6 ms·
ReCAPTCHA has crossed into the domain of cattle-corralling users and thus should be considered harmful. If the system decides it doesn't like you (most likely b
by hawaiian 7y ago
ReCAPTCHA has crossed into the domain of cattle-corralling users and thus should be considered harmful. If the system decides it doesn't like you (most likely because you're "too anonymous," but you don't really know) you will be presented with slower-loading images to click and more click-all-the-things rounds. To pretend this is about slowing down bots is disingenuous as best. On top of that, usage of ReCAPTCHA perpetuates the very problems I just described.
Why isn't there a solid alternative offering yet?
- deleted 7y ago[deleted]
- vkou 7y agoBecause when you don't annoy 'too anonymous' users with obnoxious captchas, your service gets flooded with spam, which annoys every single other user. > To pretend this is about slowing down bots is disingenuous as best. I'm not sure you have a good understanding of what happens to internet services when they don't throttle spam. They become completely unusable.
- feikname 7y agoReCAPTCHA doesn't prevent the kind of spam that makes internet services completely unusable (i.e. DDoS botnets), it prevents form submition spam.
- gbear605 7y agoTo be fair, spamming a user-submitted content site (for example, a blog with comments) is just as bad as a DDoS; either one makes the site unusable.
- luckylion 7y agoMost forum or blog comment spam I've seen was trivial to detect, even without access to the server. Isn't written in the right language? Very likely spam. Contains a link and little text? Very likely spam. If you have access to the server's information, it gets even better. Origin makes it much easier to identify likely spam, previous interactions with the site and their speed ("hits the page and 1s later submits a comment") provide more info. Sure, all of that can be worked around, but that makes it more complicated and increases the cost for the attacker. If they spend money on faking actual user interaction with your blog, routing all requests through a residential IP in your country etc pp, they are likely spending as much or more than they would on a recaptcha solving service.
- mcv 7y agoI'd much rather have a service where I can submit a comment to check if it's meaningful or likely spam, than to force my users to waste time and share data with Google that they don't want to. If clearly spam, block it, if clearly okay, allow it. If unsure, leave it for a moderator. It might even train users to write better comments if badly written ones need to wait for moderation.
- vkou 7y agoAs if that's not a complete privacy nightmare. I'm sure either the NSA, or an ad-tech agency would love to get a firehose feed of this sort of data, while providing you with a YES-SPAM/NO-SPAM service. Also, anyone who mentions <something the service wants to censor> can be, of course, blackholed as spam. ;)
- mcv 7y agoAs long as it's a public forum, I don't see the issue. It's going to be public anyway, and they could easily scrape it if they want to. The submission itself should be done by the site, so the user remains anonymous.
- vkou 7y agoThere's a lot of information that can improve spam classification, that is not publicly queryable. Any spam detection engine that asks for that information will outperform ones that don't.
- deleted 7y ago[deleted]
- applecrazy 7y agoThere should be an open source captcha solution where all the labeled images can be used to develop a model available freely to the public.
- Wowfunhappy 7y agoY'know, this would be a great project for Mozilla, if they have the resources for it. They're already doing that crowdsourced voice training data thing.
- jachee 7y agoI bet CloudFlare has the bandwidth for it.
- briandear 7y agoAnd yet they use reCaptcha. I hit it all the time accessing sites when I was in France.
- sroussey 7y agoThey also have great IP address reputation data
- AstralStorm 7y agoAs if IP addresses are not shared. IPv6 isn't present enough.
- joshu 7y agoand you don’t think that will be quickly used to make a tool to break the captchas?
- applecrazy 7y agoNo. You cycle through new types of challenges that the model can't solve yet. For example, one week of stop-sign recognition, another week of pedestrian labeling, etc.
- bduerst 7y ago>Why isn't there a solid alternative offering yet? The latest version of recaptcha doesn't even prompt users. It loads on the front-end and uses a scoring system. It's likely you've used it but didn't even know because it's invisible. It's the older implementations that have the slow loading images.
- robjan 7y agoIf you use as blocking and privacy extensions or live in a "suspicious country" it's still slow loading and multiple pages of images.
- cthaeh 7y agoNot really. Thats if the developers code it so that if you get a low score -> trigger images captcha (recaptcha v2) Recatpcha v3 by itself NEVER shows anything to the user and its entirely up the application itself on how to deal with users who are likely to be bots (which also includes users with anti-fingerprinting measures)
- gbear605 7y agoOn Google Chrome, with adblock on, without my Google account signed in, in a new incognito tab with no extensions, I have the experience of it being invisible. When I go back to the same site on Firefox, logged onto my Google account, no adblock on, no privacy options on, I have to identify dozens of photos. As far as I can tell, it just checks to see if your browser is Google Chrome to give you your score.
- bduerst 7y agoAgain, that's still not the latest version of recaptcha, which never prompts users for photos.
- Dylan16807 7y agoKicking """questionable""" users off the site entirely is not a "solid alternative". This is just splitting recaptcha into two pieces and giving you the first half. Okay, fine, but it's the second half that was causing all the problems!