16 ms·
Introducing the Invisible reCAPTCHA
- mattbgates 10y agoI started making my own as Google Recaptcha was getting annoying. At its most basic, hide a field. On your PHP page that does the checking, simply see if that field has anything in it. If it does, its a bot. If it doesn't, it's not a bot.
- delta1 10y agoDo you use inline styles to hide the field or "obfuscate" it through a CSS class?
- mattbgates 10y agoIt just doesn't show up at all. Placed right before the form ends. I also use a combination of PHP and Javascript to create my own captcha. PHP generates a random string which I send to Javascript to hold. Upon clicking a button, if what is in the captcha does not match what is in the Javascript, thou shalt not pass. Haven't had any bot break through it yet, but I did have a Russian hacker email me, pissed off (entire email was in Russian, but I'm pretty sure the translator did well to know he wasn't happy), because he had created a bot specifically for my website that managed to create over 2000 posts in less than an hour. You can view the captcha at https://mypost.io/ https://mypost.io/ .. you cannot create a post without entering the captcha. I ended up creating my own because despite entering the correct answer (selecting the right images), Google Recaptcha would not recognize it.
- NoGravitas 10y agoI've seen this called "Honeypot CAPTCHA"[0]. I'd say it's good for 90% of sites, up until the point where spammers or fraudsters start targeting you specifically. [0]: http://haacked.com/archive/2007/09/11/honeypot-captcha.aspx/ http://haacked.com/archive/2007/09/11/honeypot-captcha.aspx/
- GordonS 10y agoI've started doing this on my HTML forms years ago - spam completely disappeared immediately. I haven't had any form spam since.
- garganzol 10y agoASP.NET AJAX Control Toolkit provided similar functionality since 2007. The corresponding component is called NoBot. http://www.ajaxcontroltoolkit.com/NoBot/NoBot.aspx http://www.ajaxcontroltoolkit.com/NoBot/NoBot.aspx "NoBot is a control that attempts to provide CAPTCHA-like bot/spam prevention without requiring any user interaction. This approach is easier to bypass than an implementation that requires actual human intervention, but NoBot has the benefit of being completely invisible." Works like a charm even now, 10 years later.
- Geee 10y agoDoesn't anyone else see it as a problem that Google's bots (and possibly CIA/NSA) can access any system using Google ReCAPTCHA? They can create unlimited amount of accounts on social networks, blogs, forums etc. and thus have unlimited social voting power on the Internet. There is a need for a decentralized Captcha that can't be circumvented by anyone.
- StavrosK 10y agoWould not having ReCAPTCHA prevent this?
- iainmerrick 10y agoUsing some other bot-filtering system would prevent it. Of course the makers of that filter would be able to bypass it, but I guess you could use multiple filters...!
- StavrosK 10y agoCan't you do that now, then?
- hmate9 10y agoGoogle owns google. If they really wanted to manipulate people they would manipulate their own search result and not go through the trouble of spamming other sites.
- wisebit 10y ago"Powering these advances is machine learning and a combination of threat yadda yadda" Looks like they do little more than just check for a Google cookie [1]. [1]. https://www.blackhat.com/docs/asia-16/materials/asia-16-Sivakorn-Im-Not-a-Human-Breaking-the-Google-reCAPTCHA-wp.pdf https://www.blackhat.com/docs/asia-16/materials/asia-16-Siva... edit: still, it's far better than the previous state of captchas. I'm glad they did this. But it's like for anything to be considered "advanced" or "good" in tech lately, it has to have been powered by "machine learning".
- xg15 10y agoWell, technically, it is machine learning. Only that the machine learning was likely part of the usual data mining on google accounts and not much specific to the captcha problem... (That said, whenever I used that checkbox widget they had before this announcement, there was a noticeable framerate drop in the browser while the thing was doing its magic. So I suspect, they are at least doing some browser fingerprinting/benchmarking to see if the widget runs inside selenium or a stock browser. I also remember rumors that they analyze keyboard/mouse input on the page and check if it looks "human", but I'm not sure if that's true.)
- mpeg 10y agoYeah it's basically browser fingerprinting (incl. GPU fingerprinting, hence the slowdown) plus google cookie. If your browser is standard (AKA no anti-fingerprinting plugins) and your advertising cookies are not blocked (privacy or adblocker plugins) you'll probably pass with no issues. If either of those is not true, you have to solve a bunch of image captchas. Mouse/keyboard input analysis was just marketing talk; at least when they first released the nocaptcha it wasn't even captured.
- r721 10y agoYeah, I have third-party cookies blocked and have never seen "i'm not a robot" captchas, it's "street signs"/"mountains" ones all the way.
- brangalinafoeva 10y agoHopefully that means it won't be complete shit like their current recaptcha.
- vasundhar 10y agoWhat does it mean to #Privacy ? Does it mean they track more of our behaviour ?
- vslira 10y agoI don't mean to imply this is some kind of evil monopoly conspiracy, but it is a bit ironic that Google helps websites avoid scraping. Edit for clarification: I'm not even saying it's wrong, just plain ironic
- Sir_Cmpwn 10y agoI would still like to see captchas being replaced by proof of work systems.
- cedex12 10y agoConcerning the general problem of captchas: What about paying a small fee instead of filling ever increasingly complicated forms. Say 10 cents. You could set up a service where the website's owner could decide whether the money goes to them or to, say, a foundation of their choice.
- Grue3 10y agoI remember when they advertised it with "you just need to click a checkbox". In reality, I always have to solve a streetview captcha, possibly several times in a row.
- mpeg 10y agoLet me guess, you use privacy enhancing browser extensions or adblockers? :)
- neurostimulant 10y agoAre you behind a NAT/VPN (i.e. your public ip is shared among many other users), or not logged in to google?
- lightedman 10y agoYet another CAPTCHA failure. Here's the problem Google needs to fix. If I'm logged into my account, years old, obviously not a complaint against it, I still end up getting this captcha nonsense. Doesn't matter the site.
- SN76477 10y agoI cant wait to get blocked out of a website and not know why.
- d--b 10y agoThey should add a contest to break it. Cause that sounds like the only real thing they can do is track the movement of the mouse / keyboard, and that sounds quite simple to fake.
- CiaranMcNulty 10y agoOr basically they already know who you are because you've got a fleshed-out profile from various other sites you use.
- espadrine 10y agoGoogle Analytics and Ads are present in a large portion of the Web. So it is much more difficult than that. It requires you to program the bot to follow a sequence of links unrelated to the bot's goal, idle on some pages, click links that make sense to the session, enter some text sometimes in comment fields — in essence, react to content the bot has never seen before. Google is betting that they can extract meaning from web pages better than bots, and they have had a lot of experience with that. On Web pages, each link does not have the same probability of being clicked by a human given the list of pages seen before. Knowing that probability requires the bot to understand what a human would see, and to perform actions that match a given goal which corresponds to the sequence of pages browsed. And that goal mustn't always be the bot's goal. Bots have business incentives: they want to get people to do something by writing text that will be seen by humans. Humans, on the other hand, only do so once in a while.
- visarga 10y agoThat whole page wasn't apple to explain WHY it is invisible and how it works if it's invisible.
- tyingq 10y agoGuessing it's your browsing history (courtesy of including js from a Google domain) plus mouse tracking. It doesn't seem much different than the current "click here" one to me. They are just letting the page owner substitute their own button in lieu of the check box.
- StavrosK 10y agoIs that why I always have to solve a challenge? Because I use Privacy Badger and uBlock Origin?
- mpeg 10y agoYes, recaptcha works based on advertising cookies.
- deleted 10y ago[deleted]
- vidyesh 10y agoWhat about non-logged users/sessions?
- tyingq 10y agoI assume it pops up a challenge, again, just like the current one. Edit: Yep. "Human users will be let through without seeing the "I'm not a robot" checkbox, while suspicious ones and bots still have to solve the challenges." It really is just the current one, with the site owner's button instead of Google's checkbox.
- daviding 10y agoIt's done by binding it to one of your own buttons, where I guess it does the 'jitter test' on that element (if it's a low risk IP). https://developers.google.com/recaptcha/docs/invisible https://developers.google.com/recaptcha/docs/invisible
- retrogradeorbit 10y agoWhat is "the jitter test"?
- danso 10y agoIf you asking for a demo of it in action: https://www.google.com/recaptcha/api2/demo https://www.google.com/recaptcha/api2/demo
- gregschlom 10y agoI would guess testing that the mouse pointer moves semi-randomly over the button, in a fashion typical of the way humans browse a web page
- reaktivo 10y agoI can't image it being limited to jitter, I'm curious how they handle touchscreens.
- Klathmon 10y agoSeeing how you scroll the pages how you click your finger, the speed that you tap elements. Honestly I feel mobile is easier to validate
- manojlds 10y agoWhat about the Tab and Enter users?
- p1mrx 10y ago
- macrael 10y agoGoogle using captchas to get humans to read street addresses captured by street view cars to improve maps results remains one of the most Googly things they've ever done. Genius, lateral, and a little weird.
- quentindemetz 10y agoGoogle didn't invent this: Luis von Ahn, a CMU grad student did in 2000. Google acquired it in 2009. https://www.cylab.cmu.edu/partners/success-stories/recaptcha.html https://www.cylab.cmu.edu/partners/success-stories/recaptcha...
- jpatokal 10y agoThe original pre-Google reCAPTCHA was used for digitizing books. Using it to read house numbers for Street View was a Google addition.
- bbarn 10y agoThe original inventor also went on to found Duolingo, which uses teaching someone a language as a way to translate web pages as a service. I like that model a lot more, as at least you get something in exchange (the language learning)
- joshuamorton 10y ago(am google) To be fair, if you use google maps, and don't have any ethical issues with helping googler, you do get a return on investment, in that you get improved ML capabilities and improved address recognition in google maps.
- dsp1234 10y agoThe above poster doesn't say that Google invented recaptcha, only that their use of it to have humans clean street view data is very Googly. The original recaptcha was only text from book digitization projects.
- malikNF 10y agoWhile I like the idea of not having to deal with these annoying ReCAPTCHA prompts, something somehow feels "intrusive ?". I mean does this mean google is going to keep track of what I would be doing when I visit a site? Say for instance I am signing up for a website, does the password I enter get sent to google servers to be analyzed now?
- return0 10y agoI expect to see more people putting recaptchas in their login screens, which means even more data funneled to google (after NSA i guess).
- Sir_Substance 10y ago>I mean does this mean google is going to keep track of what I would be doing when I visit a site? Oh buddy, I have bad news for you... https://support.google.com/dfp_premium/answer/1716364?hl=en https://support.google.com/dfp_premium/answer/1716364?hl=en https://www.google.com/analytics/#?modal_active=none https://www.google.com/analytics/#?modal_active=none https://www.doubleclickbygoogle.com/solutions/measurement/ https://www.doubleclickbygoogle.com/solutions/measurement/
- popol12 10y agoWow, I never heard of Pixel Tracking. That sounds super evil. Are there browser plugins to fight back on this one?
- dandelion_lover 10y agoI use RequestPolicy. It prevents a web-site to call another web-site unless I allow.
- r3bl 10y agoThey're an even bigger thing in emails. Usually, companies would include a pixel from an external resource and then figure out if you've read the email or not by looking at was that image loaded or not. IIRC, GitHub does that. If you read the email of some notification, it won't show you that notification in your notifications. The solution is to block external image loading in your email client (I know that Thunderbird has that, and I know that Zoho's email client on Android has that).
- greenhouse_gas 10y agoJust curious. What happened to all the data made by the old reCaptcha (the one that OCRed books). I know that they stopped the project, but did Google at least release the data (old public domain text of books)?
- dingdongding 10y agoI think that data is what made lot of old books searchable on Google Books.
- fiddlerwoaroof 10y agoWasn't recaptcha originally associated with Project Gutenberg's digitization efforts?
- fiddlerwoaroof 10y agoI guess not. https://en.wikipedia.org/wiki/ReCAPTCHA#Origin https://en.wikipedia.org/wiki/ReCAPTCHA#Origin
- greenhouse_gas 10y agoIt says there that it was. Seems like a bait-and-switch. Do free labor for a good cause (PD books), turns out you're just growing Goolge's library which can be taken down at a whim.
- icebraining 10y agoIt says there that it was. No, that was the Distributed Proofreaders project, which is unrelated (just used as an early example of crowdsourced OCR). reCaptcha originally helped digitized the archive of the New York Times, but that was finished years ago.
- rodionos 10y agoIs there a sample page somewhere, where I can 'see' the invisible recaptcha at work?
- illnewsthat 10y agoHere you go: https://www.google.com/recaptcha/api2/demo?invisible=true https://www.google.com/recaptcha/api2/demo?invisible=true
- kgdinesh 10y agoYou'll never know.
- vidyesh 10y agoThis is so confusing. It doesn't explain how it works nor a demo page nor the reason behind why it went invisible.
- halflings 10y agoAgreed. The documentation page [1] has much more information. [1] https://developers.google.com/recaptcha/docs/invisible https://developers.google.com/recaptcha/docs/invisible
- illnewsthat 10y agoHere is the demo: https://www.google.com/recaptcha/api2/demo?invisible=true https://www.google.com/recaptcha/api2/demo?invisible=true
- iaml 10y agoTo get the actual verification process open in incognito mode.
- markdown 10y ago> This is so confusing. Really? > It doesn't explain how it works nor a demo page Imagine a web form without reCaptcha. Do you really need a demo of that? > nor the reason behind why it went invisible. Because Recaptcha had an annoying, bad, terrible UX.
- flamtap 10y agoI also find it confusing. No need to be rude.
- mulmen 10y agoYou have done nothing to answer the GP. How does Google determine if the captcha should be shown? What are the "adaptive captchas" that are shown to suspect users? A demo would do a great job here. How does an invisible captcha "create value by applying human bandwidth" if the premise is that humans never see the captcha?
- kuschku 10y agoI'm wondering if this might not be illegal under several countries' data privacy laws. Users need to be directly and visibly be informed, if and when data of theirs will be transmitted to third parties. As Google's ReCaptcha is based on tracking what websites you visit, what search terms you enter, correlating this data, and comparing this tracking profile of yours, it's quite problematic that the user doesn't even see any captcha anymore. With the previous captchas, site owners could keep pushing the legal problems to Google, partially. But this new solution doesn't fit with the EU Data Privacy Directive in neither intention nor letter of the law. IANAL, this is not legal advice. You can not use this in court.
- termsfeed 10y agoTo use the reCAPTCHA service you must agree to its Terms of Service agreement that clearly specifies that you must inform users on the collection and use of the data collected by reCAPTCHA + get consent from EU users [1]: > You acknowledge and understand that the reCAPTCHA API works by collecting hardware and software information, such as device and application data and the results of integrity checks, and sending that data to Google for analysis. Pursuant to Section 3(d) of the Google APIs Terms of Service, you agree that if you use the APIs that it is your responsibility to provide any necessary notices or consents for the collection and sharing of this data with Google. For users in the European Union, you and your API Client(s) must comply with the EU User Consent Policy [...] The "EU consent policy" from Google is here: https://www.google.com/about/company/user-consent-policy.html https://www.google.com/about/company/user-consent-policy.htm... [1] https://termsfeed.com/blog/privacy-policy-recaptcha/ https://termsfeed.com/blog/privacy-policy-recaptcha/
- flamtap 10y agoI can see this easily addressed by a TOS. Even the subtle ones like "clicking that button means you agree to [link to TOS]" covers it, no?
- kuschku 10y agoNope, not at all. ToS terms and EULA terms are basically null and void for such things under EU law. You actually have to make a separate, opt-in checkbox, directly informing the user what will happen.
- albeebe1 10y agoI'd love to hear some commentary from someone involved in the business of bypassing captchas. I have to assume "google invisible captcha hack" is getting bid up right now.
- barbolo 10y agoEvery now and then I have to train models (mostly neural networks) that bypass captchas. My company provides web automation in Brazil, not for spam, not for marketing purposes. Sometimes the client has a website (like an intranet) that she wants to automate through screen scraping. I know it sounds stupid, but that is pretty frequent. The models are fast (most captchas solved under 100ms in AWS Lambda) and accurate (95 to 100%). I have about 40 different captchas being solved this way. My team is still working on a solution to nocaptcha recaptcha. The problem for me is not solving the challenges, but submitting them like a human would do. I'm progressing with chromium headless. As more and more sites add this captcha, I need to find a solution to automate it. And I'm confident I will find.
- turblety 10y agoMe too. If you want to spam or hack surely you'd just outsource the captcha solving to a cheaper country. Or even sites like 2captcha that give you 1000 solves for around 50c. You can still make a robot but just send the captcha to a service like that, and that's not even one of the cheapest ones. Especially when you consider what the real value of the data (or even spamming) is.
- return0 10y agonice, but that was the most uninformative video ever.
- rosstex 10y agoThe video is old, it has nothing to do with Invisible ReCAPTCHA.
- pymai 10y agoits quite simple. the boot kicks the ball, the balloon carries it up to the ferris wheel, the ball drops onto some vertical pully system and raises the red thingy, which then tells the browser that you are not a robot
- colept 10y agoWhat I want to know is what happens if you get 'trapped' in this invisible ReCAPTCHA? The most frequent encounters with CAPTCHA's I see are rejected API requests over VPN.
- chrisacky 10y agoI was browsing Upwork the other week and I got trapped. I couldn't load any more jobs, or view any more workers. I had to inspect the Network tab in Chrome, open the API request and then click a "I am not a bot" on their API page. That was a poor implementation tbh.
- SN76477 10y agoI get them too often on mobile.
- distances 10y agoI also expect I will start getting silent registration failures with this. I'm using uMatrix to block most third-party scripts, and it's usually quite clear when I have to allow extra things with traditional captchas. Then again, it's allow-more-and-retry on many pages already so nothing new in that regard.
- zumu 10y agoI always wondered how blind people entered captchas. Does this finally make captchas accessible?
- provemewrong 10y agoSpeaking of. Audio captchas are one of the most spooky things I've heard. Noise in the background and muddled voice listing numbers. Think numbers stations, except they try their best to make the numbers unintelligible (just like regular captchas tend to do with written words).
- mmcwilliams 10y agoI'm less aware of how the more modern captchas work under the hood, but I do know that the audio interface (provided for for accessibility) of an older version of captcha was used as an attack vector for defeating it. My understanding is that the optional audio file was run through an STT program to generate the answer text so that requests could still be automated. Translating speech to text is less computationally expensive than OCR, especially when captchas were typically using hard to read or intentionally distorted images of text. Someone who knows more about this than me can certainly school me on that last bit, however.
- janpieterz 10y ago'Good' captchas will have a short audio clip that can be played instead.
- davidpelayo 10y agoOf course not. It's still a pending issue they haven't yet solved.
- ry_ry 10y agoThere is usually an audio version available, presumably screen readers are pre-configured to present the audio option on popular captchas by default. I'm curious now, will have to give it a whirl when I get into the office :D Suspect Google will rely on their vast knowledge of people's browsing habits based off IP/account/ad-tracking/browser-fingerprinting to skip the user input aspects. Although that said, a screen reader won't have the standard physical interaction clues client-side that a user is a real person, mouse tracking for ex. is probably a moot point. Not really sure how Google will handle those, or if blind users will get a degraded always-on captcha experience. Either that or a headless screen reader becomes the scraping/botting tool of choice.
- bitmapbrother 10y agoSo I didn't see how it was done, but in a way that makes sense. I guess Google doesn't want to divulge what they're doing as to not give the bot makers any sort of insight on how it works.
- andy_ppp 10y agoI think this sounds like further and deeper (maybe multi page) tracking to build up a profile that Google deems acceptable. I think I'm off to train a bot to behave more like a human when it interacts with a webpage...