3 ms·

I have had to visit the #nixos channel in Freenode (IRC) lately on a computer with all tracking disabled and the Recaptcha that is usually just click and contin

I have had to visit the #nixos channel in Freenode (IRC) lately on a computer with all tracking disabled and the Recaptcha that is usually just click and continue becomes a multi-minute endeavor finding street signs, cars and buses. You really get punished if you opt out of tracking.

SquareWheel 8y ago
Which makes sense, seeing as they use account data and other heuristics to determine if you're a bot or not. The streetsigns are their fallback for when they don't have enough data.
- darkpuma 8y ago
  No, it's not that simple. When recaptcha particularly wants to punish a user they start fading in tiles which doesn't make the captcha any harder for ML to solve, it only frustrates real humans. Furthermore, when the security level of the captcha is configured by the web admin to the lowest level, users are able to use a noscript version of the captcha. When you do this, it becomes clear that the javascript version is deliberately rejecting correct answers to make you solve more and more challenges just because they're in the mood to fuck with you. This becomes clear because the noscript captcha from the same IP and same browser will accept the correct answer the first time, every time.
Crespyl 8y ago
I'm sure this isn't done, but I do have to wonder if it'd be possible to identify a user by their unique behaviors when interacting with the extended Recaptcha puzzles. Something like writing style analysis, but applied to patterns of mouse movement, click timings and positions, or recognition rates for particular types of problems.
- jamiek88 8y ago
  If it can be done it will be done seems to be the moral of these stories so lets hope not.
- justwalt 8y ago
  With a large enough dataset, I bet you totally could. But if someone were completely anonymous, it might require too many inputs for it to be practical in a one off situation. I’d guess you could identify someone with enough time after they got a new computer.

SquareWheel 8y ago

Which makes sense, seeing as they use account data and other heuristics to determine if you're a bot or not. The streetsigns are their fallback for when they don't have enough data.

darkpuma 8y ago
No, it's not that simple. When recaptcha particularly wants to punish a user they start fading in tiles which doesn't make the captcha any harder for ML to solve, it only frustrates real humans. Furthermore, when the security level of the captcha is configured by the web admin to the lowest level, users are able to use a noscript version of the captcha. When you do this, it becomes clear that the javascript version is deliberately rejecting correct answers to make you solve more and more challenges just because they're in the mood to fuck with you. This becomes clear because the noscript captcha from the same IP and same browser will accept the correct answer the first time, every time.

Crespyl 8y ago

I'm sure this isn't done, but I do have to wonder if it'd be possible to identify a user by their unique behaviors when interacting with the extended Recaptcha puzzles. Something like writing style analysis, but applied to patterns of mouse movement, click timings and positions, or recognition rates for particular types of problems.

jamiek88 8y ago
If it can be done it will be done seems to be the moral of these stories so lets hope not.
justwalt 8y ago
With a large enough dataset, I bet you totally could. But if someone were completely anonymous, it might require too many inputs for it to be practical in a one off situation. I’d guess you could identify someone with enough time after they got a new computer.