14 ms·

I was going through the same ordeal as a Firefox user, so I've made Buster to solve challenges and reclaim some of that lost time: https://github.com/dessant/bu

I was going through the same ordeal as a Firefox user, so I've made Buster to solve challenges and reclaim some of that lost time: https://github.com/dessant/buster https://github.com/dessant/buster If you're a developer, please consider replacing reCAPTCHA on your site with an alternative. reCAPTCHA discriminates against people with disabilities and those who seek privacy, and it gaslights you into thinking you did not solve the challenge correctly, which is plain cruel. Here are some reCAPTCHA alternatives: https://www.w3.org/TR/turingtest/ https://www.w3.org/TR/turingtest/

victorheld 7y ago
I've recently had issues with buster where Google detects it, giving me this error: "Your computer or network may be sending automated queries. To protect our users, we can't process your request right now". Is there a solution for this?
- nprateem 7y ago
  It may not be buster causing that. I see that sometimes on a VPN, but also when not on a VPN but using Firefox with ghostery/ublock origin, etc.
  - erinnh 7y ago
    It may not, but Ive seen the same. Only with Buster. And only since recently.
- dessant 7y ago
  It may help if you go to the extension's settings and enable user input simulation and install the client app. Though Google may block your access to the audio challenge regardless of the browser or extensions you use, see more details here: https://github.com/w3c/apa/issues/25 https://github.com/w3c/apa/issues/25
- megous 7y ago
  I also get this sometimes, not even using buster. Once I was not able to access package tracking information, because Google blocked me completely via recaptcha from that. I actually do a lot of automated queries from my computer. I like to scrape and save content that may disappear. Just recently one psychology website I liked years ago where I put a lot of effort to comment on, silently deleted all 60k user comments, including 100s I wrote, and started putting old articles behind a paywall. My activity is perfectly legal, as I'm doing all this for my own personal use. Thankfully I have all the content locally in the database. Does it mean I should be prevented from accessing third party services that use recaptcha?
bongobongo 7y ago
>If you're a developer, please consider replacing reCAPTCHA on your site with an alternative I second this (for the same reasons that you cite), and it's fresh in my mind as I just recently began reimplementing authentication for my personal CMS. reCAPTCHA is not a nice thing to do to your users. And I also don't want to feed The Beast.
fasthandle 7y ago
reCAPTCHA also just doesn't work in the most populous country in the world. translate.google.cn does, but Google's reCAPTCHA does not. This is a big pain point. Thanks for the link to turingtest, I will certainly test it.
- shawnz 7y ago
  I thought recaptcha provided alternate domains/hosts not linked to Google so that you can use it in China. Is that not the case anymore?
  - novaleaf 7y ago
    if this is true, I'd love to hear the alternate! I use recaptcha and hate that my chinese customers need to do wacky stuff to circumvent it.
    - vinay_ys 7y ago
      Just out of curiosity, why do you use reCaptcha?
    - judge2020 7y ago
      Not sure if this is "officially" supported but I believe you can proxy the `api.js` file yourself without issue.
      - fasthandle 7y ago
        The photos or voice still needs to come from from somewhere. The somewhere is google.com. The .com is blocked.
        shawnz 7y ago
        Please see my other reply in this thread: "recaptcha.net" can also be used. Is that blocked in China too? I can't find a clear answer.
judge2020 7y ago
The problem with recaptcha alternatives is that they either are insecure or require time and money to continue to be ahead of bots. All of the "interactive stand-alone approaches" from that page can be beaten with run-of-the-mill OCR (other than perhaps the 3d challenge) and with almost any mobile phone speech recognition engine (and, if the attacker has the money, can send it off to Google's cloud speech-to-text). All of the non-interactive approaches from the page require this constant tuning and upkeep to make sure bots aren't able to sign up/abuse systems. There's also not \that\ secure if your website is targeted and scripts are made specifically to avoid your anti-abuse methods.
- briandear 7y ago
  Sending my data to Google as a condition of using someone else’s site also isn’t secure. Training Google AI also isn’t something I signed up for.
  - cameronbrown 7y ago
    Not saying I like the precedent of Google being inescapable, you're not "signing up" for anything. A web server is 100% in its rights to refuse to send you a page, on their terms.
    - briandear 7y ago
      That is true. However, if I sign up for a service, for example TransferWise, then later, signing into the account, I get a Google Captcha, now I am engaged in a relationship/data share with Google and if I don’t agree, I lose access to my account. When I signed up, I didn’t have “you must help train Google AI” as a condition of use.
    - ghusbands 7y ago
      Not entirely accurate. The GDPR restricts the terms they can use, for example. And anti-discrimination law probably also applies. These don't really apply to captcha, of course, under current interpretations.
mtgx 7y ago
> and it gaslights you into thinking you did not solve the challenge correctly, which is plain cruel. It's good to see some confirmation that you're not insane. Google's ReCAPTCHA is plain EVIL.
x3sphere 7y ago
reCaptcha v3 works well for me. There are no challenges anymore and it just gives you a score based on whether it thinks the user is a bot/spammer, then you can do whatever with that. Personally if the score is low enough I just place the user in a restricted user group that needs approval on certain site actions.
- deleted 7y ago
  [deleted]
- netcraft 7y ago
  Was just looking into using v3 today. Can you share what you consider to be low enough? I haven't seen any guidance on thresholds
  - x3sphere 7y ago
    Yeah I have the threshold set at 0.6. Anything below that gets put in the restricted usergroup.
  - dbbk 7y ago
    Google recommends 0.5 as a default threshold, and you can then tweak it based on your analysis of the scores in the dashboard.
avip 7y ago
Without taking any moral stance, it should be noted that accessibility was (and is) the most successful attack surface of anti-bots measures.
lern_too_spel 7y ago
Thanks for this. Extensions like this one make Firefox for Android worth it despite all the quirks.
swebs 7y ago
Honest question: can we start a class action lawsuit for psychological damages due to this? I've experienced this firsthand when trying to use a service through a VPN. I spent legitimately 5 minutes trying to get through only to get "Please try again" every time even though I selected them meticulously. It is infuriating. I thought I was going crazy
- beefhash 7y ago
  In fact, Google has a patent on blocking users by means of CAPTCHAs that always return failure[1]. [1] https://patents.google.com/patent/US9407661 https://patents.google.com/patent/US9407661
  - adtac 7y ago
    > In fact, Google has a patent on blocking users by means of CAPTCHAs that always return failure[1]. Erm, unless I'm mistaken, that patent says it's owned by Juniper, not Google. Google is just hosting the patent document.
- Avamander 7y ago
  I just click randomly on Chrome and get trough .-.
- m463 7y ago
  You cannot make an appointment on the california dmv website without using google services, in particular recaptcha. Also, just browsing the website, it tries to log you in. https://dmv.ca.gov https://dmv.ca.gov additionally, lots of schools now require their students to use google services. I hope there is a privacy lawsuit in the future to stop this sort of nonsense.
tootahe45 7y ago
Audio is not offered if you have non-default privacy settings, so this doesn't work when you're getting the most time-consuming captchas. So your extension is good for the captchas which take 15-20secs but not the 1minute+ ones, unfortunately.
kbenson 7y ago
If you want a good look at the state of the art in this field, look at Ticketmaster. Ticketmaster uses both recaptcha and a pre-filtering solution they supply based on their own heuristics, as well as a complex user activity tracking system to determine whether you're a bot or not based on the activity you present and traffic you pass, so even if you pass all CAPTCHAs, they still might tell you to pound sand if you try to reserve something. In the last few weeks, for select sales, they've even required unique phone numbers which they will SMS a number to or call and relay a code to which you need to enter just to get a single place in line for a sale. I'm not sure of any company more actively on the forefront of prevented automated access than Ticketmaster (which makes it kind of funny when everyone chimes in about how Ticketmaster doesn't do anything to prevent brokers from getting all the tickets). The problem is that what Ticketmaster is up against is people running specialized software that's able to emulate a browser, which ties into services that are specifically designed to beat CAPTCHAs in an automated manner using mechanical turk type solutions, but at a very low cost.[1] I have reliable testimony that some people spin up the largest AWS instance for an hour or so as needed, run this software, use a proxying service, and make 8k connections to queue up for tickets on a sale. Each AWS machine is another 8k positions in the queue. Every new layer Ticketmaster throws into the verification process knocks these people out for a couple weeks, until the company providing the software (which I believe charges a small percentage for every ticket purchased, so they fix problems fast) works around it. The arms race metaphor is very apt. That's just one of the companies trying to circumvent Ticketmaster's road blacks for brokers. There are others that try to automate their purchasing to varying degrees. I myself work for a broker that takes a very different approach, where we use (relatively) very minimal automation, and have a person in front of a browser for every purchase (and we don't have many people at all), and instead try to make select purchases based of complex analysis and lots of data. Even that's gotten much harder in the last few years as venues and promoters have learned to play with the allocations of tickets, and hold large chunks of the inventory back to be released later at higher cost. I don't really see anything wrong with that, it's a market response to supply and demand, but it is unfortunately hidden in a purposeful manner, which affects not only brokers but the the end consumer, as market information is purposefully obfuscated (which makes the markets less efficient). I've written on this multiple times before, so if anyone finds this interesting, just do an HN search for my username and Ticketmaster together. 1: https://anti-captcha.com/ https://anti-captcha.com/ (Scroll down and read their animated infographic for what is possibly the most amazing graphical metaphor of this I can imagine at step 4. It's so disturbing it's funny).
modzu 7y ago
just adding another thank you. it has made the internet accesible to me and other humans again. cheers!
rodw 7y ago
> it gaslights you into thinking you did not solve the challenge correctly, which is plain cruel That's interesting. Unless you are talking about having to click on more than one "page" of tiles (as illustrated in the video in the OP) guess I don't run into reCAPTCHA often enough to have noticed this phenomenon. Can you elaborate on what you mean by that?
- deleted 7y ago
  [deleted]
pixelrevision 7y ago
Recapcha is absolutely heinous on an iPhone SE. The pictures are way too small and blurry to figure out what they are looking for half the time and it’s really not built well for zooming.
kabacha 7y ago
> reCAPTCHA discriminates against people with disabilities It discriminates against people who value their time. Who in the right mind thinks that spending several minutes on captcha is ok?
dbbk 7y ago
None of your complaints are applicable with reCAPTCHA V3.
BuckRogers 7y ago
I just wanted to say thanks for posting this. I installed your addon when I first read the HN comments yesterday, and looking forward to testing out your work. It looked great!

victorheld 7y ago

I've recently had issues with buster where Google detects it, giving me this error: "Your computer or network may be sending automated queries. To protect our users, we can't process your request right now". Is there a solution for this?

nprateem 7y ago
It may not be buster causing that. I see that sometimes on a VPN, but also when not on a VPN but using Firefox with ghostery/ublock origin, etc.
- erinnh 7y ago
  It may not, but Ive seen the same. Only with Buster. And only since recently.
dessant 7y ago
It may help if you go to the extension's settings and enable user input simulation and install the client app. Though Google may block your access to the audio challenge regardless of the browser or extensions you use, see more details here: https://github.com/w3c/apa/issues/25 https://github.com/w3c/apa/issues/25
megous 7y ago
I also get this sometimes, not even using buster. Once I was not able to access package tracking information, because Google blocked me completely via recaptcha from that. I actually do a lot of automated queries from my computer. I like to scrape and save content that may disappear. Just recently one psychology website I liked years ago where I put a lot of effort to comment on, silently deleted all 60k user comments, including 100s I wrote, and started putting old articles behind a paywall. My activity is perfectly legal, as I'm doing all this for my own personal use. Thankfully I have all the content locally in the database. Does it mean I should be prevented from accessing third party services that use recaptcha?

bongobongo 7y ago

>If you're a developer, please consider replacing reCAPTCHA on your site with an alternative I second this (for the same reasons that you cite), and it's fresh in my mind as I just recently began reimplementing authentication for my personal CMS. reCAPTCHA is not a nice thing to do to your users. And I also don't want to feed The Beast.

fasthandle 7y ago

reCAPTCHA also just doesn't work in the most populous country in the world. translate.google.cn does, but Google's reCAPTCHA does not. This is a big pain point. Thanks for the link to turingtest, I will certainly test it.

shawnz 7y ago
I thought recaptcha provided alternate domains/hosts not linked to Google so that you can use it in China. Is that not the case anymore?
- novaleaf 7y ago
  if this is true, I'd love to hear the alternate! I use recaptcha and hate that my chinese customers need to do wacky stuff to circumvent it.
  - vinay_ys 7y ago
    Just out of curiosity, why do you use reCaptcha?
  - judge2020 7y ago
    Not sure if this is "officially" supported but I believe you can proxy the `api.js` file yourself without issue.
    - fasthandle 7y ago
      The photos or voice still needs to come from from somewhere. The somewhere is google.com. The .com is blocked.
      - shawnz 7y ago
        Please see my other reply in this thread: "recaptcha.net" can also be used. Is that blocked in China too? I can't find a clear answer.

judge2020 7y ago

The problem with recaptcha alternatives is that they either are insecure or require time and money to continue to be ahead of bots. All of the "interactive stand-alone approaches" from that page can be beaten with run-of-the-mill OCR (other than perhaps the 3d challenge) and with almost any mobile phone speech recognition engine (and, if the attacker has the money, can send it off to Google's cloud speech-to-text). All of the non-interactive approaches from the page require this constant tuning and upkeep to make sure bots aren't able to sign up/abuse systems. There's also not \that\ secure if your website is targeted and scripts are made specifically to avoid your anti-abuse methods.

briandear 7y ago
Sending my data to Google as a condition of using someone else’s site also isn’t secure. Training Google AI also isn’t something I signed up for.
- cameronbrown 7y ago
  Not saying I like the precedent of Google being inescapable, you're not "signing up" for anything. A web server is 100% in its rights to refuse to send you a page, on their terms.
  - briandear 7y ago
    That is true. However, if I sign up for a service, for example TransferWise, then later, signing into the account, I get a Google Captcha, now I am engaged in a relationship/data share with Google and if I don’t agree, I lose access to my account. When I signed up, I didn’t have “you must help train Google AI” as a condition of use.
  - ghusbands 7y ago
    Not entirely accurate. The GDPR restricts the terms they can use, for example. And anti-discrimination law probably also applies. These don't really apply to captcha, of course, under current interpretations.

mtgx 7y ago

> and it gaslights you into thinking you did not solve the challenge correctly, which is plain cruel. It's good to see some confirmation that you're not insane. Google's ReCAPTCHA is plain EVIL.

x3sphere 7y ago

reCaptcha v3 works well for me. There are no challenges anymore and it just gives you a score based on whether it thinks the user is a bot/spammer, then you can do whatever with that. Personally if the score is low enough I just place the user in a restricted user group that needs approval on certain site actions.

deleted 7y ago
[deleted]
netcraft 7y ago
Was just looking into using v3 today. Can you share what you consider to be low enough? I haven't seen any guidance on thresholds
- x3sphere 7y ago
  Yeah I have the threshold set at 0.6. Anything below that gets put in the restricted usergroup.
- dbbk 7y ago
  Google recommends 0.5 as a default threshold, and you can then tweak it based on your analysis of the scores in the dashboard.

avip 7y ago

Without taking any moral stance, it should be noted that accessibility was (and is) the most successful attack surface of anti-bots measures.

lern_too_spel 7y ago

Thanks for this. Extensions like this one make Firefox for Android worth it despite all the quirks.

swebs 7y ago

Honest question: can we start a class action lawsuit for psychological damages due to this? I've experienced this firsthand when trying to use a service through a VPN. I spent legitimately 5 minutes trying to get through only to get "Please try again" every time even though I selected them meticulously. It is infuriating. I thought I was going crazy

beefhash 7y ago
In fact, Google has a patent on blocking users by means of CAPTCHAs that always return failure[1]. [1] https://patents.google.com/patent/US9407661 https://patents.google.com/patent/US9407661
- adtac 7y ago
  > In fact, Google has a patent on blocking users by means of CAPTCHAs that always return failure[1]. Erm, unless I'm mistaken, that patent says it's owned by Juniper, not Google. Google is just hosting the patent document.
Avamander 7y ago
I just click randomly on Chrome and get trough .-.
m463 7y ago
You cannot make an appointment on the california dmv website without using google services, in particular recaptcha. Also, just browsing the website, it tries to log you in. https://dmv.ca.gov https://dmv.ca.gov additionally, lots of schools now require their students to use google services. I hope there is a privacy lawsuit in the future to stop this sort of nonsense.

tootahe45 7y ago

Audio is not offered if you have non-default privacy settings, so this doesn't work when you're getting the most time-consuming captchas. So your extension is good for the captchas which take 15-20secs but not the 1minute+ ones, unfortunately.

kbenson 7y ago

If you want a good look at the state of the art in this field, look at Ticketmaster. Ticketmaster uses both recaptcha and a pre-filtering solution they supply based on their own heuristics, as well as a complex user activity tracking system to determine whether you're a bot or not based on the activity you present and traffic you pass, so even if you pass all CAPTCHAs, they still might tell you to pound sand if you try to reserve something. In the last few weeks, for select sales, they've even required unique phone numbers which they will SMS a number to or call and relay a code to which you need to enter just to get a single place in line for a sale. I'm not sure of any company more actively on the forefront of prevented automated access than Ticketmaster (which makes it kind of funny when everyone chimes in about how Ticketmaster doesn't do anything to prevent brokers from getting all the tickets). The problem is that what Ticketmaster is up against is people running specialized software that's able to emulate a browser, which ties into services that are specifically designed to beat CAPTCHAs in an automated manner using mechanical turk type solutions, but at a very low cost.[1] I have reliable testimony that some people spin up the largest AWS instance for an hour or so as needed, run this software, use a proxying service, and make 8k connections to queue up for tickets on a sale. Each AWS machine is another 8k positions in the queue. Every new layer Ticketmaster throws into the verification process knocks these people out for a couple weeks, until the company providing the software (which I believe charges a small percentage for every ticket purchased, so they fix problems fast) works around it. The arms race metaphor is very apt. That's just one of the companies trying to circumvent Ticketmaster's road blacks for brokers. There are others that try to automate their purchasing to varying degrees. I myself work for a broker that takes a very different approach, where we use (relatively) very minimal automation, and have a person in front of a browser for every purchase (and we don't have many people at all), and instead try to make select purchases based of complex analysis and lots of data. Even that's gotten much harder in the last few years as venues and promoters have learned to play with the allocations of tickets, and hold large chunks of the inventory back to be released later at higher cost. I don't really see anything wrong with that, it's a market response to supply and demand, but it is unfortunately hidden in a purposeful manner, which affects not only brokers but the the end consumer, as market information is purposefully obfuscated (which makes the markets less efficient). I've written on this multiple times before, so if anyone finds this interesting, just do an HN search for my username and Ticketmaster together. 1: https://anti-captcha.com/ https://anti-captcha.com/ (Scroll down and read their animated infographic for what is possibly the most amazing graphical metaphor of this I can imagine at step 4. It's so disturbing it's funny).

modzu 7y ago

just adding another thank you. it has made the internet accesible to me and other humans again. cheers!

rodw 7y ago

> it gaslights you into thinking you did not solve the challenge correctly, which is plain cruel That's interesting. Unless you are talking about having to click on more than one "page" of tiles (as illustrated in the video in the OP) guess I don't run into reCAPTCHA often enough to have noticed this phenomenon. Can you elaborate on what you mean by that?

deleted 7y ago
[deleted]

pixelrevision 7y ago

Recapcha is absolutely heinous on an iPhone SE. The pictures are way too small and blurry to figure out what they are looking for half the time and it’s really not built well for zooming.

kabacha 7y ago

> reCAPTCHA discriminates against people with disabilities It discriminates against people who value their time. Who in the right mind thinks that spending several minutes on captcha is ok?

dbbk 7y ago

None of your complaints are applicable with reCAPTCHA V3.

BuckRogers 7y ago

I just wanted to say thanks for posting this. I installed your addon when I first read the HN comments yesterday, and looking forward to testing out your work. It looked great!