29 comments

20
From what I gather, we're going to physically carry around a USB stick with a personal code tied to us individually to identify ourselves when we access internet content? That's the surveilance state's wet dream meng. No thanks, I'd rather spend twice as much time and effort on the CAPTCHAs.
6
At least in theory the key in the USB stick wouldn't be personally identifiable. In practice we know "someone" will find an exploit on that, and associate keys and people.
6
It's not much effort to go from that anonymous, but unique identifier, to a person. It only takes using that identifier on a website that knows how you are, like Amazon, Facebook, Ebay, etc or pairing that with an advertising cookie to determine who you are. You'd be surprised how much personal information online-advertisers have on an average internet user, even the ones who are concerned about their privacy.
4
Most US ISPs use social security numbers. I'm sure it would take about 5 minutes to associate a stick with a customer id with a ssn.
2
Don’t even need an exploit. Be the NSA, use an AI, it’ll easily spit out who’s who.
1
That was also [one of my primary concerns](https://ruqqus.com/+technology/post/bf3m/humanity-wastes-about-500-years-per/yil1). Like you said, this would be a wet-dream for advertisers and governments.
3
I already carry around a yubikey with my keys. It's pretty good, but I share your concern about the advertising
13
I had to do one the other day where it showed you 6 images of cartoon dartboards, and you had to click on the one where the darts added to 16, like this: ![](https://backdatassup.com/img/dpoxn7azxy5cdlbqcn3cdzacpmiz669.png) If you didn't do it fast enough, you had to start again: ![](https://backdatassup.com/img/aqaebavoqk5t0vinsanc328n0rfabmt.png) I found it quite difficult to do it accurately within the time limit, especially when it wanted me to do it 20 times: ![](https://backdatassup.com/img/qbuo8kt25nm46hg9djg8evbj4z7n4pn.png) And even after I had done all 20 and I was sure I did them all right, it told me I was wrong: ![](https://backdatassup.com/img/ffdor7kap520kdbgau1f4q0ogk74w06.png) Absolutely ridiculous.
18
Ten years ago, that would have been a top rated Miniclip game, what a time to be alive.
3
>Miniclip Fuck, I'm too young to reminisce.
3
That's just a stupid design.
9
This is interesting, but I have a few concerns: * What stops spammers from setting up several banks of these keys? It's not significantly different from how telemarketers buy hundreds or thousands of phone-numbers to place calls from. * If the device has an unique identifier (which it appears to), it could be used to track a user across the internet, which is something advertisers and NSA types are very interested in doing. On the flip-side, I'm happy to see attempts being made in this space. I won't hate on innovation (so long as it's not required) that has challenges to overcome. This first pass definitely needs more work and changes.
1
YubiKeys start at $40 so it would take lot to get up and running as a scammer, they’ll probably deauth your key if you’re found to be abusing it so replacing it is costly. A device like this absolutely needs to be anonymous otherwise me and everyone else will stick with captchas.
2
In order for someone to deauth your key, they have to be getting a personal identifier from it. Alternatively, they could create an encrypted protocol through which your yubikey would be told to disable itself if abuse is detected.
1
Yeah, that will never be exploited, not. Yubikeys or any other serious product will never have such a feature.
1
Groups like cloudfair will push such a device despite its problems.
1
I am not worried about that. Security tokens are well established, I've had several Yubikeys for years, established makers will not compromise their products and open source alternatives (e.g. Nitrokey) exist.
2
That's what I was wondering. The author doesn't seem to be getting into the scammer mindset, which is essential with things like this.
8
The article is super dumb. CAPTCHA 1.0 was to help computers to read books. There was a project by Google to scan every single known book in existence into the cloud so that society could have that knowledge forever. Generally the computer could perform OCR and turn that text into a digital format, but often times there were characters that the computer had a hard time understanding. That's where the human came in. People were shown to snippets of text: one of the computer knew how to read as a test for the person and one the computer did not know how to read. The computer uses the person's response for the text it didn't know how to read to fill in the missing piece of the book. CAPTCHA 2.0 it's the same premise: teaching computers how to recognize road signs, crosswalks, traffic lights, etc. But for self-driving cars. By having a large set of images that are labeled, deep neural networks can start learning what roads look like. It's a win-win: sites get a free way of protecting against spam bots since computer algorithms cannot correctly process those images yet, and companies like Google get free labeled data sets for machine learning. And if someone does come up with a bot to defeat captcha, society wins again because now there's an algorithm in existence to do the things that were previously hard for a computer to do.
2
They acknowledge this and call it "hidden work" - their view is that Google etc. should just bloody pay for people providing a valuable service.
2
Nah think about all the things google gives away for free like browsers and operating systems. Should google charge for https://developers.google.com/recaptcha ? They are also providing a valuable service.
8
the capt has which make selected images vanish with new ones slowly reappearing are the worst.
6
Captcha doesn't even stop bots, it's just for training big tech AI
1
Yup. reCAPTCHAs that aren’t for training AI are text-based.
4
It sounds bad when they phrase it like that, but making it sound as terrible as possible is probably the point. However, take that 500 years, and consider that there are how many billions of people on the planet? So how much time does *each individual person* spend on CAPTCHAs? Because from a personal perspective I don't recall spending very much time at all. A couple minutes per year, at most, maybe? Sounds like a lazy solution to the problem when they should just be putting more work into refining the CAPTCHA process.
3
The key thing sounds gay as hell. I've never taken anything close to a 32 second captcha. If you are telling me captcha will possibly remove from my life some bots *and* some lazy/impatient/retarded cunts? Sign me up; 1 captcha per letter on twitter please.
3
...meanwhile, Humanity wastes 500 million years per day on masturbation.
2
I despise captchas
1
>blog.cloudfare.com Next do time spent 'checking your browser...'