But now all this damn clicking of hydrants, crossing, traffic lights, store fronts, vehicles etc. etc. is becoming really irritating.
And no, I disagree that we have no option but to rely on "centralised" services like cloudfare or Google.
Like I said, popular spamming software like Xrumer could crack those captchas ten years ago.
> And no, I disagree that we have no option but to rely on "centralised" services like cloudfare or Google.
Can you pitch alternatives, though? For example, an attacker can still spoof IP addresses in 2019 and create volumetric attacks that you certainly cannot endure without someone's help upstream (i.e. centralization). No need to bother with spoofing though since you can rent a botnet for peanuts. Attackers have decentralized attacks but there is increasingly only centralized defense.
A DDoS on a static site cached on just about any CDN that runs logic exclusively on the client is much harder to pull off successfully because it's so much cheaper (practically free?) to mitigate, and doesn't affect any existing users who would already have the necessary resources cached locally.
AWS did let me report these DDoSes and they would reimburse me, but it felt wayyy too precarious and I ended up switching to Cloudflare (free).
And I think that should worry us all.
Also, only the most trivial sites can be 100% cached. And those are the sites who need Recaptcha the least (or need a server to get a challenge from). Abuse is not a simple issue to solve.
It pollutes the original intention with a different goal. Is the goal to easily distinguish between bots and humans, or is the goal to trick people into doing free classification work for Google? Different intentions lead to different incentives which may lead to different results.
Uber business case: driverless cars. Users who are already uber users can bypass it.
Facebook: can sell datasets. Can authenticate users. I wonder if fb is used on more sites than Google?
Toyota: Aside from driveless, they would have a weak case but case nonetheless for starting a captcha service.
What people actually don't seem to realize ITT is that abuse is becoming so easy and such a problem that we are becoming increasingly reliant on centralized services like Cloudflare and Google.
You used to be able to just generate your own captcha on the server with simple libraries, but Xrumer (mass website-spamming software) could crack those 10 years ago.
I'd like to see more comments addressing the ever-lowering barrier of online spam/abuse instead of opting for the low hanging fruit of condemning people for trying to save their websites/platforms from it.