39

Currently, even high-reputation users, community moderators and (as far as I've heard) SE employees are confronted by captchas when they perfom actions in quick succession. That has become a significant nuisance for some user now with the increased difficulty of the ReCaptchas SE uses.

But do we actually need Captchas for established users? I certainly see the need for them for unregistered or relatively new users, but for high reputation users there are only three scenarios that I can think of where they might be useful:

  • The account is hacked by a spammer
  • A user is rage-quitting and vandalising the site
  • A user is performing large-scale misguided edits/retagging etc.

I've never heard of a case where a high-rep user was hacked by a spammer, I don't think wasting the time of a lot of users due to a largely theoretical concern is a good idea. The other two cases are real dangers that happen reasonably often.

I agree that some rate-limiting is necessary even for trusted users to prevent certain kinds of abuse. But I do think the limits should be implemented differently than they are currently, and I'd even go as far and to discontinue Captchas for reasonably high-rep users entirely and replace them with hard throttling. Of course this would be extremely annoying with the current limits, they would have to be implemented in a way that users would not encounter them during normal usage of the site.

One important part would be to make the limits less sensitive to short bursts of activity, e.g. by defining the limit over longer times and not as a hard limit between to actions. For example, instead of one edit every 10 seconds, allow 6 edits every minute. This would stop bot-like behaviour of users still pretty quickly, but it would not be triggered by common behaviour. Additionally, there could be a large per-day cap to limit the damage any user can do.

One could also take additional information into account to automatically detect harmful patterns. E.g. if many edits are reverted in a short time, it would make sense to block the user from editing for a while. The same could work for posts, using downvotes and flags as measure of harmfulness.

There would be a problem with large-scale editing or retagging, but on many sites preventing users from performing too many mass edits too quickly might stop them from flooding the frontpage. But we anyway need better tools to perform large-scale tagging operations, they are a complete pain at the moment on any non-SO site due to trashing the frontpage.

The /review path might need some special consideration, as it is encouraging behaviour that is likely to trigger the throttle mechanism.

But the biggest feature in my opinion that would allow more leniency with the anti-vandalism features would be a rewind option for user activity. Allowing moderators to undo all actions of a user since a certain point in time would make it pretty painless to reverse all consequences of a vandalism spree.

10
  • 3
    Account selling? Aug 14, 2012 at 12:09
  • 3
    @MartijnPieters Make me an offer I can't refuse.
    – yannis
    Aug 14, 2012 at 12:11
  • 1
    @YannisRizos How about one grand ? ;) Aug 14, 2012 at 12:12
  • 1
    @YannisRizos Okay,i'll ask Jon Skeet then :P (Like he would give it) Aug 14, 2012 at 12:17
  • 3
    Presuming you've seen Why is Captcha for higher rep users even necessary?
    – AakashM
    Aug 14, 2012 at 12:19
  • 1
    Other option you missed: a carefully concealed puppet ring that has voted itself up. Aug 14, 2012 at 12:28
  • 2
    @MartijnPieters that's pretty damn hard to do any extremely easy to deal with once it's found out. It's not worth pissing off hundreds of real humans to deal with one impossibly complex bot the SE team can wholesale delete if it ever actually is created
    – Ben Brocka
    Aug 14, 2012 at 12:39
  • @BenBrocka: Just enumerating the possibilities. :-) I've voted for this proposal myself, just want all angles covered. Aug 14, 2012 at 12:41
  • 1
    Nice try, robot Aug 14, 2012 at 14:52
  • 1
    "The account is hacked by a spammer" — why only a spammer? There's enough jerks around to just want to destroy stuff, like just because one likes to abuse someone's three-character Twitter account. I'm less afraid of spammers.
    – Arjan
    Aug 15, 2012 at 17:44

1 Answer 1

9

I have 49K and I've hit the captcha a lot in the past week - at least an order of magnitude more often than the 6 months prior.

I wouldn't mind if they were normally solvable on the first try, but it often takes me 4 or 5 tries. So I think something recently changed where the triggers for the captcha have become far more sensitive, and combined with the declining quality of the captcha images (something I hadn't noticed before because they weren't triggered very often at all, and may have been a gradual or sudden change, I'm not sure), it is downright frustrating.

I think the rewind feature you mention is a good idea in spirit, but implementation would be difficult. Think about cascading actions, like rage-quitter edits a post, then someone edits part of that, then someone adds a more constructive edit - I think the domino effect makes undoing just that rage-quitter's activity very difficult.

What I do think we should be seeing is a return to the rate-limiting behavior we enjoyed prior to this most recent change (and I don't think anyone can dispute that something has changed recently). Are these limits specified by Jeff two years ago still the set of rules that are in place? Have any been added / removed / changed? If so I think they need to be re-visited. At the very least I think the current set of rules should be thoroughly investigated to ensure they're working correctly. Something had to have changed to make this behavior so much more noticeable and annoying recently.

2
  • The explanation of the recent change is here: meta.stackexchange.com/a/143460/151385 Aug 14, 2012 at 12:59
  • 1
    @MadScientist I see, so it seems I am seeing captchas a lot more than I used to simply because I should have been seeing that same amount all along. Well, I think the sudden increase in frequency, combined with how abysmal those captchas are, makes this something we should be revisiting as a site.
    – Aaron Bertrand Staff
    Aug 14, 2012 at 13:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .