2
\$\begingroup\$

I still sometimes have the "we can't quite tell if you're a human" popup happen when I try to do stuff, with attached captcha. I think there should be a privilege that comes with a certain amount of rep that stops that from happening, because it's kind of annoying and it's rather unlikely someone with more than a certain amount of rep is a bot. I'm not seeing it frequently enough that I'm interested in altering my software or network to obtain a work-around.

After reading the posts linked by @doppelgreener, I think this should be done even more. It seems silly that you have to have 10K rep before the system decides you probably aren't a bot. In fact, it seems counterproductive as a 10K user who is a bot (because their account got hacked) can actually cause harm to the site (as a moderator) while the rest of us couldn't actually do much besides screw our account over. Spam bots are target at sites with low entry barriers, which SE is not. Even a measly 5 rep requirement would probably be fine.

Additionally, why do we care if bots use our site? If they're contributing high-quality questions and answers (which a 10K mod would have to be) does it matter? I understand that a botnet of coordinated upvoting and downvoting could be a problem, but don't you need a baseline amount of rep to upvote and downvote? And isn't there a 200 rep single day maximum?

I think the system is more than safe enough without a captcha on anything but account creation, but I'm not a computer security expert by any means and I can see how it might be and issue so I'll leave that alone. I really can't see how letting users with more than, say, 100 rep do stuff without asking if they're human is a problem. And according to the comments, users with 10,000 rep (which is supposed to give some anti-captcha benefit) still see the popup occasionally.

\$\endgroup\$
  • 1
    \$\begingroup\$ Which stuff are you trying to do? What browser are you using? What extensions do you have installed? Do you have any magical anti-virus software that pre-fetches pages? \$\endgroup\$ – Brian Ballsun-Stanton Nov 6 '14 at 7:46
  • \$\begingroup\$ Another couple pertinent questions: Are you on a network with a lot of users? Which country are you in? (Additionally, some internal steps are taken to determine who should be seeing captchas and how often, but those steps aren't completely clear, and reputation is probably only a small/single factor in that.) \$\endgroup\$ – Aza Nov 6 '14 at 7:55
  • 5
    \$\begingroup\$ A couple of other questions just to make sure: Are you human? Are you sure you're not a bot? Are you human, I mean, really really? When was the last time you checked? \$\endgroup\$ – lisardggY Nov 6 '14 at 7:58
  • \$\begingroup\$ @BrianBallsun-Stanton Is that relevant? Is there a reason I should be seeing them at all? I'm not spamming anything, but even if I were a captcha wouldn't be appropriate, a ban would. \$\endgroup\$ – Please stop being evil Nov 6 '14 at 8:18
  • 1
    \$\begingroup\$ So if I never see the captcha at all, does that mean I'm a replicant? \$\endgroup\$ – BESW Nov 6 '14 at 8:43
  • \$\begingroup\$ @BESW What do you mean? \$\endgroup\$ – Please stop being evil Nov 6 '14 at 8:50
  • \$\begingroup\$ BESW is making a Bladerunner reference. \$\endgroup\$ – SevenSidedDie Nov 6 '14 at 15:58
  • 1
    \$\begingroup\$ I haven't seen captcha since I made an account. Never even occurred to me that it was a thing. \$\endgroup\$ – Miniman Nov 6 '14 at 21:49
  • \$\begingroup\$ @Miniman You run into captchas when you're being heavily active, especially when you're doing a lot of editing or writing a lot of answers or questions. I have only run into them infrequently myself. \$\endgroup\$ – doppelgreener Nov 7 '14 at 7:14
3
\$\begingroup\$

There's no captcha bypass privilege, but once you pass 10k, your threshold before you're asked for a captcha is massively increased. This isn't mentioned on the 10k privilege page though. See this Meta SE request:

Add captcha threshold information to privileges page

That same meta question links to some others, which point out that captcha gets suppressed periodically once you're past 200 rep.

\$\endgroup\$
  • \$\begingroup\$ Hmm, ok, that's cool and I agree with the heavily upvoted posts there saying that these privileges should be listed on the privilege page, but the post is really old and nothing seems to have been done. Also, as has been noted many times in the linked to questions, there's no real reason to have the captcha affect users with rep at all. In fact, meta.stackexchange.com/questions/143455/i-am-not-a-robot/… indicates that the system, while intended to be functioning, was left critically bugged to the point of being disabled on everyone for a long time before anyone noticed. \$\endgroup\$ – Please stop being evil Nov 6 '14 at 8:27
  • 2
    \$\begingroup\$ I'm still asked for that captcha. But it's appropriate: imagine if a high-rep user got their session hijacked by an XSS attack. It would be mayhem. Triggering on script-like activity is a good idea, and a few false positives is well worth making such an attack less attractive to crackers. \$\endgroup\$ – SevenSidedDie Nov 6 '14 at 8:34
  • \$\begingroup\$ Yeah there are actually lots of compelling reasons to keep captcha active for everyone - or at least some method of distinguishing bots from humans, if not captcha. Bugs in the system of choice are another matter though. \$\endgroup\$ – doppelgreener Nov 6 '14 at 8:38
  • \$\begingroup\$ Wouldn't any system which acquired control of a high-rep user account be able to avoid the captchas fairly easily? Instead of answering a given captcha you can just cancel, refresh and try again (it doesn't necassarily proc a second time on answers, I think, and on questions definitely). Also captchas are not used for upvotes, downvotes, or flags (as far as I can tell) which are, in my opinion, more dangerous than spamnsers. Are they used for the mod tools? If not having them protect against attacks by singling out Q's&A's seems silly. But, again, I'm not an expert on computer security. \$\endgroup\$ – Please stop being evil Nov 6 '14 at 8:48
  • 1
    \$\begingroup\$ There's rate limits on everything. You can only use a limited number of votes and flags per day, which limits the amount of damage that can be done before it's discovered. \$\endgroup\$ – doppelgreener Nov 6 '14 at 9:02
  • \$\begingroup\$ Moderators can also revoke your session, and can suspend accounts of even the highest reputation if suspicious behavior is going on. Just to mention some tools that are in the bag for cases where things go awry. \$\endgroup\$ – wax eagle Nov 6 '14 at 13:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .