4 ms·

I've seen this a week ago on reddit. The researched told google about this vulnerability and Google doesnt care about it, they are totally OK with it. You can s

by akerro 8y ago

I've seen this a week ago on reddit. The researched told google about this vulnerability and Google doesnt care about it, they are totally OK with it. You can see here that captcha doesn't block robots, but blocks people and makes browsing inconvenient. reCaptcha is a way google mines data from us for free.

nolok 8y ago
Oh please, what a total joke of a comment. > Google doesnt care about it, they are totally OK with it Google hasn't said they don't care about it, where did you see any of that ? They merely allowed the code to be released despite it still working against the current. Previous experience (namely the original uncaptcha) prove that they intend to find a way to fix it. > You can see here that captcha doesn't block robots, but blocks people and makes browsing inconvenient. Total BS, remember it's not Google that uses it, it's website owners (us), if what you claim was indeed true we wouldn't be using it, we would use something else that did what we wanted. > reCaptcha is a way google mines data from us for free. Of course, through the visual selection it displays when "unsure", although I do not know the detail it seems pretty obvious that once it's sure you're human it sometimes ask you to detect things in picture anyway so as to provide training data (for maps, waymo, image search, whatever ...)
- Boulth 8y ago
  >> Google doesnt care about it, they are totally OK with it > Google hasn't said they don't care about it, where did you see any of that ? Check this out: > The Recaptcha team is aware of this attack vector, and have confirmed they are okay with us releasing this code, despite its current success rate. Source: https://github.com/ecthros/uncaptcha2/blob/master/README.md https://github.com/ecthros/uncaptcha2/blob/master/README.md
  - swsieber 8y ago
    The parent addressed that in the next line. > They merely allowed the code to be released despite it still working against the current. Previous experience (namely the original uncaptcha) prove that they intend to find a way to fix it.
- avian 8y ago
  > if what you claim was indeed true we wouldn't be using it Not saying this is the case here, but cargo culting does exist in tech, so this is quite a weak argument in my opinion.
  - nolok 8y ago
    I 100% agree but it's not like captcha are a complicated things or that we didn't all more or less switch to it from something else. I can say for my current needs right now that if created a non-subscriber posting content page tomorrow I would use a captcha because it removes enough bot to be worth it, and I would go with recaptcha because I find it the better one for end users (I as a user prefer to see it on websites compared to other solution).
- jsnell 8y ago
  I have literally never been asked to solve one of those image recognition recaptchas in my main browser profile. (While it happens once a month in incognito windows.) So it's not at all obvious that known humans are being asked to solve captchas just for the purposes of training.
  - nolok 8y ago
    For the record, the one I meant are the second solving: sometimes recaptcha ask you one (I believe it is genuine), and then after you succeed it ask again with another set of picture (sometimes another question), which I believe is for training. I have it semi-regularly (like once or twice a week); but I also have some automated tooling using my account AND I travel quite often so location testing probably flag we as weird. Remember that the original recaptcha also did that with text to help train OCR (it would send a known word and a unknown word, if you succeeded at the known word it would record the answer for the unknown one, and after enough people gave the same one train it as the proper OCR'ed text).
    - jobigoud 8y ago
      "second solving"? I've sometimes been asked ten times in a row to click on the shop fronts or traffic light tiles.
      - saagarjha 8y ago
        I feel that this depends on how fingerprintable your browser is. Signed in to Chrome? You’ll likely see nothing. But logged out and using Safari’s Private Browsing? You will likely have to do it multiple times.
        Izkata 8y ago
        I have the feeling this is also configurable somewhere. A few months ago, my bank added the image-clicking one to its login screen. I've always gotten past that one on the first attempt. But with the same profile on the same Firefox, all other sites always take multiple tries.
- birksherty 8y ago
  100% nonsense. When I use Firefox with 3rd party cookie blocked, it does not accepts my correct answers. Waste 5 minutes of my life to beg google to let me in. Allow 3rd party cookie, log in to google and I only have to check a box. Same when I use VPN, it does not accept any of the correct answers. So when Google sees that I am trying to protect my privacy, it punish me by having to work for them. One more thing. If try to use audio challenge in the first case, it directly told me that I am using some method to solve captcha and they won't allow it. So much fun.

by akerro 8y ago

nolok 8y ago

Oh please, what a total joke of a comment. > Google doesnt care about it, they are totally OK with it Google hasn't said they don't care about it, where did you see any of that ? They merely allowed the code to be released despite it still working against the current. Previous experience (namely the original uncaptcha) prove that they intend to find a way to fix it. > You can see here that captcha doesn't block robots, but blocks people and makes browsing inconvenient. Total BS, remember it's not Google that uses it, it's website owners (us), if what you claim was indeed true we wouldn't be using it, we would use something else that did what we wanted. > reCaptcha is a way google mines data from us for free. Of course, through the visual selection it displays when "unsure", although I do not know the detail it seems pretty obvious that once it's sure you're human it sometimes ask you to detect things in picture anyway so as to provide training data (for maps, waymo, image search, whatever ...)

Boulth 8y ago
>> Google doesnt care about it, they are totally OK with it > Google hasn't said they don't care about it, where did you see any of that ? Check this out: > The Recaptcha team is aware of this attack vector, and have confirmed they are okay with us releasing this code, despite its current success rate. Source: https://github.com/ecthros/uncaptcha2/blob/master/README.md https://github.com/ecthros/uncaptcha2/blob/master/README.md
- swsieber 8y ago
  The parent addressed that in the next line. > They merely allowed the code to be released despite it still working against the current. Previous experience (namely the original uncaptcha) prove that they intend to find a way to fix it.
avian 8y ago
> if what you claim was indeed true we wouldn't be using it Not saying this is the case here, but cargo culting does exist in tech, so this is quite a weak argument in my opinion.
- nolok 8y ago
  I 100% agree but it's not like captcha are a complicated things or that we didn't all more or less switch to it from something else. I can say for my current needs right now that if created a non-subscriber posting content page tomorrow I would use a captcha because it removes enough bot to be worth it, and I would go with recaptcha because I find it the better one for end users (I as a user prefer to see it on websites compared to other solution).
jsnell 8y ago
I have literally never been asked to solve one of those image recognition recaptchas in my main browser profile. (While it happens once a month in incognito windows.) So it's not at all obvious that known humans are being asked to solve captchas just for the purposes of training.
- nolok 8y ago
  For the record, the one I meant are the second solving: sometimes recaptcha ask you one (I believe it is genuine), and then after you succeed it ask again with another set of picture (sometimes another question), which I believe is for training. I have it semi-regularly (like once or twice a week); but I also have some automated tooling using my account AND I travel quite often so location testing probably flag we as weird. Remember that the original recaptcha also did that with text to help train OCR (it would send a known word and a unknown word, if you succeeded at the known word it would record the answer for the unknown one, and after enough people gave the same one train it as the proper OCR'ed text).
  - jobigoud 8y ago
    "second solving"? I've sometimes been asked ten times in a row to click on the shop fronts or traffic light tiles.
    - saagarjha 8y ago
      I feel that this depends on how fingerprintable your browser is. Signed in to Chrome? You’ll likely see nothing. But logged out and using Safari’s Private Browsing? You will likely have to do it multiple times.
      - Izkata 8y ago
        I have the feeling this is also configurable somewhere. A few months ago, my bank added the image-clicking one to its login screen. I've always gotten past that one on the first attempt. But with the same profile on the same Firefox, all other sites always take multiple tries.
birksherty 8y ago
100% nonsense. When I use Firefox with 3rd party cookie blocked, it does not accepts my correct answers. Waste 5 minutes of my life to beg google to let me in. Allow 3rd party cookie, log in to google and I only have to check a box. Same when I use VPN, it does not accept any of the correct answers. So when Google sees that I am trying to protect my privacy, it punish me by having to work for them. One more thing. If try to use audio challenge in the first case, it directly told me that I am using some method to solve captcha and they won't allow it. So much fun.