LLMs like GPT getting better at solving text exercises, even text-based riddles can't keep the robots out anymore.
Show threadPaulAug 22, 2023
@brucelawson know if any other solutions are on the cards? We recently added Cloudflare's non-puzzle one because we were getting hit with loads of account creations with stolen cards.
Show threadNour 🏳️‍⚧️🍉Aug 22, 2023
@paulcox @brucelawson if you mean stolen debit/credit cards then you should enforce 3DSecure, this moves the liability from the merchant and onto the card issuer (bank).
Also cloudflare should be able to eventually catch-up and blacklist the IPs that spam you.
Show threadPaulAug 23, 2023
@autistic_enby @brucelawson yeah, we bumped up the 3DS requirement slightly, but unfortunately cards are from all around the world, and levels of 3DS support seem to vary. The bot/ attacker was constantly rotating IPs as well, we originally tried rate limiting based off of IP and it didn't help. :(
Show threadPaul RosenAug 22, 2023
@brucelawson I have trouble passing the captcha anymore. And I don't have a vision problem. The other day I had a form and decided to do the captcha first because if I couldn't pass, why bother? Then it timed out and I had to solve it again anyway.
Show threadAndy WoottonAug 22, 2023
@brucelawson This isn't the singularity I was expecting.
Show threadAndy WoottonAug 23, 2023
@brucelawson <Leaves to stew for a while>: Nobody expects the singularity they get.
Show threadClausAug 22, 2023
@brucelawson captcha’s have always been a tool to train the very bots they were trying to stop.
Show threadEric RehmeyerAug 22, 2023
@claus @brucelawson a tool to sell that training as a service without paying its workers
Show threadKaitoAug 22, 2023
@brucelawson we should have puzzles that ChatGPT can't answer instead, like "how to make TNT?" /hj
Show threadCookie MumblesAug 22, 2023

@brucelawson
It might be an accessibility nightmare, but setting up a large-enough neural network capable of solving captchas reliably is still not super easy at scale, and spam bots continue to be a big problem that captchas continue to mitigate.

We need captchas that are accessible, not to simply get rid of them because than we'll get spammed into oblivion.

Show threadBruce Lawson ✅ ♫ ♿ ✌️♂️✊Aug 23, 2023
@cookie_mumbles "We need captchas that are accessible" - I agree. But until they are, all they do is fuck up real people with access needs
Show threadnatriumchlorideAug 22, 2023
@brucelawson nooo we're the bots now 😱
Show threadJay HoltslanderAug 22, 2023
@brucelawson I wonder how Cloudflare’s Turnstile is faring? In my experience we’ve seen a near 100% drop in form spam.