7 ms·

Google's reCAPTCHA makes it impossible to use large portions of the web once you take reasonable measures to protect your privacy. The challenge will continuous

Google's reCAPTCHA makes it impossible to use large portions of the web once you take reasonable measures to protect your privacy. The challenge will continuously fail, despite you spending time to carefully solve it. This cruel behavior is described in a patent [1] by Kyle Adams of Juniper Networks. [1] https://patents.google.com/patent/US9407661 https://patents.google.com/patent/US9407661

StavrosK 7y ago
The audio CAPTCHA always works first try for me. The image CAPTCHA can go eff itself, it would always take me five tries while the images loaded super slowly.
- dessant 7y ago
  Yes, the audio CAPTCHA is easier to solve, but the audio challenge is blocked [1] if you are not in a good network neighbourhood or they can't collect enough tracking data to classify your visit. [1] https://github.com/w3c/apa/issues/25 https://github.com/w3c/apa/issues/25
  - danShumway 7y ago
    Can confirm, it's rare for me to be able to get at the audio captcha. Occasionally I'll find that tabbing onto the the button allows it load when clicking directly on it won't. I assume if Google is observing behavior that makes them think you're sighted, they'll block access. I kind of wonder if it would be possible to force the issue legally as an accessibility problem, but other people than me would need to do it, and in any case it feels a kind of dirty to me to use blind accessibility as a tool in the fight for privacy. On the other hand, it also feels dirty to me that being blind would mean you're not allowed to do as much on the web to protect your privacy. Blind people should be able to use Tor.
    - wtmt 7y ago
      > Can confirm, it's rare for me to be able to get at the audio captcha. Occasionally I'll find that tabbing onto the the button allows it load when clicking directly on it won't. I assume if Google is observing behavior that makes them think you're sighted, they'll block access. That'd be very cruel to ignore those with vision, but who don't have anything close to perfect vision or correctable vision through glasses. It would also ignore those who have poorer vision as well as have difficulties in recognizing patterns. There's a whole spectrum of accessibility issues, and trying to "fail people" who seem to have enough vision to click on an audio button would be the definition of being evil. > I kind of wonder if it would be possible to force the issue legally as an accessibility problem, but other people than me would need to do it, and in any case it feels a kind of dirty to me to use blind accessibility as a tool in the fight for privacy. Even if this is not possible legally in all jurisdictions, enough publicity and outrage could help. There should certainly be some journalists from major publications/site reading HN (or HN readers with journalist contacts) who can investigate and write about this.
kabacha 7y ago
Google's reCAPTCHA is cancer upon the web. Everyone should enable fingerprint block to shut this invasive and abusive garbage. If everyone would block it the website owners would have no choice other than to move to a different captcha system.
- rum3 7y ago
  Cloudflare must be mentioned when talking about recaptcha and cancer. They are the ones locking people out from whole websites and forcing you to fill out these recaptchas. They are also the ones who have almost destroyed browsing the internet using TOR due to these recaptchas.
  - philpem 7y ago
    While I agree with you -- I'd also like to point out that >90% of malicious traffic to the websites I administer comes through the Tor network. It shouldn't be the case, and I don't want to block people who have a legitimate reason to use Tor. Unfortunately there isn't a "block Tor traffic from assholes" option, so all I can really do to reduce the malicious traffic is block exit nodes.
    - yc12340 7y ago
      This has nothing to do with Tor. Cloudflare frequently blacklists entire countries/counties worth of people (and rarely reverts those blacklists). There is a good chance, that you have missed a lot Indian/Vietnamese/Russian/Chinese visitors, because Cloudflare concluded, that forwarding their traffic to your site isn't financially viable for them. > Unfortunately there isn't a "block Tor traffic from assholes" option What exactly is "Tor traffic from assholes"? Bulk DDoS attacks? E-mail spam? SSH login attempts? Please share your valuable experience with everyone here, so that all of us could stay safe by learning from your example.
      - tragicpapercut 7y ago
        And for companies that don't do business with those countries - this is not a loss. Most "asshole" traffic I see falls into one of two categories - attempts to exploit vulnerabilities (../../../etc/passwd stuff) and account takeover attacks. The first I can forgive, I don't frankly care where that traffic comes from and the responsibility is entirely mine as website admin to prevent these types of attacks through good coding practices, WAF, etc. The second I have less control over because customers / the general public sucks at security. They re-use passwords they've had for 10 years and won't opt-in to 2fa. And as a merchant, my company generally eats the cost of fraud that these attacks generally result in. If no or little legitimate traffic is coming from Tor, and a significant percentage of malicious traffic is coming from Tor - at great cost to me / my company - why the hell would I allow it to continue?
sebazzz 7y ago
Remember that reCAPTCHA v1 used to be noble: reading books and converting them to text. Now you're just training many Google machine learning algorithms by classifying data. In which they get more useful for the consumer, thus more powerful.
- visarga 7y ago
  I hate them as much as you do, but you're wrong. Those storefront and traffic sign captchas are not useful for training ML models. If they were to be useful, they would be much more varied, like the original ones (used for OCR).
  - SCdF 7y ago
    My brain is unwilling to accept this. What is the purpose of those choices then?
    - rum3 7y ago
      Since they introduced the square-selecting captchas I have always assumed that they use it for identifying the user. I bet that depending on how you solve the captchas they can identify who you are if their system already has a theory of who you might be.
      - kmlx 7y ago
        they're there for denying access to automated scripts.
        pawelk 7y ago
        This is the reason they exist in the first place, but doesn't answer the question why they're implemented this particular way.
        faceplanted 7y ago
chmars 7y ago
Do you have a suggestion for a good alternative? I dislike Google reCAPTCHA, however, it brought down contact form and comment spam to almost zero. (With the price of an unknown number of false positives and some frustrated users.)
stefek99 7y ago
Wait. Patent? It's just a simple technique, quirk, workaround, something to win the arms race... Just like shadowbanning on Twitter.

StavrosK 7y ago

The audio CAPTCHA always works first try for me. The image CAPTCHA can go eff itself, it would always take me five tries while the images loaded super slowly.

dessant 7y ago
Yes, the audio CAPTCHA is easier to solve, but the audio challenge is blocked [1] if you are not in a good network neighbourhood or they can't collect enough tracking data to classify your visit. [1] https://github.com/w3c/apa/issues/25 https://github.com/w3c/apa/issues/25
- danShumway 7y ago
  Can confirm, it's rare for me to be able to get at the audio captcha. Occasionally I'll find that tabbing onto the the button allows it load when clicking directly on it won't. I assume if Google is observing behavior that makes them think you're sighted, they'll block access. I kind of wonder if it would be possible to force the issue legally as an accessibility problem, but other people than me would need to do it, and in any case it feels a kind of dirty to me to use blind accessibility as a tool in the fight for privacy. On the other hand, it also feels dirty to me that being blind would mean you're not allowed to do as much on the web to protect your privacy. Blind people should be able to use Tor.
  - wtmt 7y ago
    > Can confirm, it's rare for me to be able to get at the audio captcha. Occasionally I'll find that tabbing onto the the button allows it load when clicking directly on it won't. I assume if Google is observing behavior that makes them think you're sighted, they'll block access. That'd be very cruel to ignore those with vision, but who don't have anything close to perfect vision or correctable vision through glasses. It would also ignore those who have poorer vision as well as have difficulties in recognizing patterns. There's a whole spectrum of accessibility issues, and trying to "fail people" who seem to have enough vision to click on an audio button would be the definition of being evil. > I kind of wonder if it would be possible to force the issue legally as an accessibility problem, but other people than me would need to do it, and in any case it feels a kind of dirty to me to use blind accessibility as a tool in the fight for privacy. Even if this is not possible legally in all jurisdictions, enough publicity and outrage could help. There should certainly be some journalists from major publications/site reading HN (or HN readers with journalist contacts) who can investigate and write about this.

kabacha 7y ago

Google's reCAPTCHA is cancer upon the web. Everyone should enable fingerprint block to shut this invasive and abusive garbage. If everyone would block it the website owners would have no choice other than to move to a different captcha system.

rum3 7y ago
Cloudflare must be mentioned when talking about recaptcha and cancer. They are the ones locking people out from whole websites and forcing you to fill out these recaptchas. They are also the ones who have almost destroyed browsing the internet using TOR due to these recaptchas.
- philpem 7y ago
  While I agree with you -- I'd also like to point out that >90% of malicious traffic to the websites I administer comes through the Tor network. It shouldn't be the case, and I don't want to block people who have a legitimate reason to use Tor. Unfortunately there isn't a "block Tor traffic from assholes" option, so all I can really do to reduce the malicious traffic is block exit nodes.
  - yc12340 7y ago
    This has nothing to do with Tor. Cloudflare frequently blacklists entire countries/counties worth of people (and rarely reverts those blacklists). There is a good chance, that you have missed a lot Indian/Vietnamese/Russian/Chinese visitors, because Cloudflare concluded, that forwarding their traffic to your site isn't financially viable for them. > Unfortunately there isn't a "block Tor traffic from assholes" option What exactly is "Tor traffic from assholes"? Bulk DDoS attacks? E-mail spam? SSH login attempts? Please share your valuable experience with everyone here, so that all of us could stay safe by learning from your example.
    - tragicpapercut 7y ago
      And for companies that don't do business with those countries - this is not a loss. Most "asshole" traffic I see falls into one of two categories - attempts to exploit vulnerabilities (../../../etc/passwd stuff) and account takeover attacks. The first I can forgive, I don't frankly care where that traffic comes from and the responsibility is entirely mine as website admin to prevent these types of attacks through good coding practices, WAF, etc. The second I have less control over because customers / the general public sucks at security. They re-use passwords they've had for 10 years and won't opt-in to 2fa. And as a merchant, my company generally eats the cost of fraud that these attacks generally result in. If no or little legitimate traffic is coming from Tor, and a significant percentage of malicious traffic is coming from Tor - at great cost to me / my company - why the hell would I allow it to continue?

sebazzz 7y ago

Remember that reCAPTCHA v1 used to be noble: reading books and converting them to text. Now you're just training many Google machine learning algorithms by classifying data. In which they get more useful for the consumer, thus more powerful.

visarga 7y ago
I hate them as much as you do, but you're wrong. Those storefront and traffic sign captchas are not useful for training ML models. If they were to be useful, they would be much more varied, like the original ones (used for OCR).
- SCdF 7y ago
  My brain is unwilling to accept this. What is the purpose of those choices then?
  - rum3 7y ago
    Since they introduced the square-selecting captchas I have always assumed that they use it for identifying the user. I bet that depending on how you solve the captchas they can identify who you are if their system already has a theory of who you might be.
    - kmlx 7y ago
      they're there for denying access to automated scripts.
      - pawelk 7y ago
        This is the reason they exist in the first place, but doesn't answer the question why they're implemented this particular way.
        faceplanted 7y ago

chmars 7y ago

Do you have a suggestion for a good alternative? I dislike Google reCAPTCHA, however, it brought down contact form and comment spam to almost zero. (With the price of an unknown number of false positives and some frustrated users.)

stefek99 7y ago

Wait. Patent? It's just a simple technique, quirk, workaround, something to win the arms race... Just like shadowbanning on Twitter.