On: You probably don’t need ReCAPTCHA

[scarface74]

Microsoft’s implementation is the worse. I sometimes have a hard time deciphering the captcha. Why do they need that in an iOS app? Are robots emulating people from an iPhone?

[anchpop → scarface74]

The iPhone app probably communicates to some servers over an API of some kind - there's no reason someone malicious couldn't pretend to be an iphone and communicate over the same API

[arlk → anchpop]

and no reason someone malicious couldn't click-farm iPhones either.

https://gizmodo.com/thai-click-fraud-farm-busted-using-wall-...

[scarface74 → arlk]

Mechanical Turk style processing never ceases to amaze me.

[scarface74 → anchpop]

Actually, now that is think about it, Microsoft apps could only require a captcha if the username trying to log in doesn’t match the user’s previous iCloud user token.

I’m thinking about how Overcast uses a token linked to the user’s iCloud account and doesn’t require a username and password if you only use iOS devices. You can optionally add a username and password to access the web client.

[throwawaymath → scarface74]

> Are robots emulating people from an iPhone?

Many of the more sophisticated ones prefer emulating mobile application requests to web requests, so yes.

[gsich → scarface74]

User agent is quickly changed.

[tgsovlerkhgsel → gsich]

Doesn't iPhone have some sort of device attestation?

[scarface74 → tgsovlerkhgsel]

Can any iOS developers chime in? I know there has to be some type of server side validation to validate previous in app purchases. Could something similar tie a logged in iCloud user to an account?

[gsich → tgsovlerkhgsel]

In the browser?

[scarface74 → gsich]

The parent post was about using captcha in the app.