Is there a problem in making Captcha an HTML builtin with an attribute setting which type of Captcha

As the comments in that thread mention, Captcha is a service, not mere software. The distinction is that Captcha are in an arms race with spammers, and must continually evolve to remain effective.

In particular, many popular Captcha approaches have been made obsolete by advances in AI: The "distorted text as image" trick was made largely obsolete by advances in text recognition algorithms, and the "identify this image" trick will likely be made obsolete in the near future by innovations in image recognition fueled by the development of self driving cars (in fact, training AI systems is probably the reason Google offers reCAPTCHA as a service in the first place).

This continued evolution makes Captcha standardization difficult:

• If W3C standardizes an implementation, it will require browser vendors to participate in this arms race, which they have no incentive to do. In addition, if the standardized approach becomes insecure, W3C and all browser vendors would need to fix that quickly, but the W3C standardization process often takes years, which is a wholly unsuitable time period for fixing security issues.
• If W3C did not standardize the implementation, browsers would offer radically different levels of security. Since the website wishing to employ a Captcha must trust that security, it won't want to buy a pig in a poke, so will likely not use the browser feature, but continue to use Captcha services of known quality, making the standardized Captcha feature useless.

The only benefit standardization could possible provide is to define a uniform interface for embedding Captcha provided by third parties into a website, but since embedding Captchas is trivial with the means HTML already provides, this wouldn't add significant value.

So the key difference between Captchas and a date input is that Captchas must evolve alongside the state of the art in AI research, but date inputs can remain as they are for ever.

And by the way, even the standardization of date inputs by W3C was not really successful, because the browser implementations are of such varying quality that many web developers prefer custom JavaScript controls for consistency of user experience. For instance, MDN writes:

At the moment, the best way to deal with dates in forms in a cross-browser way is to have the user enter the day, month, and year in separate controls, or to use a JavaScript library such as jQuery date picker.

posted over 3 years ago

CC BY-SA 4.0

3y ago

meriton‭

2375 reputation 7 56 220 35

A standard form tag such as <input type="captcha"> won't exist. Browsers are not to be trusted to self-regulate a Captcha service.

Without getting into specific examples, there are browser extensions on the market that already employ sneaky techniques for solving Captchas programmatically. A field such as this can easily be "blanked" by any such extension or browser to have zero functionality.

I do want to speak to one service that is similar in function to reCaptcha: Android's SafetyNet. This very much is a drop-in solution, just written in Android-native code instead of HTML. It functions under the assumption that most users are using an unrooted Android device and are thus "trusted."

Again, without linking to examples and perhaps falling afoul of community guidelines, a rooted custom ROM Android device can blank this feature of the Android API.

posted over 3 years ago

CC BY-SA 4.0

corporat‭

91 reputation 0 3 9 0