29 ms·
Why can’t a bot tick the 'I'm not a robot' box?
- fubaron 8y agoWell, that's not completely true: https://www.youtube.com/watch?v=fsF7enQY8uI https://www.youtube.com/watch?v=fsF7enQY8uI
- doubletgl 8y agoDoesn't that particular Captcha also work in an incognito browser? I don't see where all this complexity comes in. You simulate the mouse movement and the click. Your browser pretends to not be able to run webgl, so no ghost image. Forcing the user to have a history with google services would lock everyone out who's new. The user agent and other browser metadata is easy to fake.
- miguelmota 8y agoAs a user who's constantly clicking on the crosswalk or storefront images you can't help but to think that you're essentially working for free training Google's machine learning models by providing them with supervised data points.
- tracker1 8y agoThat's what ReCaptcha always was... it was originally a known and another unsure text blurb from scanned books/text documents. Now it's street signs etc.
- rococode 8y agoIt's actually pretty interesting to see how the captchas have evolved as, presumably, Google decides "OK, we have enough data to consistently identify this thing" and moves on to the next challenge. I recall the modern (non-text) captchas used to be cars pretty much every time. Then, the images started getting grainier as they apparently wanted to improve their recognition in different conditions. Then crosswalks and store fronts became quite common, eventually with the same kinds of noise distorting images. Now I've started seeing things like buses, bridges, motorcycles, bicycles, etc. It feels like they've finished getting enough data for improving Google Maps and have begun moving towards collecting data for their self-driving car projects.
- cmroanirgo 8y agoYep. With the possibility of almost uniquely identifying us on the web through fingerprinting... Google, of all companies is in the perfect position to know that my web request was made by me... And therefore I'm not a robot. You can only conclude that recaptcha is a ml training exercise.
- bpicolo 8y ago>You can only conclude that recaptcha is a ml training exercise. They're not secretive about it https://developers.google.com/recaptcha/ https://developers.google.com/recaptcha/
- DigitalBison 8y ago> With the possibility of almost uniquely identifying us on the web through fingerprinting... Google, of all companies is in the perfect position to know that my web request was made by me... And therefore I'm not a robot. The article explains that this is part of what reCAPTCHA does, e.g.: > Finally they combine all of this data with their knowledge of the person using the computer. Almost everyone on the Internet uses something owned by Google – search, mail, ads, maps – and as you know Google Tracks All Of Your Things. When you click that checkbox, Google reviews your browser history to see if it looks convincingly human. But your point is otherwise right in that it's used for ML training, which Google admits as another commenter pointed out.
- gregknicholson 8y ago> Finally they combine all of this data with their knowledge of the person using the computer. Almost everyone on the Internet uses something owned by Google – search, mail, ads, maps – and as you know Google Tracks All Of Your Things. Human [n]: Entity that uses Google®-brand services. — Google Dictionary, 2020 edition
- felipemnoa 8y agoMaybe, maybe not. From time to time google forces me to prove I'm not a robot because of unusual search queries. Either my queries are unusual or I have an infected computer. The thing is, it also happens to me on my iPhone. Or, maybe they feel I'm not pulling my own weight, seeing as I rarely ever click on adds. They probably need more monkeys to feed the beast so I get selected to train their AI beast. Edit: It could also be that I'm always running on incognito mode.
- gcb0 8y agothey stopped using the text because some forum campaign that promoted typing cursewords instead of the unkown word. they probably started showing cursewords on the rendered search highligths on google books. there was a decent write up from a whitehat showing the damage, but I can't find it
- ianferrel 8y agoCite? I can't imagine some forum has enough traffic to meaningfully screw up their data, and they don't tell you which of the two words is the unknown word, so you're just going to fail a lot doing that.
- foxhop 8y agoIt was very obvious which was which and you had a 50/50 chance. I can confirm this used to work and I always used a curse word plus the known word.
- jachee 8y agoSounds like something 4chan would advocate.
- Leherenn 8y agoIt was pretty big on 4chan at least at some point in the early 2010's. And the unknown word was always the hard one to read iirc.
- have_faith 8y agoThis was extremely common on 4chan maybe 7 or so years back I can't remember the exact year and it worked for a very long time before anything was done about it and everyone knew to do it. Google asked for two words and presented them as two different fonts. The real word that needed transcribing was always identifiable and you could just write what you wanted as long as you got the second test word correct. Much fun was had.
- darkpuma 8y ago4chan was doing it specifically with a six letter racial slur that's unrepeatable.
- forgotmypw2 8y agoDon't forget the bonus: all your forum accounts can be linked to your google account, just in case you didn't use your gmail as the email address.
- nerdponx 8y agoThat's what really kills me here. This is lock-in at least as bad as the Equifax situation.
- peteretep 8y agoSelf-destructing cookies is a solution
- mcv 8y agoNot if Google has collected enough other identifying information about you to determine whether or not you're a robot. But I'm kinda hoping that the reason I keep having to identify cars and store fronts is that my refusal of third-party cookies is causing them to have no idea who I am. But that might be the optimistic view. In any case, I wouldn't mind if sites stopped using recaptcha.
- rapnie 8y agoIsn't there a good OSS alternative for ReCaptcha?
- dfabulich 8y agoCaptchas inherently require some security by obscurity; they're not a good fit for OSS solutions.
- ummonk 8y agoThe Turing test. Have one of your ops chat with them to see if they’re a bot.
- mcv 8y agoI'm doubtful about any good solution for having computers decide whether we are sufficiently human.
- speedplane 8y ago> I'm doubtful about any good solution for having computers decide whether we are sufficiently human. Two questions: - Couldn't a computer just temporarily hire a human to prove there is a human involved? - Why are we using recaptcha or verifying humanity anyway? I understand stopping spam, scams, and fraud, but scraping already public data doesn't present significant harm.
- NeedMoreTea 8y agoHelping scan all the world's books as part of a plan to make them freely available to all is much easier to get behind than tuning map objects for their self driving cars. Particularly when most books that were scanned never, ever showed up on Google books.
- CamperBob2 8y agoOTOH, succeeding at self-driving cars has the potential to save lives by the thousands.
- johannes1234321 8y agoAnd if they succeed to much they can monopolize transportation and thus mobility. Not a power I want to have in a private company. Especially not in a company from outside my country's jurisdiction. Where I can't have an impact via democratic law making process.
- thomaslangston 8y ago> Especially not in a company from outside my country's jurisdiction. Where I can't have an impact via democratic law making process. This is false. EU governments have already placed significant restrictions and fines upon US tech companies in the past. There is no reason to believe that they won't be able to again.
- yholio 8y agoThose fines are the perfect representation of the lack of control EU has over US tech giants. They are essentially opaque and impossible to inflence through normal regulatory and political channels so the only options are the big guns. You can be sure Google is not going to heavily invest in the EU tech sector under such adversarial set-up. There's a subtle blackmail here: we push the envelope as far as it goes and the EU can choose to submit or risk technological backwardness. It's a great situation for the US economy but a very bad strategical position for Europe.
- Larrikin 8y agoIdentifying text for public domain works that Google is making available online is much different than forcing the web to train their models for their profit.
- littleweep 8y agoI've been thinking about this a lot lately. Where is our compensation? It's our time and brain power training Google's AI that will one day be sold back to us. I'm really not into this.
- bonestamp2 8y ago> Where is our compensation? When you search for an address on google maps, that little tiny house number on the house was once a captcha image and now google knows that number so it can take you to the exact location on a map when you search for that number. Everyone helps train the machine so when they want something from the machine then the machine is better at finding what they asked for. That seems pretty democratic to me.
- lallinuo 8y agoYou might be interested what https://hcaptcha.com https://hcaptcha.com is doing.
- foxhop 8y agoWow thanks for this, I added myself to the waiting list. If you use my referral URL I get a bump in the queue: https://hcaptcha.com/?r=29d830be7540 https://hcaptcha.com/?r=29d830be7540
- pbhjpbhj 8y agoCan we get a hcaptcha pyramid scheme going, https://hCaptcha.com/?r=d6064d5f22b7 https://hCaptcha.com/?r=d6064d5f22b7 ...?
- hombre_fatal 8y agoI don't really understand the case where you'd use this. First, it seems tacky scrounging for peanuts from the users' captcha work. Or it's like a product/services website showing Adsense ads. It's a cheapening message to send. Second, since you make more money from more captcha volume, you're incentivized to maximize your use of captcha which is at odds with every complaint in this comments section about captcha. Most sites only use captcha to gate low-volume actions like register/login (e.g. HN). They created their own Ethereum token too which always puts a bad taste in my mouth these days. Finally, it doesn't address the upstream complaint that someone else is profiting off the user's "work" rather than the user. Though I don't find that complaint very reasonable. And a tiny fraction of a cent sounds about right. The truth is that users benefit from anti-abuse systems. The number of bots that HN's recaptcha on register/login has stopped is worth that tiny fraction of a cent to most users.
- charlietango92 8y agonot trying to be facetious, isn't that (half of) the point?
- paul7986 8y agoOne solution is to remove Google out of your life as best as possible. Personally I now use... - iCloud.com instead of Gmail - DDG for search though I do have to !g like 20 to 30% of the time for things like driving directions (from X point to Y point), local movie times nearby and flights. I still use - YouTube - Google Maps some as its great for getting distance between X and Y - Google News (is there a better substitute) - Google Photos (is there anything that compares) Hoping in time to rely a ton less on Google products.
- bo1024 8y agoNot a solution in this case - the problem is that companies like Cloudflare use these captchas to slow down your visit if you are using Tor or a VPN. In fact being logged in to google probably helps you bypass these checks
- pbhjpbhj 8y agoWhat is it in particular about GPhotos you find incomparable?
- robjan 8y agoDo you have any alternatives? Something that works on most platforms and allows you to automatically backup photos as they are taken.
- tirpen 8y agoDropbox has had automatic photo backup for ages and is available on most platforms.
- pbhjpbhj 8y agoNo, I don't, I was just curious -- I used to use Picasa and it's facial recognition was far superior to anything else I could find. Flickr app has auto upload from Android at least, I'd guess Flickr as Google photos closest competitor?
- sekasi 8y ago
- dawnerd 8y agoFor a while there they kept saying I was wrong and it would effectively lock me out of some accounts that required it. Recently it’s stopped but it’s super annoying how ambiguous it is.
- Old_Thrashbarg 8y agoYes, especially when they show you about 15 sets of images in a row taking 2 minutes to complete, clearly going beyond demonstrating you're human.
- chrischen 8y agoI think they only do that if you get the first set wrong.
- pipelineist 8y agoDoesn't reflect my experience.
- _jal 8y agoMore and more frequently when presented with a captcha, I've been deciding I don't care enough about whatever it was to want to exchange robot training for access. Especially if they pull that shit after I've spent effort on something (a comment, say) - I will absolutely walk away and not come back. Manipulative user-hostile websites can rot.
- steelframe 8y agoThe Cascade Bicycle Club in the Pacific Northwest threw me into one of these multi-minute Captchell vortexes when I tried to log in to my years-old account to renew my membership and register for one of their organized rides. I was already on the fence as to whether it would be worth paying to do these rides that I have already done several times over the years. That (ironically) dehumanizing experience pushed me over the edge. I didn't complete the Captchas, didn't log in, didn't renew my membership, and didn't register for anything this year.
- snarkyturtle 8y agoThere's an xkcd for that https://xkcd.com/1897/ https://xkcd.com/1897/
- hedora 8y agoI suspect you could replace the entire mess described in the post with: what's the logged in account's spaminess? followed by, what are the doubleclick cookies' spaminess? You could further approximate that with: "How much does Google's AI think this human's time is worth in future revenue?" I for one intentionally inject errors into their image classifier until it lets me in anyway.
- mcv 8y agoI'm now wondering if the fact that I block third-party cookies is the reason I always have to identify cars and store fronts. Maybe I should just avoid sites that use recaptcha.
- amelius 8y agoWho says it's for training? ;)
- richjdsmith 8y agoI always try and click one or two extra boxes that are wrong. Sure I sometimes have to go through and confirm extra images, but you know what? I don't work for free and so I'm doing my small part to bugger up Google's data set.
- pipelineist 8y agoI've recently made a discovery that pleases my petty side. You know how they usually give you several questions to solve, even if you're quite convinced you solved a question correctly? Turns out if you click randomly, they keep showing you new questions as well. If, after a handful of purposely wrong answers, you answer one correctly, they let you through. I now purposely mess up the answers a few times. It seems neither slower nor faster than actually taking the time to do it right, but it takes less mental load, and it makes me not feel like doing slave labour for a machine.
- djflutt3rshy 8y agoThe box has made browsing using TOR insufferable! It fusses and makes me click storefronts and traffic lights until I run out of patience and close out of whatever webpage I was trying to visit. I assume it has to do with a lack of Google cookies on the browser, essentially punishing me for trying to protect my privacy.
- modzu 8y agoget this. https://addons.mozilla.org/en-US/firefox/addon/buster-captcha-solver/ https://addons.mozilla.org/en-US/firefox/addon/buster-captch...
- superkuh 8y agoI guess Mozilla hasn't noticed that one yet. They've been removing captcha bypassing add-ons from their site. And because all Firefox versions that aren't buggy require add-ons to be signed by Moz it makes distributing them through other channels rather tedious.
- modzu 8y agowhat moz should really be doing is removing captchas from websites, not the captcha-bypass add-ons ;)
- deleted 8y ago[deleted]
- teilo 8y agoThose images are infuriating! Click all boxes with traffic lights. Ok, well, this one box just barely contains the bottom right corner of the traffic light. Click. Nope, that little corner didn't count. Try again. Ok, well on this one, the right side of the traffic light is only barely over the line, so I won't click it. Nope, that sliver of the light mattered this time. MF!
- jsgo 8y ago
- deleted 8y ago[deleted]
- ddebernardy 8y agoWhen trying to detect ad fraud, one problematic scenario is that of replay attacks. It's basically when a scammer records human behavior on a site, and then replays a mix of actual their sessions to fraudulently click an ad. The Quora answer is interesting but it's not clear to me whether the "I'm not a robot" box cannot be defeated in a similar manner.
- deleted 8y ago[deleted]
- manifestsilence 8y agoIt seems like they make that hard by mixing semi-random elements that are different each time, like user interaction data, with the user's browser fingerprint and location. This seems to be why they go to such lengths to obfuscate the algorithm they use to combine these elements. If the pseudorandom and the fixed elements were easy to separate it would make replay attacks much more feasible.
- amirhirsch 8y agoI work on bot detection at hCaptcha.com. (Hiring: reach out if you want to apply machine learning to stop bots and help websites monetize their traffic without ads) In order to successfully execute a replay attack you would also need to pass the Turing Test, i.e. click the correct images. If you design a bot that starts a combinatoric attacking by trying random guesses we can easily confuse it, so most attackers try to use a solver service. We can also identify how you interact with semantic content in the images when you click on the image and characterize your mouse interaction as human or non-human. Since confidence increases as more results come in we can also run them after the initial pass and then shadow-ban bots. (And notify the targeted website that we have determined e.g. a particular signup is a bot.) Ultimately, many techniques beyond simple correct/not-correct are required to defend against the main attack vector: humans hired to solve captchas en-masse and make thousands of fake accounts. Modern ML is pretty effective for these kinds of problems. Browser obfuscation does not add real security, and today's reCAPTCHA (all versions) is easily defeated in practice.
- 8y ago
- CodeMage 8y agoIs there any place where I can find a comprehensive list of countermeasures to stop Google from recording and analyzing all the stuff that the article lists? According to the article: It turns out they record and analyse: - Your computer’s timezone and time - Your IP address and rough location - Your screen size and resolution - What browser you’re using - What plugins you’re using - How long the page took to display - How many key presses, mouse clicks, and tap/scrolls were made And ... some other stuff we don’t quite understand.
- pixl97 8y agoTurn off javascript, mostly. To hide your ip you need to use a VPN.
- scrooched_moose 8y agoIs noscript still the best for that? I haven't looked at other options in a long time.
- kevingrahl 8y agoIf you want more granularity I’d suggest giving uMatrix a try. You’ll basically break every site at first and have to make adjustments for every site you visit (whitelist certain Ressourcen on a per domain basis) but I think it’s well worth it. NoScript (which is totally fine) just blocks all JS, uMatrix can block much more.
- shpx 8y agoNoScript lets you whitelist sites. Chrome's built in Javascript blocking is about as usable. Settings -> Privacy and Security -> Content Settings -> Javascript and then change "Allowed" to off. You can white list a domain by clicking on the padlock or the thing that says "Not Secure" in the URL bar on the left and clicking "Site settings" and changing Javascript to Allowed. In my opinion, the only real effect JS blocking has is you start complaining in HN comments about sites not working.
- deleted 8y ago[deleted]
- meritt 8y agoA bot absolutely can, you just need to use a more sophisticated bot. This article [1] is from August 2017, so the arms race has escalated and techniques improve, but the gist is the same: You just do a better job of simulating the "human" characteristics they monitor. Gen 4 bots (bots that run on an infected user's machine) can circumvent these measures as well. [1] https://intoli.com/blog/making-chrome-headless-undetectable/ https://intoli.com/blog/making-chrome-headless-undetectable/
- wulfmann 8y agoThis has been done: https://www.youtube.com/watch?v=fsF7enQY8uI https://www.youtube.com/watch?v=fsF7enQY8uI
- mnorton 8y agothis should be at the top, dammit
- _the_inflator 8y agoPut another way: basically this is another Google tool to track user behaviour that validates the fingerprint Google already has. Sneaky!
- scarejunba 8y agoHonestly, if there were a web standard where I could opt-in to all of this tracking and it meant I would be ‘trusted’ I’d happily have my user agent send them almost anything they want. I trust Google not to fuck me.
- jiveturkey 8y agoTFA is not very clear about what it's describing. It is describing how the checkbox is collecting your browser's characteristics (eg they go to great length describing the webGL fingerprint) and your own characteristics (eg mouse behavior), such that when you click the box, you are determined to be a person or a bot. If they think you are a person, you don't have to do the CAPTCHA. The whole bit about a double encrypted "VM" is overstating the case. The "VM" is "just" a bytecode interpreter, which at the end of the day can't do anything the browser's javascript engine can't do itself. Yes, it's some heavy obfuscation, and what's more interesting than the interpreter itself is the decision to spend what must have been lots of time/resources to develop it. It's security by obscurity, and in this case it is delivered to the client so obviously it's reversible. Maybe there's a deeper purpose. EDIT: ah. the purpose is not to obfuscate. it is to fingerprint the CPU characteristics. by running their own interpreter, and changing the opcodes on the fly and such things, they can defeat JIT and learn something about the CPU itself. if they have user info (google cookie) they can know what CPU/CPUs that user typically uses and if "the checkbox" records something different it's a signal.
- modzu 8y agothe answer is basically wrong. robots can and do. captcha has become an AI training tool and it now blocks humans as a consequence. the convenient side-effect being a nudge to those humans to change their behaviour in such a way as to never need captcha and thus support google's business: enable cookies, login to google, use unique identifiers (IP), etc
- hexo 8y agoWhy can't I just run headless chrome of firefox and have my bot click it there? "Aha here it is, so I click using system 'fake' mouse click". where's the catch?
- wmf 8y agoThe script can detect the difference between real Chrome and headless Chrome.
- noir_lord 8y agoPoint a webcam at the screen and wire a mouse to the computer controlling the webcam, you'd have to simulate the computer moving the mouse like a human would but I don't see why it wouldn't work.
- eseehausen 8y agoBecause humans still get the picture selection prompts, so you'd have to write code good enough to read the prompt and then select the appropriate images.
- joshuamorton 8y agoYou've now forced spammers to purchase webcams. And write code or whatever to make realistic mouse movements. This is expensive. Whatever they're doing likely isn't worth it anymore.
- cr0sh 8y agofake-users-as-a-service business op? I can see it being possible - racks of "robot arms" that move mice based on whatever criteria is needed (in this case, reCaptcha). It works for 3D printing, as well as device testing - so in theory, this could be done too...
- noir_lord 8y agoHave the ‘AI’ solved the I’m not a robot and kick the street view stuff to a human. It’s always going to be an arms race I guess.
- eridius 8y agoLately I've been getting reCAPTCHA prompts all the time even though I'm not browsing in incognito mode and haven't cleared cookies. All I'm doing is running a very basic ad blocker, using Safari (which blocks third-party tracking), and very rarely loading a Google site. The most interaction I have with Google is when I end up having to use my corporate Google account as SSO for some other site. Given that I'm not doing anything unusual, it really feels to me like reCAPTCHA, for all its complexity, boils down to "what's your history using Google software? Oh you rarely use it? I'm gonna give you a captcha". It didn't used to be this aggressive, but it's really ramped up in the past few weeks.
- kevin_thibedeau 8y agoRandomized user agent also seems to trigger reCAPTCHA without real cause. Should be an ADA violation for doing that.
- rtkwe 8y agoADA? Americans with Disabilities Act? Why would that have any bearing on user agent randomization?
- Mirioron 8y agoI think he means that having people fill out recaptcha all the time because they don't allow Google to track them should be an ADA violation.
- rtkwe 8y agoAgain I still don't see how not wanting Google to track you should qualify as a disability under the ADA.
- Mirioron 8y agoNonono, disabled people might be barred from using a service because of excessive recaptcha. That's what he means. I also think he really meant CVAA rather than ADA though.
- rotrux 8y agohttp://sikulix.com/ http://sikulix.com/
- bluedino 8y agoThey encrypt it twice? Forget about it, then.
- orblivion 8y agoTriple distilled, with two scoops of raisins.
- ryantgtg 8y agoTotally anecdotal: Back when I was using a vpn and would see this recaptcha more often, I found that the recaptcha would often declare me a bot (and give me a second chance) if I clicked the boxes too quickly. Like, the storefronts would load and I'd immediately click+click+click+click then submit. But if I slowed down and staggered my clicks, it would realize I'm just another inefficient human who needs time to move a mouse and make decisions.
- taftster 8y agoRight. I think I have seen similar behavior for mouse movement as well. Not sure, but I think moving your mouse around randomly helps as well. The timing of picking the images, as you say, helps. As does the order you pick them in. Of course, I think the biggest thing is your browser's fingerprint. If you are using a lot of privacy blocking addons, etc. you are going to be spending a lot of time looking at captchas.
- yalogin 8y agoCan anyone point me to the virtual machine and encryption mechanisms used by Google, as was alluded in that link?
- deleted 8y ago[deleted]
- xirdstl 8y agoI feel a sense of dread whenever I see this box. Is it going to let me through, or am I going to spend the next few minutes futilely clicking signs and lights, only to give up and leave the site?
- sk1pper 8y agoGlad I’m not the only one. I thought something was wrong with my brain. Or that I might be a robot.
- toxik 8y agoCounter anecdote: I was actually never rejected though I’ve been subjected to the picture test multiple times. Most of the time I just get through, though it is hard not to sigh and roll your eyes when presented with one. Annoying as they are, I don’t really see a better alternative. They’re also pretty easily circumvented with cheap labour like mechanical turk and similar services.
- sgolestane 8y ago01001000 01100101 01101100 01101100 01101111 00100000 01100110 01100101 01101100 01101100 01101111 01110111 00100000 01110010 01101111 01100010 01101111 01110100
- snazz 8y agoFor those of you who don’t get it, this is ASCII text in binary.
- benologist 8y agoSomeone is suing Apple for making 2FA too annoying, I only hope Google can be next for the significantly greater time being wasted on their stupid CAPTCHA. Why should any of us even care if someone accesses a website programmatically? It's almost definitely not my problem, and it's not even necessarily a problem it's just a way to access pages, made easier by Google in fact because it's a perfectly legitimate way to navigate the internet and Google themselves depend on it. If anyone wants to discourage it just provide an official API to use instead of pages, which are a defacto API for humans. https://github.com/GoogleChrome/puppeteer https://github.com/GoogleChrome/puppeteer https://www.trustedreviews.com/news/apple-hit-two-factor-lawsuit-alleging-2fa-disruptive-3657342 https://www.trustedreviews.com/news/apple-hit-two-factor-law...
- partiallypro 8y agoEvery time I fill one of these out I get the picture test, and I answer them correctly...but am asked 3-5 times to identify which blocks contain a school bus or stop light. It's very annoying.
- ivanbakel 8y agoI think it's speculated that you're recorded as being a useful classifier if you answer correctly on initial test captchas, so you get given Google's datasets for machine learning. It would explain why you get picture tests even after you should definitely pass the check.
- kzzzznot 8y agoIf that is true that is a huge breach of trust. Are these practices ever audited?
- Scene_Cast2 8y agoBy whom? For what? (Meaning - probably not, unless you count a few Googlers sanity checking launches)
- manmal 8y agoYou mean, they still haven't managed to classify those storefronts correctly, after 3 years or so?
- alexpetralia 8y agoYes - I feel at this point that our labor is simply being used to help provide training data for Google's algorithms.
- teej 8y agoI mean, this has been exactly the situation since recaptcha was invented.
- 8y ago
- judge2020 8y agoIf you often get this while using Tor - https://privacypass.github.io/ https://privacypass.github.io/ For firefox - https://github.com/dessant/buster https://github.com/dessant/buster
- nixpulvis 8y agoI feel like a "bot" with access to control your mouse and read the output from the graphics system (aka get an image of the screen in real-time) could have little trouble with these things.
- brokenmachine 8y ago>could have little trouble with these things That's a bit of an ambiguous sentence - are you saying they would have little trouble, as in not much trouble, or the opposite?
- quickthrower2 8y agoYes, but as a spammer, you would need access to lots of different people's mice and screens. A bot net would do it I guess.
- bsamuels 8y agoSlightly related, but I have a fun conspiracy to share: I'm convinced that part of the reason Google released headless Chrome is as a honeypot for bot authors to use. The idea is that instead of going through the effort of fingerprinting and identifying new bot software, release something that bot authors will use instead that you have a capability to detect. Somewhere inside of headless Chrome, there's one or more subtle changes that make it so Google can detect whether you're using headless Chrome or normal Chrome. There's no limit to how subtle the indicator could be - maybe headless Chrome renders certain CSS elements slightly slower than normal Chrome, etc. It sounds pretty crazy/complicated but I could definitely see it being worth it if it means detecting $X,000,000 worth of ad fraud every year
- mpol 8y agoInteresting idea :) I don't think spambots are currently using Chromium or even running JavaScript. Using simple spamfilters in JavaScript still works fine on my setups.
- bsamuels 8y agoMost modern credential stuffers use headless browsers with all the bells and whistles, html5, javascript, etc. Login attempts are usually spread over a massive botnet of residential IPs as well, where they'll only use each IP for one or two login attempts before moving on to the next. It's a very fascinating problem space
- Damogran6 8y agoIn my experience, the botnet didn't upgrade their JVM...it was 18-24 months out of date. THAT was what we filtered on at the F5 to blunt the attack.
- golergka 8y agoDoes it mean that you're breaking the experience for users who deliberately disable js by default? Can I ask you not to do that? Modern web is unusable if you let js on any webpage
- ascii_only 8y agounCaptcha2 claims 90% accuracy at beating reCaptcha. http://github.com/ecthros/uncaptcha2/blob/master/README.md http://github.com/ecthros/uncaptcha2/blob/master/README.md
- executesorder66 8y agoThis addon also works in a similar way: https://addons.mozilla.org/en-US/firefox/addon/buster-captcha-solver/ https://addons.mozilla.org/en-US/firefox/addon/buster-captch...
- seotut2 8y agoI think recaptcha and captcha in general are very overused today, as they cause way too much inconvenience for the user. Why discriminate against robots so much? What's so wrong about crawling or using automated tools? With today's networks and hardware performance most websites shouldn't concern themselves with denial-of-service type of attacks, unless they're past a certain threshold of popularity.
- taftster 8y agoOne thing is account creation. It's usually a bad idea that user accounts are created by non-humans. In general, anything that writes to a database may have concerns about robot/automation/abuse. I agree with you, for "read only" content, let the robots crawl.
- benrbray 8y agoWell, it's useful on places where genuine human interaction is important, like Craiglist or Reddit. (in reality though reddit has a huge bot / astroturfing problem anyway, so perhaps the value of captchas really is overstated)
- remus 8y agoThere's nothing inherently wrong with crawlers and automated tools, but there's a lot of poorly written scrapers out there that can easily generate a huge volume of traffic along with the associated maintenance. Why waste time catering to people who are too lazy to write a decent scraper? Most people would prefer to spend their time working on things that will benefit the other 99% of their users.
- learc83 8y agoAt work we have a scraper that likes to use a particularly expensive search query using hundreds of different ips dozens of times per second, all so that they can scrape data that is freely available from us as an XML feed at a different url. Every time I found a way to fingerprint and block them, they'd change their bot to avoid detection. Captcha for rate limiting seemed like the least bad option. However, eventually I decided that instead of blocking them, I'd return random results from the db. They weren't checking the data too thoroughly because to this day they haven't changed the bot to avoid my most recent pattern detection. They're still merrily scraping useless data.
- ThePhysicist 8y agoSo basically they do very advanced browser fingerprinting? I wonder if they keep that data around, as that would tell them who uses which third party services (not that they would have trouble working this out by other means) and would make a nice addition to their tracking efforts. It’s quite depressing to see that almost all sites now require sending data to Google just to log in to them. Not to mention that they help to turn billions of users into clickworkers for annotating AI data. Tell me what you want but I’m pretty sure they show image captchas to users that they are absolutely sure are no bots. I use Chromium on Linux and I’m logged into a Google account, still I have to solve three or four image captures at times to use a login.
- dudus 8y agoThis is reCAPTCHA v2. There's even a v3 that does not have a checkbox at all. Is just a Javascript API that gives you a score between 1.0 and 0.0 on how likely a user is a bot or not. I suspect it uses the same ideas of this one, maybe more since the article is a bit outdated. https://developers.google.com/identity/protocols/OAuth2#installed https://developers.google.com/identity/protocols/OAuth2#inst...
- JohnFen 8y ago> Is just a Javascript API that gives you a score Yes, this is the worst of them all, as it will completely lock me out of websites that use it.
- dudus 8y agoI don't think that's the goal. Nowhere they suggest locking people out though def it is possible. The idea is that the website can choose to be more cautious about that user, requiring 2FAuth, flagging for possible credit card fraud and comment moderation. I think these are all good use cases.
- JohnFen 8y agoIt will lock me out of the websites because it requires me to enable Google Javascript code to execute, which is something I will not do. I allow very little JS to execute at all, and I don't allow any from advertising companies or entities that report to advertising companies. I understand the reasons why sites may want to do this sort of thing, but personally, the cost of allowing this to happen in my browsing is simply too high.
- codeulike 8y agoIts getting weird when you have to fill that box in with pen and paper Marci Robin was buying a Fiat 500X from a West Palm Beach, Florida dealership, and was in the final stages of signing all the paperwork, when she was presented with a strange but simple question: was she a robot? This wasn’t online or anything, she was right there, in person, in front of the sales person, who wanted her to check a box, with a pen, on real paper, confirming that she was not, in fact, a robot. She claims she isn’t. https://jalopnik.com/dealership-makes-woman-sitting-right-in-front-of-them-c-1826232532 https://jalopnik.com/dealership-makes-woman-sitting-right-in... edit: and the original tweet: https://twitter.com/MarciRobin/status/998030243981033472 https://twitter.com/MarciRobin/status/998030243981033472
- rothron 8y agoThis would've made an awesome SciFi short story. The twist at the end is that she's lying.
- codeulike 8y agoI can't imagine that a car dealership would even care, as long as they got to sell a car. "Oh dang, you ticked the 'not a robot' box but you are actually a robot ... Ah, no worries, I'll put a call in to head office, get the paperwork changed. Well, enjoy your car! ... And don't forget to come back in six months for your free oil change! ... for the car, I mean."
- kaybe 8y agoAre there rules against selling to robots? I mean, a great portion of the stock exchange is just that, essentially, no?
- palunon 8y agoRobots can't own property, as they are not recognized as a person. You may sell to someone represented by a robot, but you're not selling to the robot. When using a vending machine, your making a trade with the vending machine company, not the machine itself.
- peterwwillis 8y agoBack in the late 90s, my teenage friends and I were writing Visual Basic programs to automatically click ad banners and surf webpages to generate money. I doubt it's significantly more difficult to do the same now with a captcha box.
- anth_anm 8y agoBots that can defeat captcha easily are probably the AI development I'm most excited for. The amount of time I've wasted clicking on crosswalks and store fronts is way too high.
- taftster 8y agoI'm not convinced that picking the pictures has anything to do with actually convincing google if you're a bot or not. I mean sure, it's an indicator. But I _know_ that I can pick the right pictures of school buses and store fronts every freaking time, so that's only a very small indicator. More likely, the majority of the algorithm is devoted to the "fingerprint" of your browser. If you have adblock running, you may not have a google ad cookie. If you have a randomizing user-agent addon, you're going to get blocked. What we need, for captcha, is an addon that makes you look as human as possible. Mouse click timings become random. Javascript fingerprint becomes John Smith common. Third party cookies, temporarily enabled (and then pruned). VPN traffic routed through a common looking gateway that few bots use. etc. etc.
- derefr 8y agoYou're assuming that the picking-of-pictures validation logic cares solely about what pictures you pick. What if it cares about your "mouse click timings" not being random, but rather looking like the mouse movements of a human who is using eye saccades to examine and classify images, and then moves their mouse only when they see and find one, and sloppily at that?
- taftster 8y agoRight, that's what I'm saying. I was putting forth that humans are pretty random with their timings. But the truth is, they are probably not and that we all probably click in some uniform distribution. But I am pretty sure, if you click on the images too quickly, you're going to get stopped. Slowing down your clicks, moving around a little like you're "thinking" seems to help. That's been my experience at least. I'm personally rooting for the AI here. When the robots and crawlers become so smart to become too hard for Google to distinguish between them and humans, then we will all benefit. They are becoming smarter, which is why captchas are becoming more difficult for humans.
- aboutruby 8y agoMy theory is that the challenges are actually just to slow down humans trying to do repetitive sensitive tasks (sign ups for instance).
- taftster 8y agoGoogle runs a very profitable ad network. People who use adblockers don't directly help support their revenue. I have a conspiracy theory that google is making it hard for people running adblock to get through captchas. I want all the code that is used by the captcha to think I'm running a pristine ad displaying browser. I wonder if recaptcha seeing your ad cookies (and other dark tracking indicators) would be enough to help get through. Like we need a "recaptcha profile" in your browser that would have just enough fingerprint to get you through. Robots don't watch the ads. Adblock blocks the ads. Google's revenue is mostly ad revenue. I don't think it's coincidence.
- not_a_cop 8y agoOddly, they don't answer the harder question. How you can prove that a human genuinely wanting the information in the page is filling that information out? Imprisoned humans are great CAPTCHA defeat bots.
- wolco 8y agoThe bigger question. Why do we treat bot visits differently. Automated submissions or manual have the same rate limiting controls that prevent more submissions than expected. The content of a form shouldn't be acceptable or not based on who sent it (human or machine) there needs to be another verification process against the data submitted to expected/acceptable values. Why couldn't a bot purchase a droplet or shoes. As a saler I would be happy to sell to them. Purchases would be quicker and less wasted resources with humans browsing the same product pages for months before buying.
- dragonwriter 8y ago> Why do we treat bot visits differently. Because bots are used in multitarget and multisource spam attacks that humans can’t do efficiently; rate limiting on any particular target site, particularly for submissions from a particular source, cannot prevent such attacks.
- tptacek 8y agoI believe this is related to anti-spam work that Mike Hearn did, and described at a high level on the ModernCrypto lists: https://moderncrypto.org/mail-archive/messaging/2014/000780.html https://moderncrypto.org/mail-archive/messaging/2014/000780.... (search "Javascripts").
- dazhbog 8y agoEvery time that thing asks Select all images with traffic lights, I'm like, does the pole also count? Select all images with cars, what about that car that is two pixes in the next tile? Do I click based on absolute truth, or how they expect an average user to?
- seanwilson 8y agoThe linked post doesn't give any concrete answers in my opinion. Can't a bot use a real browser to pass the CSS tests? Can't the behaviour of a human be recorded and mixed in with the behaviour of the bot to seem more human like? Why can't the encryption used be decoded?
- bhntr3 8y agoI haven't seen any mention of keystroke (or mouse) biometrics (https://en.m.wikipedia.org/wiki/Keystroke_dynamics https://en.m.wikipedia.org/wiki/Keystroke_dynamics) When the checkbox appeared I assumed that was what it was. Keep a history of the biometrics of the devices either on the account or in a cookie. Use a sufficiently secure and obfuscated language to capture and upload the data (maybe using steganography in an image, explaining the weird image uploads.) Prompt when the biometrics don't match a known user of the device/account (according to ml). Or if the tracking data didn't exist (incognito) then prompt using a backup model trained in the difference between the biometrics of known bots and known humans. Keep a very loose threshold here. That's how I'd do it if I were Google (and no one else because only Google can afford that.) All the browser fingerprinting stuff mentioned is great but doesn't really work as much as you'd hope in practice.
- phire 8y agoThe basic theory behind that checkbox is to attach an unmovable cookie to your browser. The majority the client side reCAPTCHA is fingerprinting to make it impossible for spammers to steal cookies from legitimate users. Once you have the immovable cookie, is easy to do regular reCAPTCHA challenges until you are sure that browser is being used by a regular human. You will notice that if you ever move to fresh OS install, or a different browser that reCAPTCHA suddenly starts showing you image challenges again, which last for several weeks. Keyboard/mouse biometics is a nice theory. But that's all it is. It doesn't work as a general CAPTCHA solution because it's so easy for bots to fake human looking input.
- bhntr3 8y agoGreat points. I agree the critical and biggest innovation is building a secure environment inside the browser. When I explored keyboard/mouse biometrics it was for detecting account theft which is a bit different. If they have a way to create a secure, immovable cookie across browser sessions even in incognito mode then they don't need biometrics. In the absence of persistence, biometrics could serve as the cookie. Even with a naive approach in a hackathon, a member of my team was able to get very high precision identifying users based on a small sample of keyboard and mouse movements. I'm sure Google can do better. So it's not really about attackers being able to look like any human. It's about being able to look like a specific human. Which is much harder. But maybe you have more experience? We abandoned it seemed intrusive and because we knew we couldn't invest in the secure environment. Without that it doesn't matter. And with it maybe there's an easier solution. But I figured that given Google made it that they would be using keyboard/mouse movements for user identification.
- aasasd 8y agoCould anyone please translate this part to a normal technical description?: > Google’s invented language is decoded with a key that is changed by the process of reading the language, and the language also changes as it is read. I feel like that's either some everyday cryptothing that I'm too tired to realize right now (ahem hashing cough?), or some clever stuff that I want to know quite a lot. Or Google cracked the secret of writing Malbolge.
- aaron695 8y agoBit more info here https://github.com/neuroradiology/InsideReCaptcha https://github.com/neuroradiology/InsideReCaptcha
- _cs2017_ 8y agoWhy wouldn't a bot just use a proper browser (not headless), detect the "not a robot" box at the pixel level, and click on it using browser automation or some mouse movement script? At today's level of bot sophistication this seems almost trivial. Sure it might cost more in resources, but I doubt it's economically prohibitive when you're making at least a cent per fraudulent ad click?
- judge2020 8y agoI believe the Quora answer is putting a little too much faith in Google using "fair" factors when determining if a client is a robot. I'm sure it plays a part in determining "hijacked extension" activity vs human activity, but it's likely that the majority of the decision is how much recent activity your signed-in Google account has, whether or not you're signed in on Chrome (Firefox has a lot more stories of recaptcha challenges), and maybe even if you have Google WiFi or Google Home linked to your account. I wouldn't be surprised if they purely whitelist accounts that subscribe to Google Fiber or Fi.
- jtth 8y agoI think less of whatever entity puts it in front of me.
- dazhbog 8y agoThe other day I noticed that if you leave the tab open long enough the images become grainy.. I wonder if they also overlay another image that to humans looks like noise, but its a neural network attack[1][2] [1] https://youtu.be/SA4YEAWVpbk?t=34 https://youtu.be/SA4YEAWVpbk?t=34 [2] https://medium.com/datadriveninvestor/8b966793dfe1 https://medium.com/datadriveninvestor/8b966793dfe1
- zahreeley 8y agoBecause its a Bot. Ro-Bot
- kumarvvr 8y agoWait, what is stopping me from using something like selenium, and mouse automation tools like in python and simply do what a human does?
- ezioamf 8y agohttps://github.com/ecthros/uncaptcha https://github.com/ecthros/uncaptcha
- mnm1 8y agoThis explains everything except why Google itself won't let humans through even when they've selected the right things a million times. All this sophistication and it's still too stupid to do its basic job of knowing the right answer which couldn't be more than a few equality checks away.
- 1stranger 8y agoProtip: if you click on the headphone icon on recaptcha you get an audio challenge which I find much simpler and less annoying.
- executesorder66 8y agoAnd this addon makes it even easier: https://addons.mozilla.org/en-US/firefox/addon/buster-captcha-solver/ https://addons.mozilla.org/en-US/firefox/addon/buster-captch...
- smadurange 8y ago"the language also changes as it is read" Lol. Quora and its nonsense.
- thowmeaway 8y agoIt only catches obvious bots. I write stuff that gets past ReCaptcha all the time. I'm just one guy and I am not even that good at this. Plenty of other people get past it too: https://medium.com/@jsoverson/bypassing-captchas-with-headless-chrome-93f294518337 https://medium.com/@jsoverson/bypassing-captchas-with-headle... I am pretty sure Google is just doing an 80/20 rule here, or even a 99/1 rule since there are so many simple bots that are easy to detect.
- mrep 8y agoI just read that blog post and it relies on using 2Captcha which is literally a service that pays actual humans to solve the captchas for you so it's not actually automating away the human aspect.
- danschumann 8y agoI'm sure it could.. if you had the minimum hardware and a smart enough bot. It's always going to be an arms race.
- avodonosov 8y agoSo how does it really work? In the article a lot of words about obfuscated code reading browser fingerprint, but that's just a fingerprint, a bot can run a browser as well and fingerprint will not reveal him. How clicking the checkbox helps? Do they measure the delay it takes me to read the captcha request and react by clicking?
- walrus01 8y agoTurns out that the low cost way to bypass this is to hire a click farm of 25 people in Bangladesh, each running remote desktop sessions to about a dozen virtual machines.
- klyrs 8y agoOkay how about a button that says "I'm a robot" and you only serve to sessions that don't click it. "Sorry you said you were a robot. If you clicked it by mistake, clear your cookies and uninstall at least 50% of your fonts"
- michaco33 8y agoI wish they finally could so I could stop being held hostage through multiple rounds of visual recognition tests -- how long is it going to take me to prove I'm human when I'm senile?
- fabioborellini 8y agoIsn't this a typical Quora answer? Full of filler and shitty hard-to-verify details that provide no value to the answer ("the language is encrypted twice", what the hell), and very little effort on answering the actual question (what is the purpose of CAPTCHA). And the community rules try to block people from writing firm "you're full of shit"-like answers, even though every other answer of Quora is full of lies like "Linux is fast, because it was designed for 16-bit computers".
- jaabe 8y agoI had my “wow” this place might not be that good experience with Quora yesterday when I was trying to google evaluate AWS workmail. Quite a lot of the “extremely good looking” answers on Quora straight up said that you couldn’t do e-mail in AWS. These were answers from after workmail was a thing by the way. So I started looking at other Quora answers on stuff I wouldn’t normally need an answer for, and it’s frighteningly how often completely wrong answers look correct. Don’t get me wrong, there is a lot of truly amazing answers as well, and it’s entirely possible that I just suck at it, but I don’t think I can always tell the amazing answer from the completely wrong one.
- adventured 8y agoMy experience with Quora has been that more often than not the older the answer, the better it is. I find that answers in history, are often better than in tech. It always seems like the community that initially built Quora, stopped building it further several years ago and now it's floating out in space Wile E. Coyote style.
- welly 8y agoI was going to say the same. I don't use Quora at the moment but when I did, I'd be more interested in subjective questions (history, geographical - ie. travel etc., and more philosophical questions) rather than objective and technical questions (and answers) as I've found many of them to be simply untrue.
- 8y ago
- blazespin 8y agoI never got this. Why not just run the browser in a VM, capture the screen and do a mouse click. I mean, why bother with all the headless nonsense which is an arms race. How could google possible ever defeat something that never ever even goes near the operating environment and just appears as a simple human mouse click? I suppose you’d have to simulate the human movement of the mouse over to make it look like a human actually did it, but how hard can that be? Just train it with a few 100 Turks moving mouse pointers to click on links. Though an interesting counter measure might be to inject cpu spikes and measure the impact in the mouse movements and the robot controlling it. Must be a fun job, both sides.
- untangle 8y agoI see a lot of conjecture and theory and not a lot of evidence. AI models? Maybe for ad behavior but not for this. Google has you and your machine ID'ed and fingerprinted. That's the core of the authentication. The rest is subterfuge and obfuscation. Is there any evidence that I'm wrong?
- sascha_sl 8y agoYes. You get punished for blocking Google tracking. I love it. Totally not evil(tm). Very tempted to cancel/stop using anything that uses this crap, but it's a bit too ubiquitous.
- mrccc 8y agoThe captcha always reminds me of The Stanley Parable: > Employee #427's job was simple: he sat at his desk in room 427 and he pushed buttons on a keyboard. > Orders came to him through a monitor on his desk, telling him what buttons to push, how long to push them, and in what order.
- arendtio 8y agoSometimes I get really angry about that captcha. For example, when I am trying to buy something, having an account on the store with 100+ orders, and still having to play 6 rounds or so of 'find the car' at the speed of the very slow fading images. So sophisticated and still such a pain in the a for the user.
- ddtaylor 8y agoYou certainly can click that box using chrome headless or a simple VNC setup. It's insanely easy. Google has replaced the idea of a CAPTCHA (completely automated public Turing test to tell computers and humans apart) with a basic rate limiting heuristic.
- jonathanstrange 8y agoI don't understand this. When I get the "I am not a Robot" box, in 95% percent of all cases I only have to click the checkmark. That's it. A robot certainly can do that, too. In the remaining 5% I get a Captcha that is impossible to solve, e.g. it states "Please mark all cars" and once I've marked all cars it states "Please also mark all traffic signs" and when I've marked all traffic signs it states "Please also mark the following traffic signs" and so on, for as long as I bother to try. I have never encountered a Google Chaptcha that worked in any other way, either it works trivially with one click or never. My conclusion has always been that Google Captcha are simply broken for anyone who runs an ad-blocker, and I don't don't bother with services for which it doesn't work. Problem solved.
- superlupo 8y agoI hate it because I always have to solve lots of storefront or traffic sign images as I have disabled third party cookies because I do not want to be tracked by Google all over the web.
- speedplane 8y agoThere a many services that can get around a Google Recaptcha. They are not free, but cost roughly $2 for 1000 recaptchas. This means is that recaptcha makes things more expensive, but still surmountable. Services that use recaptcha should consider why they are using them. Preventing spam, stealing proprietary data, and preventing actual harm are legitimate reasons. On the other hand, stopping free information from becoming truly free is bad. For example, numerous U.S. government agencies use captchas to prevent scraping or analyzing of public documents. These government organizations provide "public access" in the narrowest possible sense, making it difficult to search for a specific record or analyze data in bulk. If they can't do it, they should allow others to try.
- robk 8y agoOur national mail carrier added this to their tracking page! Makes tracking a parcel absolutely maddening and prevents third parties from doing simple (non abusive) aggregation of tracking data.
- ainiriand 8y agoThat answer is not an answer. It is just a way to look smart while not helping at all. I've seen this behavior a few times, mostly at work.
- wifirouterlogin 8y agoInteresting
- pluma 8y agotl;dr: because Google massively invades your privacy to know whether you're a bot or not before you tick the box, also the CAPTCHA is a bit more sophisticated than just showing a checkbox to click on.
- alt_f4 8y agoJudging by the amount of spam i receive from a reCaptcha v2 protected contact form, I'm positive bots can tick the box or circumvent it.
- T3RMINATED 8y agoIll sell you a bot that bypasses Google Catcha for 920$
- yeutterg 8y agoAfter reading this thread yesterday, I had a nightmare in which I called 911 but was required to answer an endless stream of personal verification questions, never able to report the problem.
- squarefoot 8y agoThis already happens with many automated service call centers: endless key tapping before an actual carbon based lifeform who can understand the problem picks up.
- sudshekhar 8y agoI faced this recently when my card was skimmed and I saw some fraud transactions. After blocking the card, I tried reaching customer support, but my bank's IVR refused to recognize the card number (mandatory to talk to fraud folks apparently) and thus, didn't let me through. Had to reach out to them on twitter to get things moving. Horrible stuff.
- hartator 8y agoAt SerpApi.com, we built a bot to check these boxes and an AI to solve the actual CAPTCHA. Checking the box is actually not that hard. There is no advanced measurements of your mouse and touch speed. This is an Internet myth. It's more a game of cookies, making them age well, and having an organic set of headers.
- SheinhardtWigCo 8y agoAren’t you afraid of being sued by Google for selling their search results?
- wstuartcl 8y agoMy first thought as well, looks like the business is 100% based on breaking TOS. From their site: Is scraping legal? In the United States, scraping public resources falls under the Fair Use doctrine, and is protected by the First Amendment. See the LinkedIn Vs. hiQ scraper ruling for more information. This does not constitute legal advice, and you should seek the counsel of an attorney on your specific matter to comply with the laws in your jurisdiction. ROFL, I guess if you are able to ignore the layers of other issues TOS, breaking of technology to specifically exclude your use case, etc and are only willing to apply some very tangential case law against your reasoning it is "legal".
- mlb_hn 8y agoThe misconceptions about nonhuman/invalid traffic (NHT) seem like a problem brewing. There's an arms race between the NHT guys (e.g. ad fraud networks) and the guys trying to detect it (e.g. ad providers). Meanwhile, a lot of people are using analytics to inform decision making assuming most traffic is legitimate (e.g. news organizations, anyone doing A/B testing). The guys naively using analytics with weak feature detection may be totally unprepared to deal with nonhuman traffic from repurposed networks which have been optimized to defeat the more advanced countermeasures =/
- renlo 8y agoI’ve had a number of reCAPTCHA incidents where I could not pass the test for tens of images, it was a very frustrating experience. Please do not use reCAPTCHA. The items one is supposed to select often overlap the grids, so it becomes a kind of Keynesian Beauty Contest[1] at that point; I assume they validate based on how much in alignment you are with previous answers, so it becomes a problem of “What nearby grids would a person reasonably select when there’s overlap”, or, you’re tasked at selecting <some_item> and you see <some_item> in the distant background of the image you’re supposed to classify and you need to determine “How visible would <some_item> need to be for a reasonable person to classify <some_item> as being in this image”. On top of this, when you’re clicking through image after image after image, the additional frustrating thing is that you’re helping train their algorithms; you’re doing work because their service isn’t smart enough to know you’re human, or, you’re seen as a marginal customer they can piss off by forcing you to work for them for free. It’s a frustrating experience when it fails, and my current strategy is to leave the website when the ‘I’m not a robot’ checkbox fails. [1]https://en.m.wikipedia.org/wiki/Keynesian_beauty_contest https://en.m.wikipedia.org/wiki/Keynesian_beauty_contest
- retro64 8y agoYou’re overthinking it. I have had a similar experience. The worst were the “stop light” questions. Does it mean the pole, the light, the tiny corner overlapping another square? I used to try to include everything as it was technically true. Very frustrating – until I finally started to not care. Click on the most obvious pictures. Click click click. Done. Get it wrong? Click click click on the next one. Way faster with a much better success rate doing so. It usually only takes a couple of tries now.
- JoshTko 8y agoJust a suggestion to not say "You're overthinking it" it can be considered pretty dismissive.
- retro64 8y agoMaybe a cultural thing? For me, "you're over thinking it" is a familiar/friendly way of expressing an idea, similar to how you would approach a friend. It was not intended to be dismissive.
- ValleyOfTheMtns 8y agoI feel somewhat vindicated by this story. I was talking to a couple of work colleagues about the "I'm not a robot" box and they were convinced it worked purely as a time delay, to slow bots down. I had a feeling that there was far more to it than that, but I didn't know how/where to get that information at the time.
- tyteen4a03 8y agoIs there an easy-to-implement, simple-to-use alternative solution out there that delivers better UX, does not require i18n treatments and stops spambots just as well? I'm not seeing any except asking questions about the site, and even that takes effort to translate. Numerical math questions I assume can be easily bypassed.
- IncandescentGas 8y agoIt is difficult to prevent being tracked by google, when a website forces you to expose your visit to a google property just to log in