7 ms·
Theres another downstream issue of this that many people seem to be unaware of. I've gone down the road of trying to create a super private browsing experience
by akyu 7y ago
Theres another downstream issue of this that many people seem to be unaware of.
I've gone down the road of trying to create a super private browsing experience.(www.privacytools.io for a good start).
The issue is the web experience degrades rapdily and quite frequently is unusable. You have to block CDNs for a start if you really wanna go full paranoia mode. And there's too many other issues to list here.
But the biggest issue, is that Google's CAPTCHAs become unsolveable. I mean literally they wont let you pass. You will get served a large sequence of captchas. I've experienced up to 6 for a single verification. And not only do you get more, but they deliberately add an excruciatingly slow delay to each image. It can take 10-15 seconds to solve a single image set, and then you still need to do 5 more.
Also interesting side note, it seems they are injecting adversial noise into the hard captcha, as I noticed faint distortions in most of the images.
Bur even with your best effort to solve them you will not get through. Ive repeated this experiement many times. It seems that preventing browser fingerprinting is the thing that really makes them put up a redflag, but its hard to know for sure. And I'd like to emphasize that none of the privacy modifications I was using make any significant change to normal browser functionality. You still have JS, you still have cookies (through Firefox containers).
Anyway the scary thing here is its very easy to extrapolate this further and get to an internet where you either opt in to be tracked, or you are effectively throttled/gated on huge parts of the web.
Google CAPTCHAs have gone from asking the question "Are you human?" to "Which human are you?".
And the beautiful, incredible irony is how this contrasts with Google's very public stance on net neutrality.
"Internet companies, innovative startups, and millions of internet users depend on these common-sense protections that prevent blocking or throttling of internet traffic, segmenting the internet into paid fast lanes and slow lanes, and other discriminatory practices. Thanks in part to net neutrality, the open internet has grown to become an unrivaled source of choice, competition, innovation, free expression, and opportunity. And it should stay that way. "
Do as I say. Not as I do.
- codexon 7y agoThe google captcha's are starting to be unsolvable for me.
- dcolkitt 7y agoI could be wrong, but I assume that Google mostly does this because of the huge amount of malicious garbage bot traffic on the web. Once you go fully anonymous and private, there's no way to distinguish you between the hordes of malicious traffic. But there seems like there should be a technological solution. Google knows what a "legitimate" user looks like. Either because they come from a safe IP, or they're registered Google users, or they have a normal established browser history. But using your legitimate identify compromises your privacy, because then your IP/user-account can be correlated to your personal identity. So, let's create zero-knowledge proof identity schemes. Using your legitimate, but non-private, identity you "register" an ephemeral, private anonymous identity. But it's done using zero-knowledge proof, such that Google has no idea about who a particular anonymous identity besides that it must belong to one of its several million legitimate identities.
- deleted 7y ago[deleted]
- gambler 7y ago>I could be wrong, but I assume that Google mostly does this because of the huge amount of malicious garbage bot traffic on the web. Once you go fully anonymous and private, there's no way to distinguish you between the hordes of malicious traffic. What's "malicious" about simply opening a page on a website? Google bots are doing this all the time and they don't have to solve CAPTCHAs.
- jstarfish 7y agoIf your site is at all worth scraping, it will be scraped, republished and monetized by someone other than you. Google plays the long game though. By setting themselves up for being the gatekeeper of bot traffic, any bot belonging to a competing search engine cannot possibly index the web as well as Google can.
- gpvos 7y agoI assume Google Recaptcha has a way to recognize its own Google Bots.
- doktrin 7y agoI think at the absolute worst I've spent almost 10 minutes painstakingly walking through successive google CAPTCHAs before just giving up. The modern web is basically openly hostile to anonymity (or pseudo anonymity). That's one of those genies I don't see any way of putting back in the bottle : the privacy conscious consumer is just too small to matter at any kind of scale. They end up relegated to a niche set of tools and services (which ironically enough presents a neatly encapsulated attack surface for any malicious actors who might be interested in targeting these users). Ultimately it may all be moot : we're slowly moving towards the point - still years or decades off, admittedly - when effective de-anonymization of the public internet will become a reality. For better or worse, I guess.
- Razengan 7y ago> But the biggest issue, is that Google's CAPTCHAs become unsolveable. I mean literally they wont let you pass. You will get served a large sequence of captchas. I've experienced up to 6 for a single verification. And not only do you get more, but they deliberately add an excruciatingly slow delay to each image. It can take 10-15 seconds to solve a single image set, and then you still need to do 5 more. All of which is an obnoxious form of unpaid labor to train their AIs.
- Razengan 7y agoAdd: It's nicely clever, and it should be appreciated if it advances technology as a whole by enabling self-driving cars etc. sooner, but I can't help but feel offended whenever going through its "hard mode."
- hevi_jos 7y agoI had to use my own computer programs in order to be able to solve Google's CAPTCHAS!!! Machines solve them much better than I do, way faster and way better. And the most important thing, it does not frustrate or mentally exhaust me, like the thing does to people.
- crooked-v 7y agoThere's also outsourced services that pay people to solve captchas all day, Mechanical Turk style. At this point I think they're a moral necessity, given that recaptcha will often flatly refuse to allow accessibility options for some users.
- modzu 7y agohaha here's one better -- i am using the GOOGLE'S voice to text API to break their own audio captcha!!! so when people say that captcha is about stopping bots, they are wrong. as some of the top comments point out, from google's POV captcha is about enforcing personal identification and training AI.
- DavideNL 7y ago> But the biggest issue, is that Google's CAPTCHAs become unsolveable. i've noticed the same... vicious.
- ve55 7y agoGoogle's ReCaptcha has done a lot of harm to the Internet and is constantly used when it completely unnecessary (viewing a page? Submitting feedback when you're already logged into an account that you already did a captcha to make or login with?). >Google CAPTCHAs have gone from asking the question "Are you human?" to "Which human are you?". This is a good way to put it. I wonder if the Googlers that work on ReCaptcha are somehow able to convince themselves they're Making The World A Better Place, like most Googlers somehow manage to.
- jammygit 7y agoWhat is a good alternative? I'm going to be looking I to our login system soon and have been meaning to read about the options
- spiznnx 7y agoNot sure you need to make sure the user is human on a log-in form. Just limit the number of attempts per day per account, perhaps with email verification to pass it.
- svnpenn 7y agogithub has a good one you can test it by trying to create a new account its dead simple and looks to be pretty secure you have to orient an object so that its not upside down https://octocaptcha.com https://octocaptcha.com
- dillonmckay 7y agoIt is a real PITA when attempting to post to HN via AT&T LTE, same with clicking on any FB link from Google search results.
- mirimir 7y agoHuh? HN uses CAPTCHAs?
- mirimir 7y agoOK, so Google CAPTCHAs using Tor can be almost impossible. But using nested VPN chains, in a VM with a basic Firefox install with NoScript and an ad-blocker, I see hardly any CAPTCHAs. Sure, everything that I do is tracked and correlated. But it's just linked to a VPN exit IP, and a made-up persona. I actually go out of my way to link everything in this VM to Mirimir.
- akyu 7y agoJust to clarify, I wasn't talking about using TOR in my post. I found a certain configuration of Firefox config settings and Add-ons which will fail every CAPTCHA on any site. This is without a VPN, from my home IP address, which I found bizarre as that should be more than enough to identify me uniquely. And your solution is good. But its kind of ridiculous that we have to jump through hoops like that to stay private.
- mirimir 7y ago> I found a certain configuration of Firefox config settings and Add-ons which will fail every CAPTCHA on any site. Could you share more specifics, please? Reading your comment, that really didn't sink in for me. And I wonder what you're blocking that Tor browser doesn't. And/or how Tor browser reduces CAPTCHA incidence. It is ridiculous. But for me it's been a hobby. For over 20 years now ;)
- Tsubasachan 7y agoUse Canvasblocker and enable all the settings. The internet punishes anonymous browsing. Every site out there wants to track you. Across websites! Just imagine ordering a Big Mac at the McDrive. Suddenly a McDonald's employee walks out and puts a GPS tracker under your car. How would you respond?
- mirimir 7y agoMaybe try Canvas Defender instead. It serves a random canvas, and maybe that doesn't trigger so much. Within a few years, I wouldn't be too surprised if they'll be printing GPS trackers on packaging ;)
- turrini 7y ago> And not only do you get more, but they deliberately add an excruciatingly slow delay to each image. It can take 10-15 seconds to solve a single image set, and then you still need to do 5 more. There's a GreaseMonkey script that eliminates this delay. https://greasyfork.org/en/scripts/382039-speed-up-google-captcha https://greasyfork.org/en/scripts/382039-speed-up-google-cap...
- dfischer 7y agoThere's this paper that highlights the techniques (supposedly) including the fingerprinting: https://www.blackhat.com/docs/asia-16/materials/asia-16-Sivakorn-Im-Not-a-Human-Breaking-the-Google-reCAPTCHA-wp.pdf https://www.blackhat.com/docs/asia-16/materials/asia-16-Siva...
- m463 7y agoA shopping website is one thing, but the california dmv website https://dmv.ca.gov https://dmv.ca.gov logs you into google when you use it, and google captcha is required to make an appointment, otherwise you get a cryptic "server unavailable" message.
- jakecopp 7y agoI'd love to see a CAPTCHA for identifying a business/feature in Mapillary imagery which can then be later verified and added to OpenStreetMap!
- aeternus 7y agoHow about a browser / service that makes you pseudonymous instead? This would probably be hard to do with canvas-based browser fingerprinting, but might work with the various other fields. Basically create a large pool of 'profiles' based on common browser settings, then assign one at random to clients. Basically, make it look like thousands of users on the same machine.
- ThePowerOfFuet 7y ago>Google CAPTCHAs have gone from asking the question "Are you human?" to "Which human are you?". Nailed it.