[HN Gopher] Friendly Captcha - GDPR-Compliant Bot Protection
       ___________________________________________________________________
        
       Friendly Captcha - GDPR-Compliant Bot Protection
        
       Author : kosasbest
       Score  : 34 points
       Date   : 2023-08-08 17:46 UTC (5 hours ago)
        
 (HTM) web link (friendlycaptcha.com)
 (TXT) w3m dump (friendlycaptcha.com)
        
       | TheRealPomax wrote:
       | GDPR is about how you handle personally identifiable information.
       | And IPs famously don't count as PII unless they are stored in
       | combination with other data that allows linking that IP to a real
       | human being, so I'm having a _really_ hard time understanding why
       | being GDPR-compliant is even relevant to a captcha solution.
        
         | geraneum wrote:
         | IP addresses are considered personal data according to [1] and
         | there's no mention of it being counted as personal data
         | conditionally.
         | 
         | [1] https://commission.europa.eu/law/law-topic/data-
         | protection/r...
        
         | input_sh wrote:
         | > And IPs famously don't count as PII
         | 
         | Please elaborate, as IP addresses are specifically listed as
         | PII on European Commission's website:
         | https://commission.europa.eu/law/law-topic/data-protection/r...
        
       | CharlesW wrote:
       | I'm curious why they wouldn't mention a differentiator in the
       | title.
        
       | toxicFork wrote:
       | > Friendly Captcha generates a unique crypto puzzle for each
       | visitor. As soon as the user starts filling a form it starts
       | getting solved automatically. Solving it will usually take a few
       | seconds. By the time the user is ready to submit, the puzzle is
       | probably already solved.
       | 
       | What makes this NOT work on a bot machine?
        
         | jart wrote:
         | A better question is why you can't just use a token bucket
         | rather than mining bitcoins on your client's phone wasting
         | their battery.
        
           | Szpadel wrote:
           | because bots use hundreds IP addresses assigned to the same
           | system, if you have 5r/s from 10k IP addresses it adds up if
           | you require computational power you force them to invest
           | money in hardware and potentially make it unprofitable
        
             | jart wrote:
             | The last botnet I fended off had 49131669 IPs so believe me
             | I know: https://ipv4.games/statusz The issue is it's not
             | their money. A lot of these botnets are compromised of
             | ordinary people's devices that got hacked into or hijacked
             | by some slimy mobile app, that fires off a DDOS request
             | every ~5sec or so in the background, and they do it because
             | hacked devices aren't easy to fingerprint. So I feel bad
             | for what's going to happen to all those normal people if
             | the industry pivots to using CPU hard approaches to defend
             | themselves.
        
               | hot_gril wrote:
               | Right. Captchas are supposed to ensure the operation is
               | human-initiated. This solution doesn't work.
        
         | yomlica8 wrote:
         | It sounds like a proof of work rate limiter similar to
         | something hashcash. I don't think it will stop a bot machine,
         | just make it very expensive to use. Which is actually all
         | regular captchas do anyway.
         | 
         | Whenever this comes up as an alternative to regular captchas I
         | see a lot of push back that we can't do this because it would
         | cost mobile users to much battery power. If that is really such
         | a concern, let the mobile users solve shitty captchas as an
         | alternative and the rest of us use something like this. Mobile
         | users already endure horrible privacy, no easy ad blocking,
         | countless "install our app" popups and a software ecosystem
         | that is infested with dark patterns so I don't see how they
         | would really even notice.
        
           | bastawhiz wrote:
           | > I don't think it will stop a bot machine, just make it very
           | expensive to use
           | 
           | My phone solves the captcha puzzle in about three seconds. I
           | assume it's working on one core. If you're running this on a
           | server and it's able to do one every, say, two seconds, and
           | you have sixteen cores, that's still about eight per second.
           | At that point, what is this defending against? You're running
           | into API rate limit territory.
           | 
           | The whole point of a captcha is to make it _unsolvable_ for a
           | machine. Not to make it more expensive. Because the bad
           | actors will eventually make it cheap, and then it 's not
           | effective anymore. Consider that today, it's often cheaper to
           | farm out CAPTCHA puzzles to a room full of humans on laptops
           | than it is to solve them. Making it a purely computational
           | challenge is almost certainly _saving money_ for the bad
           | actors.
        
             | mschuster91 wrote:
             | > At that point, what is this defending against?
             | 
             | I have seen spam attacks against webforms running with
             | _hundreds_ of calls per seconds. We in the end ran our own
             | solution - a simple math captcha was all it took.
        
             | Kiro wrote:
             | > If you're running this on a server and it's able to do
             | one every, say, two seconds, and you have sixteen cores,
             | that's still about eight per second.
             | 
             | That's no problem. It's supposed to protect against bots
             | making billions requests a second.
        
               | hot_gril wrote:
               | Captchas are not just ddos protection, and even if it
               | were, the botnets don't send tons of spam from any single
               | device. Otherwise it's too easy to identify and block.
        
               | Kiro wrote:
               | That's why you use something like this, where each
               | request incurs a cost for the attacker so it doesn't
               | matter if the origins are distributed.
        
               | hot_gril wrote:
               | The attacker doesn't have to calculate the puzzles in one
               | central place. It can do that on the hacked devices.
        
           | JohnFen wrote:
           | > It sounds like a proof of work rate limiter similar to
           | something hashcash. I don't think it will stop a bot machine,
           | just make it very expensive to use
           | 
           | Ah, OK. I was wondering the exact same thing as toxicFork.
           | This makes some sense. It's a shame they don't explain it on
           | their website.
           | 
           | But then the natural followup question: why do they keep
           | mentioning blockchain? What's that bringing to the table? If
           | it's just about soaking up processing time, then surely
           | anything computationally heavy would do the trick, so why
           | include something that would set off some people's alarm
           | bells?
        
         | dogma1138 wrote:
         | Nothing, most JS challenges simply rely on the headless browser
         | not executing the JS or that the delay & computational cost
         | would be enough to render most bot attacks ineffective.
        
       | alberth wrote:
       | What makes other solutions _not_ GDPR compliant?
        
         | omoikane wrote:
         | Probably cookies. Some captcha will try to remember that you
         | are human with a cookie so that you don't have to solve
         | captchas repeatedly, this one advertises as not storing
         | personal information:
         | 
         | https://friendlycaptcha.com/privacy/gdpr/
        
           | TheRealPomax wrote:
           | That doesn't violate the GDPR. For a cookie to violate GDPR
           | it has to trace back to personally identifiable information,
           | not just "a uuid'd session". The number of people that get
           | this wrong is _staggering_.
        
             | cccbbbaaa wrote:
             | I'm pretty sure a session ID is personal data since it can
             | be linked to a specific user by the service provider (see
             | GDPR article 4(1)), and can be processed under the
             | "legitimate interest" legal basis (article 6(1)f).
             | 
             | Cookies don't violate GDPR, but are subject to ePrivacy
             | 2002/58/CE, article 5(3). "Strictly necessary" cookies (eg.
             | session ID cookies) are exempt from consent.
        
               | TheRealPomax wrote:
               | Fun fact: if you have user accounts, the act of logging
               | in is literally the act that consents to storing and
               | handling PII (unless you're so bad at writing a signup
               | agreement that you forgot to put that in there).
               | 
               | If you _don 't_ require users to be logged in to serve
               | content, e.g. the overwhelming majority of web content,
               | then a visitor's session id, by definition, cannot be
               | linked to their personal information, because there is no
               | personal information to link to.
               | 
               | However, if a session id is used to track "the same user
               | across different websites", building up a behavioural
               | profile, THAT would require explicit consent. But since
               | cookies are per-domain, and browsers have severely locked
               | down cross domain access, that's basically a non-
               | existence concern (as both a blessing and a curse. The
               | wild west web is long gone, for better and for worse).
        
             | hot_gril wrote:
             | Because the law is unclear and lots of sites are afraid to
             | accidentally violate it. If you search "do you need a
             | cookies banner to operate in the EU" online, Google's
             | suggested answer is "If your site has EU or UK visitors,
             | you require a cookie banner to comply with GDPR," which
             | you're saying isn't exactly true.
        
             | omoikane wrote:
             | Then I have no idea. Sounds like more captcha vendors
             | should be advertising themselves as "GDPR compliant".
             | 
             | Reminds me of "asbestos free" labeling:
             | https://xkcd.com/641/
        
               | hot_gril wrote:
               | The website also advertises "made in Europe," so it seems
               | like a national(-ish) trust/pride thing.
        
       | notpushkin wrote:
       | Same but free and open source: https://mcaptcha.org/
        
         | wardpearce wrote:
         | Been using it for a new project of mine. Mcaptcha is great and
         | extremely easy to build custom components for.
        
       | r1ch wrote:
       | TLDR: hashcash as SaaS.
        
       ___________________________________________________________________
       (page generated 2023-08-08 23:01 UTC)