4 ms·
“A lot of the scripts that are run to enable tracking delay webpage load times while all these tracking scripts fire and run in the background,” said Peter Dola
by ngold 7y ago
“A lot of the scripts that are run to enable tracking delay webpage load times while all these tracking scripts fire and run in the background,” said Peter Dolanjski, Firefox Product Lead.
Over at Google they are trying to sell fingerprinting as a feature.
- skybrian 7y agoWhat do you mean? Link?
- RonanTheGrey 7y agoFingerprinting is the primary way that Captcha decides whether to block you or not. Fingerprinting == security is the parallel they are drawing.
- skybrian 7y agoOk, that makes sense. Not ideal, but captchas need to be written somehow.
- akerro 7y agoModern captchas are designed to be anti-human and use as for free training of their AI algorithms. We're slaves for free while Google benefits from this, both technologically and financially. Next captcha from google will be even more aggressive, you're not logged to Google = you're a bot, you can't access that content.
- CaptainZapp 7y agoNext captcha from google will be even more aggressive, you're not logged to Google = you're a bot, you can't access that content. You may be right. But you know what: If I encounter captchas nowadays and unless I really need to get to that site it's "Fuck you very much!" time. I'm just not that interested in most of the web to make it woth my while and provide free work for Google.
- Anarch157a 7y agoI cancelled my subscription and deleted Spotify because of that. I can do with streaming of local radio and my own music. I really hope the EU hits them hard with a GDPR investigation, the amount of identifiable data they collect with reCaptcha is unacceptable.
- hombre_fatal 7y agoSome strong statements in these comments on a website with registration and login protected by Google's ReCaptcha. :)
- CaptainZapp 7y agoPlease explain. I've never seen a reCaptcha on HN. Is that because I registered my account something like 10 years ago?
- Wowfunhappy 7y agoI agree that this is terrible, but what is your alternative? I can't come up with one.
- atoav 7y agoI had simple questions you can answer with text on my site for years, and I had no spam problem whatsoever. I am not convinced that training google’s image recognition algorithms is the only way to solve the captcha problem
- philpem 7y agoI have one which picks a bunch of random single-digit numbers and a math operator, then asks you to type the result. I spent days trying it out with screen readers and tweaking it to work with as many as possible.
- dual_basis 7y agoThis seems like it would be very easy to game
- farisjarrah 7y agoIts very difficult to block an extremely motivated and targeted attack. With things like this, you aren't trying to necessarily block a highly targeted attack. You mostly need to just ward off the majority of low effort bot spam and random internet trolls. Having extremely tight security can be expensive and/or difficult for most organizations.
- dual_basis 7y agoThis is exactly why something like reCAPTCHA exists and is used prevalently. To me, it sounds like your system is just security by obscurity. It wouldn't scale, if it did become used prevalently then it would be very easy for bots to circumvent.
- atoav 7y agoI normally agree with concerns about security through obscurity, but I disagree here: this isn’t a security feature. It is spam protection. Everything that creates more work for any attacker here helps reducing spam, on top of that Google itself uses code obsfucation (”Security through obscurity”) in their Captcha for precisely that reason. It won’t scale, because it mustn’t scale. It is a dead simple solution to a complicated problem and works as long as it works, without selling your user data and brainpower toone of the biggest tech companies there is. If it should happen that the spam bots overcome it or your site becomes big enough to be targeted you just change it for something stricter, stronger or more sophisticated.
- smittywerben 7y agoThe fact that CAPTCHA sweatshops exist is a testament to it's failure as a protocol, let alone the privacy implications (just run X.exe to continue).
- skybrian 7y agoSeems like spammers wouldn't hire humans if they could fully automate it? That's about the best you could do as a defense.
- bluGill 7y agoWhy do you assume they aren't automating it. The obvious thing if I'm a spammer is to hire humans to solve the problem, collect their output and feed it into my ML training. I now have the same dataset that google is using, for my ML. Actually I'm not sure I need to go to full ML: after a few rounds I can probably just use image compare (not ML) and just feed humans images that I haven't seen before. Of course round two of the above is to expand on the above. Doing ML for image recognition isn't hard (other than CPU cost). I can also collect statistics, images humans take longer on I will take longer on as well (I can potentially collect eye movement so I have better data than google here - this can feed into ML). Images that humans are unsure of I will fake unsure of by sometimes clicking sometimes not at similar rates to humans. I don't know what ML google has that isn't public, but we also don't know what scammers have. Ultimately google needs to expose enough data to scammers (who see more captchas than anyone else by nature of their operations) that their ML algorithms have a large training set. Once a scammer realizes the types of data good is looking for it isn't hard to collect other samples for your private training set. Go outside in any city and you will find stoplights and street signs... you now have a training set of data that isn't googles to test on - you need a few cities and seasons worth of course, but that is an implementation detail.
- skybrian 7y agoThis is why Google will have to keep changing how the captchas work. Maybe using adversarial examples?