Posted by ribtoks 22 hours ago
CAPTCHAs are increasingly ineffective. Services are either going to go offline or implement some kind of system like this. PII like credit cards or SSNs aren't enough because those are regularly stolen.
So where do things go? Fewer services and infinite fraud?
A combination of "regulate AI" and "The optimal amount of fraud is not zero". https://www.bitsaboutmoney.com/archive/optimal-amount-of-fra...
People are just going to have to find a new way to monetize. Maybe more things will become paywalled, or sponsored long-term like old TV shows. Again, there’s no good way to solve this, and the “solutions” on offer just contribute to the surveillance state without solving the problem.
As a footnote i found googles recaptcha bitterly ironic, it was painted it in bright colors "this data assists in book scanning" or "this help our self driving cars recognize stop signs" but really designed to train models to do exactly what it's trying to prevent them from doing. and making life hell for the humans along the way. The modern single click version is doing behavioral analyses.
1. lots of laptops have fingerprint readers & TPM2 build-in
2. lots of folks own Yubikeys or FIDO2 keys - if these became the norm then the price would come down significantly.
Both of these methods only require a tap to authenticate to a website. Both provide public-key authentication, and both provide some level of proof of work / require human interaction, without revealing the identity of the end-user.
Why not use or standardise these? because there's no benefit to Google of course.
I can think of many sites where, for users that trigger captchas often, introducing a multi-device workflow is even worse for those users than clicking traffic light images. An automatic rollout would be hostile to those operators!
We can all do our part, by using their products as little as possible, contribute to open alternatives (OpenStreetMap, Fediverse, Linux, Nextcloud...) and by stimulating our (non-techie!) friends and family.
But it is a lot of work :(
Phones. Your choice is Apple or Google.
As you said, YouTube. Again, they have users and creators in one place, so it’s hard for a new platform to compete.
There are also a lot of enterprise contracts that bundle many things together. Like cloud and their workplace apps (whatever it is now called).
But also, just their size is a problem. Look at their AI story. First off, many customers get forced into packages where they get Gemini included as part of the bundle (which means they’re paying for it automatically and have less of a reason to pay for something else). But also - Google was slow to build useful products here. Even though they are late and made many failed attempts like Bard, they can afford to take losses for years that no small company - or maybe even large companies that aren’t mega corps - can absorb. Those other competitors would go out of business and have to be careful and move slowly in spending. But Google’s capital lets them make mistake after mistake but still compete and eventually win. So it’s not a fair competition.
That's no better, and in many ways far worse, than the corpos doing it.
There should not be a requirement to verify identity, but if a website owner only wants to provide access to their website to people with verified identities, why is that not their right?
Verifying identity for specific services tied to your finances or body is a whole different topic.
> if a website owner only wants to provide access to their website to people with verified identities, why is that not their right?
I like the GDPR's general point of view that the right to privacy is more important than the right to trade privacy for access. An anonymous verification might be fine, but this system is not, and random websites needing your specific identity is not.
The spirit of the law isn't to tell you that, it's to limit how much you can track people without their consent.
> Costco has the right to verify my identity when I walk into their store, I don't see why computing resources would be different.
That falls under "Verifying identity for specific services tied to your finances or body". You bought a membership, they're checking your membership.
If it was a store without a membership, then for practical purposes in real life we let them look at your ID but they shouldn't be allowed to record any identifying data off of it. When it's all done by machines we should use cryptography to make it anonymous from the start.
For an example, see EU's GDPR, DMA etc.
Whether it's targeted ads, or training AI on their data, or verifying their age and implicitly identity, or "fraud defense", most people happily take it in exchange for a convenient freebie which is why things keep escalating.
It's understandable, people are assaulted with all kinds of abuses from every direction. There are more immediate threats that they can grasp more easily so this stuff has to wait its turn.
The prime recent example of this is gamers. I've seen many people say a version of this: "I tried Linux before but it was too complicated/didn't run most games/when I ran into something I had no idea how to solve it, so I just went straight back to Windows. Now I installed Bazzite cause I was fed up with Win11 and I'm super happy with it. If I do run into a problem I just ask AI and it solves it".
I've genuinely seen dozens of comments similar to this. The fact is that there needs to be a very convenient and user-friendly alternative ready to go for the moment that some people do start to care. You need both just as much as each other. And until very recently, those alternatives didn't exist, not at the level of convenience required.
Or don't approach the world with a fundamental mindset of having agency to (help) fix things they see as broken. Just because people see something as bad doesn't mean they inherently see a bright flashing line from that to "so I should do something about it rather than accept it".
Feelgood slactivism. They don't care about your boycott. They finance their own alternatives because they know what makes you shut up.
Search is still their workhorse for ad revenue. Less search, less users, in addition to users now just asking chatgpt and co, will hurt them well
This is an attestation scheme. Attestation is about controlling what software you are and aren't allowed to run. If a future version of this allows desktop browsers rather than just phones, it will almost certainly try to do similar forms of attestation, and prevent you from controlling your own software stack.
We really need brand new legislation that makes it much easier to break up companies that are too big, and also to tax mega corporations at a much higher rate than all other companies. Then we can have fair competition and the power of choice. But the existing laws end up with no real consequence for these companies, and even if there’s some slap on the wrist, it takes years in court. New laws must make it very fast and low cost for society to take action.
As a web-wide captcha replacement, not cool
They also need to browse the web, and are more likely to be blocked by these measures than humans
In other words these measures work as intended...?
(And no, not you Microslop!)