[HN Gopher] Friendly Captcha - GDPR-Compliant Bot Protection
___________________________________________________________________
Friendly Captcha - GDPR-Compliant Bot Protection
Author : kosasbest
Score : 34 points
Date : 2023-08-08 17:46 UTC (5 hours ago)
(HTM) web link (friendlycaptcha.com)
(TXT) w3m dump (friendlycaptcha.com)
| TheRealPomax wrote:
| GDPR is about how you handle personally identifiable information.
| And IPs famously don't count as PII unless they are stored in
| combination with other data that allows linking that IP to a real
| human being, so I'm having a _really_ hard time understanding why
| being GDPR-compliant is even relevant to a captcha solution.
| geraneum wrote:
| IP addresses are considered personal data according to [1] and
| there's no mention of it being counted as personal data
| conditionally.
|
| [1] https://commission.europa.eu/law/law-topic/data-
| protection/r...
| input_sh wrote:
| > And IPs famously don't count as PII
|
| Please elaborate, as IP addresses are specifically listed as
| PII on European Commission's website:
| https://commission.europa.eu/law/law-topic/data-protection/r...
| CharlesW wrote:
| I'm curious why they wouldn't mention a differentiator in the
| title.
| toxicFork wrote:
| > Friendly Captcha generates a unique crypto puzzle for each
| visitor. As soon as the user starts filling a form it starts
| getting solved automatically. Solving it will usually take a few
| seconds. By the time the user is ready to submit, the puzzle is
| probably already solved.
|
| What makes this NOT work on a bot machine?
| jart wrote:
| A better question is why you can't just use a token bucket
| rather than mining bitcoins on your client's phone wasting
| their battery.
| Szpadel wrote:
| because bots use hundreds IP addresses assigned to the same
| system, if you have 5r/s from 10k IP addresses it adds up if
| you require computational power you force them to invest
| money in hardware and potentially make it unprofitable
| jart wrote:
| The last botnet I fended off had 49131669 IPs so believe me
| I know: https://ipv4.games/statusz The issue is it's not
| their money. A lot of these botnets are compromised of
| ordinary people's devices that got hacked into or hijacked
| by some slimy mobile app, that fires off a DDOS request
| every ~5sec or so in the background, and they do it because
| hacked devices aren't easy to fingerprint. So I feel bad
| for what's going to happen to all those normal people if
| the industry pivots to using CPU hard approaches to defend
| themselves.
| hot_gril wrote:
| Right. Captchas are supposed to ensure the operation is
| human-initiated. This solution doesn't work.
| yomlica8 wrote:
| It sounds like a proof of work rate limiter similar to
| something hashcash. I don't think it will stop a bot machine,
| just make it very expensive to use. Which is actually all
| regular captchas do anyway.
|
| Whenever this comes up as an alternative to regular captchas I
| see a lot of push back that we can't do this because it would
| cost mobile users to much battery power. If that is really such
| a concern, let the mobile users solve shitty captchas as an
| alternative and the rest of us use something like this. Mobile
| users already endure horrible privacy, no easy ad blocking,
| countless "install our app" popups and a software ecosystem
| that is infested with dark patterns so I don't see how they
| would really even notice.
| bastawhiz wrote:
| > I don't think it will stop a bot machine, just make it very
| expensive to use
|
| My phone solves the captcha puzzle in about three seconds. I
| assume it's working on one core. If you're running this on a
| server and it's able to do one every, say, two seconds, and
| you have sixteen cores, that's still about eight per second.
| At that point, what is this defending against? You're running
| into API rate limit territory.
|
| The whole point of a captcha is to make it _unsolvable_ for a
| machine. Not to make it more expensive. Because the bad
| actors will eventually make it cheap, and then it 's not
| effective anymore. Consider that today, it's often cheaper to
| farm out CAPTCHA puzzles to a room full of humans on laptops
| than it is to solve them. Making it a purely computational
| challenge is almost certainly _saving money_ for the bad
| actors.
| mschuster91 wrote:
| > At that point, what is this defending against?
|
| I have seen spam attacks against webforms running with
| _hundreds_ of calls per seconds. We in the end ran our own
| solution - a simple math captcha was all it took.
| Kiro wrote:
| > If you're running this on a server and it's able to do
| one every, say, two seconds, and you have sixteen cores,
| that's still about eight per second.
|
| That's no problem. It's supposed to protect against bots
| making billions requests a second.
| hot_gril wrote:
| Captchas are not just ddos protection, and even if it
| were, the botnets don't send tons of spam from any single
| device. Otherwise it's too easy to identify and block.
| Kiro wrote:
| That's why you use something like this, where each
| request incurs a cost for the attacker so it doesn't
| matter if the origins are distributed.
| hot_gril wrote:
| The attacker doesn't have to calculate the puzzles in one
| central place. It can do that on the hacked devices.
| JohnFen wrote:
| > It sounds like a proof of work rate limiter similar to
| something hashcash. I don't think it will stop a bot machine,
| just make it very expensive to use
|
| Ah, OK. I was wondering the exact same thing as toxicFork.
| This makes some sense. It's a shame they don't explain it on
| their website.
|
| But then the natural followup question: why do they keep
| mentioning blockchain? What's that bringing to the table? If
| it's just about soaking up processing time, then surely
| anything computationally heavy would do the trick, so why
| include something that would set off some people's alarm
| bells?
| dogma1138 wrote:
| Nothing, most JS challenges simply rely on the headless browser
| not executing the JS or that the delay & computational cost
| would be enough to render most bot attacks ineffective.
| alberth wrote:
| What makes other solutions _not_ GDPR compliant?
| omoikane wrote:
| Probably cookies. Some captcha will try to remember that you
| are human with a cookie so that you don't have to solve
| captchas repeatedly, this one advertises as not storing
| personal information:
|
| https://friendlycaptcha.com/privacy/gdpr/
| TheRealPomax wrote:
| That doesn't violate the GDPR. For a cookie to violate GDPR
| it has to trace back to personally identifiable information,
| not just "a uuid'd session". The number of people that get
| this wrong is _staggering_.
| cccbbbaaa wrote:
| I'm pretty sure a session ID is personal data since it can
| be linked to a specific user by the service provider (see
| GDPR article 4(1)), and can be processed under the
| "legitimate interest" legal basis (article 6(1)f).
|
| Cookies don't violate GDPR, but are subject to ePrivacy
| 2002/58/CE, article 5(3). "Strictly necessary" cookies (eg.
| session ID cookies) are exempt from consent.
| TheRealPomax wrote:
| Fun fact: if you have user accounts, the act of logging
| in is literally the act that consents to storing and
| handling PII (unless you're so bad at writing a signup
| agreement that you forgot to put that in there).
|
| If you _don 't_ require users to be logged in to serve
| content, e.g. the overwhelming majority of web content,
| then a visitor's session id, by definition, cannot be
| linked to their personal information, because there is no
| personal information to link to.
|
| However, if a session id is used to track "the same user
| across different websites", building up a behavioural
| profile, THAT would require explicit consent. But since
| cookies are per-domain, and browsers have severely locked
| down cross domain access, that's basically a non-
| existence concern (as both a blessing and a curse. The
| wild west web is long gone, for better and for worse).
| hot_gril wrote:
| Because the law is unclear and lots of sites are afraid to
| accidentally violate it. If you search "do you need a
| cookies banner to operate in the EU" online, Google's
| suggested answer is "If your site has EU or UK visitors,
| you require a cookie banner to comply with GDPR," which
| you're saying isn't exactly true.
| omoikane wrote:
| Then I have no idea. Sounds like more captcha vendors
| should be advertising themselves as "GDPR compliant".
|
| Reminds me of "asbestos free" labeling:
| https://xkcd.com/641/
| hot_gril wrote:
| The website also advertises "made in Europe," so it seems
| like a national(-ish) trust/pride thing.
| notpushkin wrote:
| Same but free and open source: https://mcaptcha.org/
| wardpearce wrote:
| Been using it for a new project of mine. Mcaptcha is great and
| extremely easy to build custom components for.
| r1ch wrote:
| TLDR: hashcash as SaaS.
___________________________________________________________________
(page generated 2023-08-08 23:01 UTC)