36 ms·

Google’s new reCAPTCHA has a dark side

1091 points by ProAm 7y ago

shock 7y ago
> According to two security researchers who’ve studied reCaptcha, one of the ways that Google determines whether you’re a malicious user or not is whether you already have a Google cookie installed on your browser. It’s the same cookie that allows you to open new tabs in your browser and not have to re-log in to your Google account every time. I try to never be logged into my google account as a matter of principle. Maybe I'm just fooling myself thinking this will make tracking me more difficult.
- toong 7y ago
  You don't need to log-in, to be tagged with a cookie and subsequently be identified. Sometimes referred to as "anonymous authentication".
  - cyphar 7y ago
    Or "shadow profiles".
deleted 7y ago
[deleted]
cbsks 7y ago
You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scores.php https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor... I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does. Edit: I also got 0.7 on Firefox with strict content blocking (which is supposed to block fingerprinters), uBlock Origin, and Cookie AutoDelete. I get 0.9 from a container which is logged into Google.
- deleted 7y ago
  [deleted]
- deleted 7y ago
  [deleted]
- ixwt 7y ago
  I get a 0.7 on my computer on Firefox. If I use the same website in Chrome (which is signed into a Google account) I get a 0.9. I guess it's a [0,1] scale?
  - benologist 7y ago
    I'm guessing their a-listers came up with something like this: // TODO: add impressive-looking math if (signedin && trackedEverywhere) { return 0.9 } else { return 0.7 } I think we give Google way too much credit for their talent. This is the same company that didn't feel like finishing their website for two decades and subsequently stole $75 million from their users even when Google knew [1]. The same company that somehow still doesn't reconcile amounts owed and just keeps the money when they randomly-ban users and hide behind fake support emails, but they did feel like paying $11 million to keep that away from scrutiny [2]. [1] https://www.businessinsider.com/google-emails-adtrader-lawsuit-refund-ad-click-fraud-2019-5 https://www.businessinsider.com/google-emails-adtrader-lawsu... [2] https://www.searchenginejournal.com/adsense-lawsuit/248135/ https://www.searchenginejournal.com/adsense-lawsuit/248135/
    - Twirrim 7y ago
      If I sign out of my google account in Chrome it drops from 0.9 to 0.7. I could have sworn I'd never signed in to Chrome using my google account, but I guess I must have mistakenly signed in to gmail or something. I use FF as my main browser, only ever drop back to Chrome sporadically, or when I really want tabs to be completely isolated (there are some annoyingly CPU/power intensive stuff I do from time to time, and I can just renice Chrome while I get on with other stuff.)
      - 7y ago
heavymark 7y ago
I get score of .7 in Safari. .3 in Chrome if not logged in/paused, but a .9 if logged in. Always hate that in non-logged in chrome browsers I have to fill out those picture questions a 100 times seemingly endlessly.
octosphere 7y ago
Google's captcha system is overkill for most websites. If I want to filter out bad actors (on a simple straight-forward site), there are other more simpler and easier to solve captcha systems out there. They might not have the rigour of Google's system, but they do the job, and well. I would however use Google's system if the site is massive and there is the possibility that someone is using a script or some program to algorithmically bypass the (simple) captcha, and register accounts en-masse and trying to create a psyop[0], or disinformation campaign, or even a sockpuppet army. [0] https://en.wikipedia.org/wiki/Psychological_Operations_(United_States) https://en.wikipedia.org/wiki/Psychological_Operations_(Unit...
- kop316 7y ago
  Which Captcha systems would you recommend?
  - chocolatkey 7y ago
    On that note, has anyone tried hCaptcha? I am considering using it on a project
    - amirhirsch 7y ago
      I work on hCaptcha, let me know if you have any questions.
- eli 7y ago
  There are diminishing returns once a CAPTCHA gets past a certain point. Bad actors can (and do) just humans to fill out captchas all day. We get some spam submissions on our sites that I'm 99.9% certain are people in developing countries copy/pasting spam templates and filling out captchas by hand.
  - wolco 7y ago
    What happens is the captcha is farmed out to live operators who solve it.
rolltiide 7y ago
This is probably good for proxy users, since it probably isnt just tracing a polluted IP anymore But Im not sure, since the browser sessions for some proxy users like TOR exit nodes are so short
cracker_jacks 7y ago
The other tradeoff is you're giving Google an extraordinary amount of power to decide who is allowed and not allowed on your website with no transparency on how this decision was made. Not sure what company is willing to blindly trust Google with that power.
- pergadad 7y ago
  Plenty of small companies/private website owners might make a simple cost/benefit calculation - 15% less users but in return X reduced false accounts/traffic/...
  - nothis 7y ago
    This is a problem that has to be solved by government regulation, “the market” has already made up its mind: It doesn’t give a fuck.
    - atomicUpdate 7y ago
      What is there to regulate? Bots are already illegal and "the market" has decided it does care, which is why reCAPTCHA exists and is widely used. Those companies aren't rejecting legitimate users/customers out of spite.
    - hello_newman 7y ago
      The last thing the internet needs is "government regulation". If that were to happen, you could kiss everything you love about the internet goodbye. Governments do a horrible job regulating basically everything else other than critical, necessary services, and the jury is still out even on that one. Why would they suddenly do such a better job regulating something we're still all trying to figure out?
- cyphar 7y ago
  Unfortunately, the answer is (basically) all of them. Combined with CloudFlare, even websites that aren't explicitly making that decision are still opting their users into both CloudFlare and Google's tracking. I use Tor fairly regularly and it's a complete nightmare. I sometimes spend 5-15 minutes solving reCAPTCHA (since your Tor circuit changes every 10 minutes this can result in having to solve the reCAPTCHA several times).
mrosett 7y ago
The subheadline gets it right: > It’s great for security—but not so great for your privacy. For individual users, security and privacy frequently go hand-in-hand. But for site operators, user privacy makes security a lot harder. The more you know about a user, the easier it is to figure out if they're an adversary.
modzu 7y ago
you will identify yourself to google, or you will be denied the web.
totaldude87 7y ago
add this to the list of how Google's open source engines work! ex how they treat captcha in other browsers ( easier captcha/validations for chrome users and beating the crap out of Firefox users)
superasn 7y ago
There are a lot of sites that are totally unusable on Firefox regardless how much you use ff. I do all my mobile browsing on FF yet when I try to use some websites I always get this Recaptcha failed error(1) while it works flawlessly on chrome though I never use it often. Try it, maybe it will happen for you too. Same happens on most sites which show you that "checking your browser" page via cloudflare too. The web is very unusable unless you're using chrome because of such antics. (1) https://cdn3.imggmi.com/uploads/2019/6/27/0dd96b25707ce6e236b9bfbdf3f3c82e-full.jpg https://cdn3.imggmi.com/uploads/2019/6/27/0dd96b25707ce6e236...
- pergadad 7y ago
  I have the same experience, some pages don't work on FF but fine on Chrome. I like to apply Occam's Razor, but with so many users it seems to me as if that's either by design, or certainly there is little desire to fix the issue.
  - superasn 7y ago
    Worst part is my chrome installation is 100% fresh with no browsing history and FF has cookies and history older than an year ago.. still google trusts Chrome more than FF?
    - antsar 7y ago
      To be fair, its not super-hard to follow the incentives there...
    - SquareWheel 7y ago
      reCaptcha isn't able to read your non-Google cookies or history, so most of that isn't being considered.
      - ceejayoz 7y ago
        I was under the impression sites using Google Analytics were included as a reCaptcha signal.
klyrs 7y ago
> one of the ways that Google determines whether you’re a malicious user or not is whether you already have a Google cookie installed on your browser. ... can we please get a serious antitrust investigation now?
mikojan 7y ago
There is a light side?
mikojan 7y ago
there is a light side?
writeslowly 7y ago
Wouldn't reCaptcha V3 also make things much more difficult for Google competitors, assuming that site owners place it on every page? I'm guessing it will block any sort of scraper (since scraper access patterns don't look human) with some sort of whitelist for Google's scrapers.
- quickthrower2 7y ago
  Yes it means Google has p0wnd the web.
- luckylion 7y ago
  They typically won't completely deny access, but only disallow certain actions (posting a comment etc). All out denying access will likely get site owners into trouble, at least in the EU - you need to be able to access privacy information, publisher info etc. I'm also not sure whether non-opt-in usage of recaptchav3 is GDPR compliant.
jcomis 7y ago
I hate the v3 reCAPTCHA. On FF, I usually KNOW I am answering correctly and it says I failed. I always have to go through it multiple times. It's maddening. It often leaves me second guessing myself... is that sliver of car counted? is a crossing signal a street light? What about those streetlights way off in the distance, do I select those two in addition to the ones front and center? That RV looks sort of like a bus, should I select that too?
- SlowRobotAhead 7y ago
  They want all tiles with bicycles... but are showing me a road painted bicycle crossing pictogram...
  - deleted 7y ago
    [deleted]
  - hiccuphippo 7y ago
    At that moment I don't care if their AI gets the wrong feedback on what a bicycle is as long as I get pass the captcha.
- gok 7y ago
  It's not really about getting the questions right. The challenges they present aren't that hard for modern computer vision systems. It's more about verifying that you consider the question for a "human" amount of time, make your mouse move like a human might, etc.
  - deleted 7y ago
    [deleted]
  - stirfrykitty 7y ago
    Captchas are hell on the blind and vision impaired. There are add-ons for this, but they mostly suck. Things like Webvisum exist but they are invite only.
- symlinkk 7y ago
vasili111 7y ago
Disabling browser API that adblockers/privacy protectors use. Fingerprinting users with adds at stackowerflow. Now collect information how user navigate webpage. This is a scary trend. And I am not speaking here about how Android and Android apps (which is allowed by Google) track users.
swamp40 7y ago
https://imgur.com/gallery/msNg5eY https://imgur.com/gallery/msNg5eY
LinuxBender 7y ago
So this is probably a bit off topic, but why don't more site owners just create their own unique anti-spam system? In my opinion, if they were simpler, yet all unique, there would be less bots that could mass spam and privacy would be improved. Even something as simple as a question: "How many legs does a spider have?" ____ And then cycle through different types of free form questions of things that most people should know. Perhaps block the IP after {n} failed attempts for an hour.
- JorgeGT 7y ago
  I remember a site that had such questions, specific to the knowledge of the site in question. Imagine HN asking "The L in SQL stands for: _____"
- vmurthy 7y ago
  One possible reason: the site owners nowadays use the likes of Foursquare/wix/whatnot which means reCaptcha etc are just a checkbox item. Custom anti-spam may be beyond their technical capabilities or interest levels.
- flixic 7y ago
  Most sites use reCAPTCHA to protect against bot registrations, sometimes targeted to their specific registration system. Any simple solution would defeat the purpose of a CAPTCHA.
  - LinuxBender 7y ago
    Would it though? If each system was unique and rotated through different types of challenges, the bot would have to be custom tailored to handle every challenge type. i.e. free form questions, count the gray dots (vision impaired friendly), math questions, play tic-tac-toe and get a stalemate, ascii hang-man ... I could think of hundreds of different challenges. The bot would have to constantly adapt and the bot developer would have to really love puzzles. The bot consumers would have to update constantly and would have to learn all the challenges of each site owner. As a bonus, google the all knowing, is less knowing and no longer a gate-keeper.
Mountain_Skies 7y ago
Smells a lot like using Google's virtual monopoly on bot detection as a way to push users into using one of their other products. Likely not a wise idea when the government is itching for an excuse to bring an antitrust case against you.
nkkollaw 7y ago
Google is trying to kill the competition by purposely introducing weird bugs here and there, taking advantage of the fact that they own the most visited sites on the web. They've been doing it for a while now, Tech Altar even had a video about it the other day: https://www.youtube.com/watch?v=ELCq63652ig https://www.youtube.com/watch?v=ELCq63652ig Along with the censorship and privacy issues, I guess it's time for them to change their payoff, "don't be evil".
- SlowRobotAhead 7y ago
  >I guess it's time for them to change their payoff, "don't be evil". They dropped that years ago, literally and effectively.
  - nkkollaw 7y ago
    Ah, really—wasn't aware, thanks.
dheera 7y ago
I guess another question is why we really need captchas. What are we trying to protect against that can't be accomplished with rate limits, voting systems, or other ways to regulate meaningful use of a website? Ultimately why does it matter if the user is a human or bot, as long as they are being a valuable user? What's wrong if a bot buys some of your inventory, pays for it and everything? What's wrong if an NLP bot responds to discussion threads with scientific facts and citations?
- lucb1e 7y ago
  Indeed, if they need to pay, there is no need for a CAPTCHA. As for responding to discussions, sure, you'd ban any human that posts spam the same as any bot. However, bots can spam your site faster than your human moderators can keep up with, so by using a CAPTCHA, only humans can post (ideally, of course), and thus moderators can keep up. As a security consultant, it is not uncommon to recommend a CAPTCHA for things like successive, three failed login attempts from a single IP address within a certain time period. But I do agree that CAPTCHAs are used too frequently, and some security people recommend them for just about everything. As someone who blocks a lot of tracking and feels the pain of these tracking monsters (that's what CAPTCHAs are these days, more than the Completely Automatic Public Turing test they're supposed to be), I always think very carefully whether a CAPTCHA is the only option, and I'm sure to recommend CAPTCHAs that fit the situation but are less invasive than a third-party one. Edit: oh, right, credit cards are common in many countries and banks set chargeback limits. It's still crazy to me that your 'public key' is also the only thing needed to withdraw money from your account, thereby necessitating a chargeback system. I guess for credit cards a CAPTCHA might be useful too.
  - atomicUpdate 7y ago
    > if they need to pay, there is no need for a CAPTCHA > As a security consultant Hm? How does a security consultant not know that credit card numbers can be stolen and used by bots?
    - lucb1e 7y ago
seieste 7y ago
There are government services, such as the USPTO, that rely on Google reCAPTCHA. The new reCAPTCHA has made it difficult for me to access documents, and sometimes they think that I'm a bot and thus deny me access entirely. Does the government realize the consequences of this? Both that it pushes users to use Chromium-based browsers, and that they're helping to solidify a company that already has a near monopoly in the browser space? Further, this quote is very creepy: > To make this risk-score system work accurately, website administrators are supposed to embed reCaptcha v3 code on all of the pages of their website, not just on forms or log-in pages. With AMP, Google Ads, and reCAPTCHA, Google now has access to pretty much everything that people do on the web.
- heywire 7y ago
  Makes me wonder if this could cause those sites to run afoul of the ADA? (I'm admittedly not very familiar with the requirements, but thought it was interesting to consider).
- m463 7y ago
  You are required to use reCAPTCHA on the California DMV website when making appointments and other functions. https://www.dmv.ca.gov https://www.dmv.ca.gov It will also log you in to google on the first page. Additionally, the stations at the DMV all have tablets on stands, showing Google logins for some operations.
  - aidenn0 7y ago
    When did this start? I used the DMV page without a google account in February with no issues, and the local DMV has no tablets as of May.
    - m463 7y ago
      It's been quite a while. At some point in the last year maybe with google blocked, it became impossible to register for a DMV appointment. Filling in the forms and pressing submit ended up with an unhelpful "Server Unavailable" and "Call xxx-xxx-xxxx during business hours"
keiru 7y ago
I'm much more worried about ideological persecution than targeted advertising. It's very easy to think you are doing the right thing, everyone thinks that.
Theodores 7y ago
I had to test a simple contact form implementation with reCAPTCHA yesterday on an office worker's PC that was running Chrome. I spent all day clicking on sidewalks ans traffic lights! Or buses. No idea what they want the clicks on buses for. I actually had problems upstream of the CAPTCHA. This was on a Wordpress site and I was patching up the Contact Form 7 implementation on there. What shocked me was how naff Wordpress is. After however many years it does not come with a contact form built in. Comments yes, but a contact form, no. Then the fairly de-facto Contact Form 7 would not work with Google Captcha 3 and the latest V5 Wordpress. So there must be hundreds of sites out there with contact forms that do not work. Then there are people cussing ReCaptcha when there is this hideous mess of bloat going on. The Contact Form 7 didn't even use HTML5 form validation and styling it was a nightmare. I eventually went to CAPTCHA2 with the box you tick. Having the v3 box in the bottom right of the screen on every page was not what the client wanted. Plus it didn't work with this kludge known as Wordpress. I think the issues raised in the article are not that big a deal. If you have logged in to Chrome and you are on your normal device and IP address then you can get a free pass. Why not? I seriously advise anyone to test their implementations on a non-logged in PC, it is an eye opener. And a time consumer. But forms have to be made to work. You can't have people locked out. There is a lot to be said for backend validation based on form data, I like to make forms unique with a hidden timestamp in it that is MD5 encoded. You can then see if someone has spent long enough on the form for it to be 'real'.
jvagner 7y ago
My confidence in Google reCAPTCHA is diminished by their admin site.. can't edit/change "reCAPTCHA type:v3" settings.
rbritton 7y ago
I'm torn on this. reCAPTCHA v2 (mostly useless[0]) and v3 function largely on browser fingerprinting plus a few other heuristics (e.g., whether or not you have a Google cookie). Any meaningful privacy measures to resist fingerprinting end up with a low reCAPTCHA score. I personally run into a wall on most sites using it. That said, it's one of the most effective means of combatting automated spam and credential stuffing attacks. In a recent implementation I did, having 2FA active for your account bypasses the captcha requirement, but the vast majority of users are still too non-technical to use 2FA and are subject to the frustrations of reCAPTCHA. [0]: https://github.com/dessant/buster https://github.com/dessant/buster
- gcbw2 7y ago
  It is used irresponsibly. A responsible spam protection system should allow every spam (and consequentially responsible user) from an ISP. If a ISP shows sign of abuse, then show Captcha or other system that will block some spam while also blocking some valid users. This is a evil-for-the-greater-good solution. Do not fool yourself into thinking this is a solution (i.e. without caveats) Impacted users can complain to both the service provider (you) and their ISP. And that failing, switching their ISP (i.e. voting with their wallet --how that happens in a monopoly is another discussion) Bottom line, if you show captcha for all users (even for ISPs that are now showing signs of spam) you are intentionally blocking some users for no good reason. And you are part of the problem. Sadly, this includes the US government as they blanket censor all their forms (from visa request to DMV visits) behind Google(R) captcha(tm) at all times.
  - gcbw2 7y ago
    lots of salty people in denial about being part of the problem ;)
  - remus 7y ago
    It seems that your suggestion is that ISP is a good signal for detecting spam, but it's not obvious to me that this is true. For example a site targeted by a botnet could be hit with traffic from a wide range of otherwise legitimate looking ISPs, in which case you're going to be getting a lot of spam on your website.
Proven 7y ago
That's fine - if I see that shit, I close the tab and move on... There goes your "minor inconvenience for most users"...
jk2faster 7y ago
https://hcaptcha.com/ https://hcaptcha.com/ seems to be a viable alternative. If you are a developer, please consider using something other than reCaptcha. Not only is it annoying, but a privacy nightmare as well.
- amirhirsch 7y ago
  thanks, I work on hCaptcha, we are hoping to provide a unbiased bot-detection system with different incentives from an advertising company. Let me know if you have any questions.
  - folkhack 7y ago
    Have any services like AC or 2captcha integrated against you?
    - amirhirsch 7y ago
      we've seen people asking them to integrate us on social media. you should see my comment about epidemic analysis above.
      - folkhack 7y ago
        It won't take long if you guys get popular. I don't say this as a rip - I just have never come into contact with your CAPTCHA.
- judge2020 7y ago
  > earns website owners money > an open decentralized protocol for human review that runs on the Ethereum blockchain. Is this basically a JS crypto miner?
  - amirhirsch 7y ago
    We provide dataset annotation services and pay out to sites based on what companies pay us.
bbmario 7y ago
What are the open source alternatives to this?
dessant 7y ago
Google has been doing the same with reCAPTCHA v2 [1]. They are aware of the legal risk of outright blocking users from accessing services, so reCAPTCHA v3 contains no user facing UI, Google merely makes a suggestion in the form of a user score, so the responsibility to delay or block access and the legal liability that comes with it falls on websites. reCAPTCHA v2 is superseded by v3 because it presents a broader opportunity for Google to collect data, and do so with reduced legal risk. Since reCAPTCHA v3 scripts must be loaded on every page of a site, you must send Google your browsing history and detailed data about how you interact with sites in order to access basic services on the internet, such as paying your bills, or accessing healthcare services. It's needless to say that the kind of data that is collected by reCAPTCHA v3 is extremely sensitive. Those requests contain data about your motor skills, health issues, and your interests and desires based on how you interact with content. Everything about you that can be inferred or extracted from a website visit is collected and sent to Google. If you'll refuse to transmit personal data to Google, websites will hinder or block your access. [1] https://github.com/w3c/apa/issues/25 https://github.com/w3c/apa/issues/25
- stri8ed 7y ago
  Is it that different from the way Google Analytics works?
  - tinus_hn 7y ago
    You can’t block recaptcha!
    - edraferi 7y ago
      Why not? Is it always self-hosted?
      - blacksmith_tb 7y ago
        I think they meant "you can't block reCAPTCHA and still access services behind it" - technically you could add a rule to uBlock Origin etc. to block it, but then you'd be unable to use those site/services.
quickthrower2 7y ago
Next step: recapcha pro. $29 a year (by CC or Googlecoin of course!) to browse the web free of recapchas and be able to use your favourite sites again.
- theandrewbailey 7y ago
  $29 to spam the web to my heart's content? I'll take infinity of them!
  - quickthrower2 7y ago
    You did read the ToS? It can be cancelled any time for any reason, and you'll never find out why.
uniformlyrandom 7y ago
Every 3rd party service has a dark (or grey) side. This is a trade-off for offloading some functionality onto 3rd party.
shehfnfndjdj 7y ago
Recaptcha is only used on 25% of top 10k websites? Anyway, I’m very angry about the way the web is made to work, especially identity, and usually I would spew a bunch of anger and swear words describing how stupid it is and all the people who blindly support it but I don’t want this to be censored so instead I will behave myself! This is hilarious because this is the worst, most needlessly complicated solution to identity that one could ever imagine. It’s funny how it apparently takes a PhD to tell you that google isn’t analyzing your behavior on the website. They track you across every webpage you visit that has their code running. And it goes way beyond cookies. Look at the filter bubble research that duck duck go did — they have an idea of who you are regardless of what cookies you have or whatever else. And this data has informed captcha results before this latest iteration. It’s complicated, needless and also gives a bunch of sensitive data to a private company that shouldn’t have it. Nobody cares. Identity services are the alternative to this. Have a company that has multiple ways of verifying identity including operating physical locations where you can show up and prove beyond any doubt that you are person X. Once identity is established, something like a yubikey or whatever can be used to authenticate various things like making an account on a website or what have you. If you get hacked then you can rectify by engaging in one of the identity verifications tasks, up to and including coming in person and being biometrically verified with absolute certainty. The company would make money with modest fees to users and charging websites to use their service to verify their users. It should be that the government has all this in place, and you can use secondary identification numbers for websites. But I’m the United States identity is broken, based on a shitty Ssn where if it’s stolen you are basically fucked.
kwhitefoot 7y ago
Luckily Idon't need any of the sites that ues this obnoxious tool. Just vote with your feet and tell the site to drop it or lose you.
- hombre_fatal 7y ago
  Yet you're on a website that uses ReCaptcha. Just tried to register via Tor and got this: https://i.imgur.com/svjfLqo.png https://i.imgur.com/svjfLqo.png Kind of toothless to say "I'll NEVER use ReCaptcha (except for websites I want to use)!" In fact, I'd go a step further and assert that, while you complain about ReCaptcha, you're actively benefiting from HN using ReCaptcha since you see less spam day-to-day because of it. ;)
  - kwhitefoot 7y ago
    I don't remember using recaptcha on HN.
braindead_in 7y ago
What about Google Analytics? They already have all my browsing history. reCAPTCHA data is not even as detailed as GA.
- overtlypensive 7y ago
  Don't 'whatabout' us and change the subject, we're talking about reCAPTCHA now. If you must know, the key difference is that you can block Analytics and still use the site, but are denied access if you block CAPTCHAs.
- zuzun 7y ago
  Difference is you can block Google Analytics and the websites continue to work.
  - braindead_in 7y ago
    You can roll your own captcha as well. Nobody forces you to use reCAPTCHA v3.
gingerlime 7y ago
I know people are (rightfully) worried about centralisation on the Internet, but I still wonder how come there's virtually no "competition" to reCaptcha. Even from one of the "centralised" players. For example, even Cloudflare, which has its own "checking your browser" protection, still uses reCaptcha in some other cases... Why doesn't Cloudflare offer a reCaptcha alternative to their customers? (a transparent one, more like reCaptcha v3 rather than the intrusive 5-second one...).
alexnewman 7y ago
It also doesn't block bots
beart 7y ago
If it takes me longer than 5 seconds to access the content I'm looking for, I close the tab. Am I alone in this?
- hombre_fatal 7y ago
  I doubt you're consistent with it. You'd probably wait 10+ seconds to post an HN comment for example. Easy to say you'd bounce on a website you didn't care about. That's a bit of a tautology.
  - beart 7y ago
    reCAPTCHA is often used at sign-up time. Unless I'm paying a parking ticket or something, if I can't get through your sign up process in a few seconds, then you've already lost my interest. There are so many SAAS products now, and it doesn't take much to lose out on potential users. It doesn't really impact my life much because, as you said, I probably don't have much investment in it in the first place.
dao- 7y ago
> “Google is so deeply integrated with the internet,” Khormaee says. “We want to do anything we can to protect it.” This is outright creepy.
gcbw2 7y ago
Remember every time you complained about China's citizen score system? Now remember that every interaction with the government must happen online (from requesting a US visa to going to the DMV), and all those forms are behind a Google(R) Captcha(TM) censorship system, which ranks users based on how well Google(R) can monetize the current user browser session. Let that sink in.
ksajadi 7y ago
I now leave any website that has google recaptcha unless it’s really necessary for the same reason
djsumdog 7y ago
I can't seem to find what rules for uBlock Origin and others will block reCAPTCHA v3. I'm noticing that little blue bock in the bottom right corner of more sites now and I think I just want to block it entirely. If a site won't let me login because of it, guess I'll just stop using it. If it's something like my Bank .. well guess I gotta get a new bank. Nothing really excuses this level of potential tracking.
jchook 7y ago
reCAPTCHA apparently doesn't stop bots well at all. When I published a brand new site, I got thousands of bot sign-ups in the first couple weeks. reCAPTCHA apparently had no effect on stopping them. The bots signed-up with real user emails, causing my site to send unsolicited email to them, which affected my domain's email reputation significantly. I rolled my own invisible CAPTCHA and immediately stopped ALL the bot traffic.
- folkhack 7y ago
  This is 100% accurate. There is no way to stop bots through reCAPTCHA, doesn't matter the version. It's honestly trivial and can be done with even the most basic web automation skillset. Rolling your own CAPTCHA is a fantastic option, because folks like 2captcha are never going to take the time to integrate against a one-off solution. When you do something like that you drastically increase the barrier by introducing the need for a reverse engineering skillset to bypass your unique solution... and that skillset is expensive lemme tell ya ;)
turrini 7y ago
Wait until they make google-webassembly-blobs mandatory, it will get even worse.
amluto 7y ago
> Because reCaptcha v3 is likely to be on every page of a website, if you’re signed into your Google account there’s a chance Google is getting data about every single webpage you go to that is embedded with reCaptcha v3—and there many be no visual indication on the site that it’s happening, beyond a small reCaptcha logo hidden in the corner. There’s a potentially bigger risk being overlooked. Google can execute first-party script. This means they get every user’s session credentials and can freely impersonate that user. So can all the other trackers in use. I don’t understand how anyone thinks this is remotely okay.
g00d_hack3r 7y ago
So you are so afraid of being tracked? you don't wanna give any ounce of your data? but you still want to have full access to the web, and for free?!! The world doesn't work this way. Either pay for what you get, or be prepared to accept ads/tracking. It is that simple.
- crtasm 7y ago
  I pay money to plenty of businesses and most of them still embed loads of advertising/analysis/tracking scripts. Seems less simple than you make out.
cm2187 7y ago
Stupid question: why do companies care so much about bots to the point of degrading the customer experience significantly? I can understand for things like public forums. But like why would an ecommerce website ever put a captcha between you and your order (or a news website)?
- Michielvv 7y ago
  For example: - bots sign up with email addresses that are owned by other people that don't appreciate your welcome/activation/etc. mails. - all that automatically generated data can start to hurt performance. Especially on a smaller site, having millions of useless users in your database can slow things down significantly.
  - cm2187 7y ago
    That's one thing, but like why would the FT put a captcha on the login page. I am not signing up. I just want to access a website I already paid for. This is just terrible UX.
    - blinzy 7y ago
      I think it's again to mitigate against potential bad actors attempting to access legitimate users' accounts. You could use other methods but there's always tradeoffs, e.g., let's say that instead of using a captcha you just temporarily block login attempts to some account after X failed login attempts. This has the advantage that it's faster for legitimate users as you don't need to complete the captcha; however, the main disadvantage is that you can then get an attacker brute-forcing logins (even if they don't really care about getting users' credentials) which can disrupt your website by preventing potentially thousands of users from signing in. In my opinion the captcha is the least bad option from a security point of view, as long as it has an alternative accessible mechanism for example for blind users.
- remus 7y ago
  An example from another comment: bots checking stolen cc numbers which then results in high numbers of charge backs and the potential for getting blocked by visa/mastercard.
vasili111 7y ago
Is it possible to inject code that will provide that kind of reCAPCHA fake but looking as legit data and bypass its check that way?
rmolin88 7y ago
How can I complain? Where to go? How can we organize? I want to do something about this! This is complete and utter bullying. Bullying on user privacy, bullying on Firefox. Somebody please tell me where to go?
saltminer 7y ago
>For instance, if a user with a high risk score attempts to log in, the website can set rules to ask them to enter additional verification information through two-factor authentication. This defeats the purpose of using 2FA: to require a second factor every time you login. This completely negates the benefits of 2FA if a hacker has gotten my username/password through a keylogger. It's easy enough to get a good score if you just disable tracking protections and login to a Google account, then a hacker can easily break into your account. I was thinking it had to be the author not understanding how 2FA worked, but Google is actually advocating this ([0]): > login With low scores, require 2-factor-authentication or email verification to prevent credential stuffing attacks. You would think the people behind recaptcha would understand how 2FA is supposed to work. [0]: https://developers.google.com/recaptcha/docs/v3#score https://developers.google.com/recaptcha/docs/v3#score
- judge2020 7y ago
  I think "real" 2fa isn't going to care about what ReCaptcha v3's trust score is, the case for this is "this user has a recaptcha score of 0.2, they don't have any cookies for this site, and [other system] also thinks they are suspicious. Let's require extra email verification and/or ask to answer a security question".
verisimilitudes 7y ago
Entirely disregarding how it is browsing with Tor and finding ReCAPTCHA so often due to Cloudflare, it's a bother even on a website I regularly use over my normal connection. Bandcamp is an online music store and I'm prompted for a Google ReCAPTCHA every time I try to log in, which really causes me to do it less often than I normally would, as I must permit Google JavaScript for it to succeed. I've wanted to send a complaint about this to Bandcamp, but their email is hosted by gmail and none of my messages get to them because I host my own email. Adding reverse DNS and SPF is enough for many email servers, but not Google. I find it a bad situation that my experience with a business is worse, due to Google, and I can't even contact them to let them know, due to Google.
5830 7y ago
Actually an amazingly smart play by Google - instead of making you prove you're human they make you prove you are monetizable.
macinjosh 7y ago
Everything Google does has a dark side. They are a parasitic corporation.
miccah 7y ago
> According to two security researchers who’ve studied reCaptcha, one of the ways that Google determines whether you’re a malicious user or not is whether you already have a Google cookie installed on your browser. This makes sense to me. The presence of cookies is a strong indicator of normal human browsing, and Google would only be able to see their own cookie.
- zcid 7y ago
  Except a lot of people don't like Google having persistent cookies that track your web usage. Why should giving up that data be a prerequisite for accessing a website?
  - themacguffinman 7y ago
    It's not a prerequisite for accessing the website, it's just a prerequisite for skipping the captcha puzzle.
edgartaor 7y ago
I just want shout out a previous article published here in HN that sparkle a quite interesting conversations. https://news.ycombinator.com/item?id=20158386 https://news.ycombinator.com/item?id=20158386 Long history short, don't use a captcha if you don't need it. And most of the time your website don't need it.
xg15 7y ago
Apart from the privacy nightmare, couldn't this also result in discrimination? > For instance, if a user with a high risk score attempts to log in, the website can set rules to ask them to enter additional verification information through two-factor authentication. Seems to me, this could easily flag genuine users who access the site through a non-standard flow - e.g. because they use assistive technologies. In the worst case, this could result in impaired users being forced to jump through additional hoops - or being blocked completely.
MR4D 7y ago
Not sure how this is any worse than the Facebook "like" button that's on every website on the planet. Sure, we hate that, but it's there, and plus, Google probably already has a cookie on your computer anyway. Given all that, this seems like a very minor privacy loss to whine about compared to all the other crap that Google/FB/etc does. Please help me if I'm missing something unique about this particular issue.
cyrksoft 7y ago
“Google’s ... has a dark side” is valid for almost everything they do.
anfilt 7y ago
Yet, I can't visit websites because I don't want be tracked. What's worse is this stupid thing even shows up on government, university websites ect...
basicplus2 7y ago
Time for a separate computer just for when i am forced to interact with websites using Googles recaptcha for paying bills etc
OrgNet 7y ago
not sure how Google can keep making their product worst and keep getting more customers...
numlock86 7y ago
Is it just me or is the site broken? I see it for a quarter second, then the page turns blank.
InTheArena 7y ago
Same box, same physical location. Chrome I get a score .2 higher then firefox, despite the fact that I never use chrome for anything...
KirinDave 7y ago
I'm... actually struggling to see what this dark side is. The data is collected under a non-reuse agreement. It's specifically there to make a good captcha. There are other captcha vendors, and they don't make that promise (and I can think of at least one who admits they collect and resell data via captcha). So the downside here is that no one has a credible way to compete with Google? Maybe because their Google cookie actually is a pretty good indicator of humanity? That's nonsense. Tons of people do. There's LOADS of great research on captcha that isn't implemented by any vendor. The roadblock is that NO ONE WANTS TO, because it's a thankless, unprofitable task that puts you dead in the crosshairs of a ton of very organized people who will devote huge resources to circumventing or breaking your offering. "A land grab," sure. Of a nuclear wasteland covered in small arms battles.
- kabacha 7y ago
  > The data is collected under a non-reuse agreement Oh you sweet summer child. Would you by any chance be interested in buying a bridge? Despite that, even assuming if it's true and we'll have a lovely accurate AI captcha system. The big down-side is that captcha is breaking programmable web. I maintain a lot of small software crawlers from simple notification applets to bigger analytic crawlers and the web in the past few years has been increasingly hostile towards this. API endpoints are disappearing and in general make distributing free apps very difficult. The web-crawlers are super simple to write and even maintain but services like cloudflare, distils, captcha break them and while there's always solutions to these systems they are very hard to distribute to users (you can't really pack in pupeteer, selenium or some other webengine automation stack with your app). Public data should be public. These sort of idiotic measures are not compatible with web protocol. The web only know one thing - 1 IP address == 1 person and it should be encouraged not dismissed.
  - KirinDave 7y ago
    > Despite that, even assuming if it's true and we'll have a lovely accurate AI captcha system. The big down-side is that captcha is breaking programmable web. I actually find this argument to be a bit compelling, if I'm being selfishly honest. It's super annoying that crawlers are so awkward to write these days, and I miss the days when they worked better. > but services like cloudflare, distils, captcha break them and while there's always solutions to these systems they are very hard to distribute to users (you can't really pack in pupeteer, selenium or some other webengine automation stack with your app). I don't disagree, but I also think we may be asking to keep model T's or gasoline driven 1-person bikes around. These technologies made more sense once, but make much less sense now. > Public data should be public. Sure, but what you don't get to mandate is how their public. If someone wants to make public information available in a specific way and you don't like that way, the burden is on you to republish it. Outside of a very narrow accessibility scope, I'm neither legally nor morally obligated to cater to your specific needs. And indeed, as a service or data provider I have my own problems. It's by no means an imaginary threat CAPTCHAs are solving. This is not a classical phantom security issue that statism uses to justify authoritarianism. It's equivalent to locking my doors when I leave a shop or making sure that my wares are properly labeled and not spoiled. > These sort of idiotic measures are not compatible with web protocol. The web protocol as you envision it hasn't been compatible with reality for a long time now. Hell, your crawlers are themselves a violation of the spirit of the original web. You are part of the very problem you're railing against! > The web only know one thing - 1 IP address == 1 person and it should be encouraged not dismissed. I suspect this statement is why you got downvoted, for what it's worth.
kabacha 7y ago
> Google encouraging site admins to put reCaptcha all over their sites hahah, wow. Put this tracking software suit on every page please - it's for your own good! I used to kinda believe in Accelerationism[1] - philosophy where you encourage and accelerate flawed systems to promote a breaking point. However it turns out our society doesn't really have a breaking point. 1 - https://en.wikipedia.org/wiki/Accelerationism https://en.wikipedia.org/wiki/Accelerationism
kabacha 7y ago
Could anti-competitive suit be raised towards google regarding their reCaptcha? They aiming to have (if not already) a crawler blocking tool that obviously doesn't block their own crawler. Doesn't that sound a bit dystopian?
- qtplatypus 7y ago
  You can block googles crawler with robots.txt
  - kabacha 7y ago
    That's not very relavant to my proposed problem. Here's an immaginary scenario: recaptcha blocks all crawlers except google's ones, how are competitors supposed to compete if they can't crawl anything despite robots.txt or whatever?
    - qtplatypus 7y ago
      The purpose of recaptcha is to block malicious bots from accessing parts of a site that automated bots are not supposed to go to. Why would someone be using recaptcha to block bots from the general part of their web site? Your imaginary scenario would require web masters to become hostile to crawlers.
      - kabacha 7y ago
        > web masters to become hostile to crawlers You must have been living under a rock for the past decade, haven't you? Web masters are definitely hostile towards webcrawlers. There's an entire platitude of "web-crawler" protection services - cloudflare for example is probably the biggest one.
pteredactyl 7y ago
Is this a surprise to anyone in this community?
ga-vu 7y ago
Congratulations to the reporter who found reCAPTCHA after 10 years
vinay_ys 7y ago
Any app should be clear and upfront about what data it collects and how it collects it, and what it does with it. The platforms - web-browser or operating system - that run these apps - web app or native app - for the benefit of that user - should provide well-understood intuitive experience around what is allowed/possible to be collected and used from the user's device. Now, technical mechanisms are one major part of the solution. In this regard, these mega corps should be held to a higher standards as they run the platforms as well as the biggest apps on those platforms. But we also need legal protections that make both the application owners and the platforms owners responsible for any abuse of the user. This particular case is eerily similar. Credit card fraud prevention companies do the same thing - they say they need to know as much transaction data as possible in real-time for them to know which is a legitimate transaction and which is a fraud transaction. There is misdirection and fog around how they justify this with thinly veiled technical explanations about network effects and criticisms about monopolistic by design. The reality is fraud can be prevent by designing the product differently in the first place - chip & pin - multi-factor authentication etc. technology is present to prevent theft and fraud without having to collect so much data centrally. In this case, similarly, to prevent DDoS attacks, there are other anonymous non-data collection oriented solutions possible. More research and collaboration is needed to evolve the Internet architecture to react to DDoS attackers and other types of technical abusers of your app, catch them and prevent them from growing. Instead, we get these centralized monopolistic solutions.
zipslip 7y ago
And the bright side?
neop1x 7y ago
How else do you want to detect humans in a widely-used centralized service like reCaptcha? This is the result of laziness of website developers. There could be thousands of custom captcha implementations but instead, most devs just put recaptcha there and they're done.
Mamels 7y ago
Join me here, ill give you 70 points as a sign up bonus,.we can earn $200 daily..just do the task and youll be rewarded https://coincircle.com/l/SMuyELTo~m https://coincircle.com/l/SMuyELTo~m
lg101 7y ago
_It works best with context about how humans and bots interact with your website, so for best performance include reCAPTCHA in many places_ O.o
lg101 7y ago
`It works best with context about how humans and bots interact with your website, so for best performance include reCAPTCHA in many places` O.o

1091 points by ProAm 7y ago

> According to two security researchers who’ve studied reCaptcha, one of the ways that Google determines whether you’re a malicious user or not is whether you already have a Google cookie installed on your browser. It’s the same cookie that allows you to open new tabs in your browser and not have to re-log in to your Google account every time. I try to never be logged into my google account as a matter of principle. Maybe I'm just fooling myself thinking this will make tracking me more difficult.

toong 7y ago
You don't need to log-in, to be tagged with a cookie and subsequently be identified. Sometimes referred to as "anonymous authentication".
- cyphar 7y ago
  Or "shadow profiles".

deleted 7y ago

[deleted]

cbsks 7y ago

You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scores.php https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor... I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does. Edit: I also got 0.7 on Firefox with strict content blocking (which is supposed to block fingerprinters), uBlock Origin, and Cookie AutoDelete. I get 0.9 from a container which is logged into Google.

deleted 7y ago
[deleted]
deleted 7y ago
[deleted]
ixwt 7y ago
I get a 0.7 on my computer on Firefox. If I use the same website in Chrome (which is signed into a Google account) I get a 0.9. I guess it's a [0,1] scale?
- benologist 7y ago
  I'm guessing their a-listers came up with something like this: // TODO: add impressive-looking math if (signedin && trackedEverywhere) { return 0.9 } else { return 0.7 } I think we give Google way too much credit for their talent. This is the same company that didn't feel like finishing their website for two decades and subsequently stole $75 million from their users even when Google knew [1]. The same company that somehow still doesn't reconcile amounts owed and just keeps the money when they randomly-ban users and hide behind fake support emails, but they did feel like paying $11 million to keep that away from scrutiny [2]. [1] https://www.businessinsider.com/google-emails-adtrader-lawsuit-refund-ad-click-fraud-2019-5 https://www.businessinsider.com/google-emails-adtrader-lawsu... [2] https://www.searchenginejournal.com/adsense-lawsuit/248135/ https://www.searchenginejournal.com/adsense-lawsuit/248135/
  - Twirrim 7y ago
    If I sign out of my google account in Chrome it drops from 0.9 to 0.7. I could have sworn I'd never signed in to Chrome using my google account, but I guess I must have mistakenly signed in to gmail or something. I use FF as my main browser, only ever drop back to Chrome sporadically, or when I really want tabs to be completely isolated (there are some annoyingly CPU/power intensive stuff I do from time to time, and I can just renice Chrome while I get on with other stuff.)
    - 7y ago

heavymark 7y ago

I get score of .7 in Safari. .3 in Chrome if not logged in/paused, but a .9 if logged in. Always hate that in non-logged in chrome browsers I have to fill out those picture questions a 100 times seemingly endlessly.

octosphere 7y ago

Google's captcha system is overkill for most websites. If I want to filter out bad actors (on a simple straight-forward site), there are other more simpler and easier to solve captcha systems out there. They might not have the rigour of Google's system, but they do the job, and well. I would however use Google's system if the site is massive and there is the possibility that someone is using a script or some program to algorithmically bypass the (simple) captcha, and register accounts en-masse and trying to create a psyop[0], or disinformation campaign, or even a sockpuppet army. [0] https://en.wikipedia.org/wiki/Psychological_Operations_(United_States) https://en.wikipedia.org/wiki/Psychological_Operations_(Unit...

kop316 7y ago
Which Captcha systems would you recommend?
- chocolatkey 7y ago
  On that note, has anyone tried hCaptcha? I am considering using it on a project
  - amirhirsch 7y ago
    I work on hCaptcha, let me know if you have any questions.
eli 7y ago
There are diminishing returns once a CAPTCHA gets past a certain point. Bad actors can (and do) just humans to fill out captchas all day. We get some spam submissions on our sites that I'm 99.9% certain are people in developing countries copy/pasting spam templates and filling out captchas by hand.
- wolco 7y ago
  What happens is the captcha is farmed out to live operators who solve it.

rolltiide 7y ago

This is probably good for proxy users, since it probably isnt just tracing a polluted IP anymore But Im not sure, since the browser sessions for some proxy users like TOR exit nodes are so short

cracker_jacks 7y ago

The other tradeoff is you're giving Google an extraordinary amount of power to decide who is allowed and not allowed on your website with no transparency on how this decision was made. Not sure what company is willing to blindly trust Google with that power.

pergadad 7y ago
Plenty of small companies/private website owners might make a simple cost/benefit calculation - 15% less users but in return X reduced false accounts/traffic/...
- nothis 7y ago
  This is a problem that has to be solved by government regulation, “the market” has already made up its mind: It doesn’t give a fuck.
  - atomicUpdate 7y ago
    What is there to regulate? Bots are already illegal and "the market" has decided it does care, which is why reCAPTCHA exists and is widely used. Those companies aren't rejecting legitimate users/customers out of spite.
  - hello_newman 7y ago
    The last thing the internet needs is "government regulation". If that were to happen, you could kiss everything you love about the internet goodbye. Governments do a horrible job regulating basically everything else other than critical, necessary services, and the jury is still out even on that one. Why would they suddenly do such a better job regulating something we're still all trying to figure out?
cyphar 7y ago
Unfortunately, the answer is (basically) all of them. Combined with CloudFlare, even websites that aren't explicitly making that decision are still opting their users into both CloudFlare and Google's tracking. I use Tor fairly regularly and it's a complete nightmare. I sometimes spend 5-15 minutes solving reCAPTCHA (since your Tor circuit changes every 10 minutes this can result in having to solve the reCAPTCHA several times).

mrosett 7y ago

The subheadline gets it right: > It’s great for security—but not so great for your privacy. For individual users, security and privacy frequently go hand-in-hand. But for site operators, user privacy makes security a lot harder. The more you know about a user, the easier it is to figure out if they're an adversary.

modzu 7y ago

you will identify yourself to google, or you will be denied the web.

totaldude87 7y ago

add this to the list of how Google's open source engines work! ex how they treat captcha in other browsers ( easier captcha/validations for chrome users and beating the crap out of Firefox users)

superasn 7y ago

There are a lot of sites that are totally unusable on Firefox regardless how much you use ff. I do all my mobile browsing on FF yet when I try to use some websites I always get this Recaptcha failed error(1) while it works flawlessly on chrome though I never use it often. Try it, maybe it will happen for you too. Same happens on most sites which show you that "checking your browser" page via cloudflare too. The web is very unusable unless you're using chrome because of such antics. (1) https://cdn3.imggmi.com/uploads/2019/6/27/0dd96b25707ce6e236b9bfbdf3f3c82e-full.jpg https://cdn3.imggmi.com/uploads/2019/6/27/0dd96b25707ce6e236...

pergadad 7y ago
I have the same experience, some pages don't work on FF but fine on Chrome. I like to apply Occam's Razor, but with so many users it seems to me as if that's either by design, or certainly there is little desire to fix the issue.
- superasn 7y ago
  Worst part is my chrome installation is 100% fresh with no browsing history and FF has cookies and history older than an year ago.. still google trusts Chrome more than FF?
  - antsar 7y ago
    To be fair, its not super-hard to follow the incentives there...
  - SquareWheel 7y ago
    reCaptcha isn't able to read your non-Google cookies or history, so most of that isn't being considered.
    - ceejayoz 7y ago
      I was under the impression sites using Google Analytics were included as a reCaptcha signal.

klyrs 7y ago

> one of the ways that Google determines whether you’re a malicious user or not is whether you already have a Google cookie installed on your browser. ... can we please get a serious antitrust investigation now?

mikojan 7y ago

There is a light side?

mikojan 7y ago

there is a light side?

writeslowly 7y ago

Wouldn't reCaptcha V3 also make things much more difficult for Google competitors, assuming that site owners place it on every page? I'm guessing it will block any sort of scraper (since scraper access patterns don't look human) with some sort of whitelist for Google's scrapers.

quickthrower2 7y ago
Yes it means Google has p0wnd the web.
luckylion 7y ago
They typically won't completely deny access, but only disallow certain actions (posting a comment etc). All out denying access will likely get site owners into trouble, at least in the EU - you need to be able to access privacy information, publisher info etc. I'm also not sure whether non-opt-in usage of recaptchav3 is GDPR compliant.

jcomis 7y ago

I hate the v3 reCAPTCHA. On FF, I usually KNOW I am answering correctly and it says I failed. I always have to go through it multiple times. It's maddening. It often leaves me second guessing myself... is that sliver of car counted? is a crossing signal a street light? What about those streetlights way off in the distance, do I select those two in addition to the ones front and center? That RV looks sort of like a bus, should I select that too?

SlowRobotAhead 7y ago
They want all tiles with bicycles... but are showing me a road painted bicycle crossing pictogram...
- deleted 7y ago
  [deleted]
- hiccuphippo 7y ago
  At that moment I don't care if their AI gets the wrong feedback on what a bicycle is as long as I get pass the captcha.
gok 7y ago
It's not really about getting the questions right. The challenges they present aren't that hard for modern computer vision systems. It's more about verifying that you consider the question for a "human" amount of time, make your mouse move like a human might, etc.
- deleted 7y ago
  [deleted]
- stirfrykitty 7y ago
  Captchas are hell on the blind and vision impaired. There are add-ons for this, but they mostly suck. Things like Webvisum exist but they are invite only.
symlinkk 7y ago

vasili111 7y ago

Disabling browser API that adblockers/privacy protectors use. Fingerprinting users with adds at stackowerflow. Now collect information how user navigate webpage. This is a scary trend. And I am not speaking here about how Android and Android apps (which is allowed by Google) track users.

swamp40 7y ago

https://imgur.com/gallery/msNg5eY https://imgur.com/gallery/msNg5eY

LinuxBender 7y ago

So this is probably a bit off topic, but why don't more site owners just create their own unique anti-spam system? In my opinion, if they were simpler, yet all unique, there would be less bots that could mass spam and privacy would be improved. Even something as simple as a question: "How many legs does a spider have?" ____ And then cycle through different types of free form questions of things that most people should know. Perhaps block the IP after {n} failed attempts for an hour.

JorgeGT 7y ago
I remember a site that had such questions, specific to the knowledge of the site in question. Imagine HN asking "The L in SQL stands for: _____"
vmurthy 7y ago
One possible reason: the site owners nowadays use the likes of Foursquare/wix/whatnot which means reCaptcha etc are just a checkbox item. Custom anti-spam may be beyond their technical capabilities or interest levels.
flixic 7y ago
Most sites use reCAPTCHA to protect against bot registrations, sometimes targeted to their specific registration system. Any simple solution would defeat the purpose of a CAPTCHA.
- LinuxBender 7y ago
  Would it though? If each system was unique and rotated through different types of challenges, the bot would have to be custom tailored to handle every challenge type. i.e. free form questions, count the gray dots (vision impaired friendly), math questions, play tic-tac-toe and get a stalemate, ascii hang-man ... I could think of hundreds of different challenges. The bot would have to constantly adapt and the bot developer would have to really love puzzles. The bot consumers would have to update constantly and would have to learn all the challenges of each site owner. As a bonus, google the all knowing, is less knowing and no longer a gate-keeper.

Mountain_Skies 7y ago

Smells a lot like using Google's virtual monopoly on bot detection as a way to push users into using one of their other products. Likely not a wise idea when the government is itching for an excuse to bring an antitrust case against you.

nkkollaw 7y ago

Google is trying to kill the competition by purposely introducing weird bugs here and there, taking advantage of the fact that they own the most visited sites on the web. They've been doing it for a while now, Tech Altar even had a video about it the other day: https://www.youtube.com/watch?v=ELCq63652ig https://www.youtube.com/watch?v=ELCq63652ig Along with the censorship and privacy issues, I guess it's time for them to change their payoff, "don't be evil".

SlowRobotAhead 7y ago
>I guess it's time for them to change their payoff, "don't be evil". They dropped that years ago, literally and effectively.
- nkkollaw 7y ago
  Ah, really—wasn't aware, thanks.

dheera 7y ago

I guess another question is why we really need captchas. What are we trying to protect against that can't be accomplished with rate limits, voting systems, or other ways to regulate meaningful use of a website? Ultimately why does it matter if the user is a human or bot, as long as they are being a valuable user? What's wrong if a bot buys some of your inventory, pays for it and everything? What's wrong if an NLP bot responds to discussion threads with scientific facts and citations?

lucb1e 7y ago
Indeed, if they need to pay, there is no need for a CAPTCHA. As for responding to discussions, sure, you'd ban any human that posts spam the same as any bot. However, bots can spam your site faster than your human moderators can keep up with, so by using a CAPTCHA, only humans can post (ideally, of course), and thus moderators can keep up. As a security consultant, it is not uncommon to recommend a CAPTCHA for things like successive, three failed login attempts from a single IP address within a certain time period. But I do agree that CAPTCHAs are used too frequently, and some security people recommend them for just about everything. As someone who blocks a lot of tracking and feels the pain of these tracking monsters (that's what CAPTCHAs are these days, more than the Completely Automatic Public Turing test they're supposed to be), I always think very carefully whether a CAPTCHA is the only option, and I'm sure to recommend CAPTCHAs that fit the situation but are less invasive than a third-party one. Edit: oh, right, credit cards are common in many countries and banks set chargeback limits. It's still crazy to me that your 'public key' is also the only thing needed to withdraw money from your account, thereby necessitating a chargeback system. I guess for credit cards a CAPTCHA might be useful too.
- atomicUpdate 7y ago
  > if they need to pay, there is no need for a CAPTCHA > As a security consultant Hm? How does a security consultant not know that credit card numbers can be stolen and used by bots?
  - lucb1e 7y ago

seieste 7y ago

There are government services, such as the USPTO, that rely on Google reCAPTCHA. The new reCAPTCHA has made it difficult for me to access documents, and sometimes they think that I'm a bot and thus deny me access entirely. Does the government realize the consequences of this? Both that it pushes users to use Chromium-based browsers, and that they're helping to solidify a company that already has a near monopoly in the browser space? Further, this quote is very creepy: > To make this risk-score system work accurately, website administrators are supposed to embed reCaptcha v3 code on all of the pages of their website, not just on forms or log-in pages. With AMP, Google Ads, and reCAPTCHA, Google now has access to pretty much everything that people do on the web.

heywire 7y ago
Makes me wonder if this could cause those sites to run afoul of the ADA? (I'm admittedly not very familiar with the requirements, but thought it was interesting to consider).
m463 7y ago
You are required to use reCAPTCHA on the California DMV website when making appointments and other functions. https://www.dmv.ca.gov https://www.dmv.ca.gov It will also log you in to google on the first page. Additionally, the stations at the DMV all have tablets on stands, showing Google logins for some operations.
- aidenn0 7y ago
  When did this start? I used the DMV page without a google account in February with no issues, and the local DMV has no tablets as of May.
  - m463 7y ago
    It's been quite a while. At some point in the last year maybe with google blocked, it became impossible to register for a DMV appointment. Filling in the forms and pressing submit ended up with an unhelpful "Server Unavailable" and "Call xxx-xxx-xxxx during business hours"

keiru 7y ago

I'm much more worried about ideological persecution than targeted advertising. It's very easy to think you are doing the right thing, everyone thinks that.

Theodores 7y ago

I had to test a simple contact form implementation with reCAPTCHA yesterday on an office worker's PC that was running Chrome. I spent all day clicking on sidewalks ans traffic lights! Or buses. No idea what they want the clicks on buses for. I actually had problems upstream of the CAPTCHA. This was on a Wordpress site and I was patching up the Contact Form 7 implementation on there. What shocked me was how naff Wordpress is. After however many years it does not come with a contact form built in. Comments yes, but a contact form, no. Then the fairly de-facto Contact Form 7 would not work with Google Captcha 3 and the latest V5 Wordpress. So there must be hundreds of sites out there with contact forms that do not work. Then there are people cussing ReCaptcha when there is this hideous mess of bloat going on. The Contact Form 7 didn't even use HTML5 form validation and styling it was a nightmare. I eventually went to CAPTCHA2 with the box you tick. Having the v3 box in the bottom right of the screen on every page was not what the client wanted. Plus it didn't work with this kludge known as Wordpress. I think the issues raised in the article are not that big a deal. If you have logged in to Chrome and you are on your normal device and IP address then you can get a free pass. Why not? I seriously advise anyone to test their implementations on a non-logged in PC, it is an eye opener. And a time consumer. But forms have to be made to work. You can't have people locked out. There is a lot to be said for backend validation based on form data, I like to make forms unique with a hidden timestamp in it that is MD5 encoded. You can then see if someone has spent long enough on the form for it to be 'real'.

jvagner 7y ago

My confidence in Google reCAPTCHA is diminished by their admin site.. can't edit/change "reCAPTCHA type:v3" settings.

rbritton 7y ago

I'm torn on this. reCAPTCHA v2 (mostly useless[0]) and v3 function largely on browser fingerprinting plus a few other heuristics (e.g., whether or not you have a Google cookie). Any meaningful privacy measures to resist fingerprinting end up with a low reCAPTCHA score. I personally run into a wall on most sites using it. That said, it's one of the most effective means of combatting automated spam and credential stuffing attacks. In a recent implementation I did, having 2FA active for your account bypasses the captcha requirement, but the vast majority of users are still too non-technical to use 2FA and are subject to the frustrations of reCAPTCHA. [0]: https://github.com/dessant/buster https://github.com/dessant/buster

gcbw2 7y ago
It is used irresponsibly. A responsible spam protection system should allow every spam (and consequentially responsible user) from an ISP. If a ISP shows sign of abuse, then show Captcha or other system that will block some spam while also blocking some valid users. This is a evil-for-the-greater-good solution. Do not fool yourself into thinking this is a solution (i.e. without caveats) Impacted users can complain to both the service provider (you) and their ISP. And that failing, switching their ISP (i.e. voting with their wallet --how that happens in a monopoly is another discussion) Bottom line, if you show captcha for all users (even for ISPs that are now showing signs of spam) you are intentionally blocking some users for no good reason. And you are part of the problem. Sadly, this includes the US government as they blanket censor all their forms (from visa request to DMV visits) behind Google(R) captcha(tm) at all times.
- gcbw2 7y ago
  lots of salty people in denial about being part of the problem ;)
- remus 7y ago
  It seems that your suggestion is that ISP is a good signal for detecting spam, but it's not obvious to me that this is true. For example a site targeted by a botnet could be hit with traffic from a wide range of otherwise legitimate looking ISPs, in which case you're going to be getting a lot of spam on your website.

Proven 7y ago

That's fine - if I see that shit, I close the tab and move on... There goes your "minor inconvenience for most users"...

jk2faster 7y ago

https://hcaptcha.com/ https://hcaptcha.com/ seems to be a viable alternative. If you are a developer, please consider using something other than reCaptcha. Not only is it annoying, but a privacy nightmare as well.

amirhirsch 7y ago
thanks, I work on hCaptcha, we are hoping to provide a unbiased bot-detection system with different incentives from an advertising company. Let me know if you have any questions.
- folkhack 7y ago
  Have any services like AC or 2captcha integrated against you?
  - amirhirsch 7y ago
    we've seen people asking them to integrate us on social media. you should see my comment about epidemic analysis above.
    - folkhack 7y ago
      It won't take long if you guys get popular. I don't say this as a rip - I just have never come into contact with your CAPTCHA.
judge2020 7y ago
> earns website owners money > an open decentralized protocol for human review that runs on the Ethereum blockchain. Is this basically a JS crypto miner?
- amirhirsch 7y ago
  We provide dataset annotation services and pay out to sites based on what companies pay us.

bbmario 7y ago

What are the open source alternatives to this?

dessant 7y ago

Google has been doing the same with reCAPTCHA v2 [1]. They are aware of the legal risk of outright blocking users from accessing services, so reCAPTCHA v3 contains no user facing UI, Google merely makes a suggestion in the form of a user score, so the responsibility to delay or block access and the legal liability that comes with it falls on websites. reCAPTCHA v2 is superseded by v3 because it presents a broader opportunity for Google to collect data, and do so with reduced legal risk. Since reCAPTCHA v3 scripts must be loaded on every page of a site, you must send Google your browsing history and detailed data about how you interact with sites in order to access basic services on the internet, such as paying your bills, or accessing healthcare services. It's needless to say that the kind of data that is collected by reCAPTCHA v3 is extremely sensitive. Those requests contain data about your motor skills, health issues, and your interests and desires based on how you interact with content. Everything about you that can be inferred or extracted from a website visit is collected and sent to Google. If you'll refuse to transmit personal data to Google, websites will hinder or block your access. [1] https://github.com/w3c/apa/issues/25 https://github.com/w3c/apa/issues/25

stri8ed 7y ago
Is it that different from the way Google Analytics works?
- tinus_hn 7y ago
  You can’t block recaptcha!
  - edraferi 7y ago
    Why not? Is it always self-hosted?
    - blacksmith_tb 7y ago
      I think they meant "you can't block reCAPTCHA and still access services behind it" - technically you could add a rule to uBlock Origin etc. to block it, but then you'd be unable to use those site/services.

quickthrower2 7y ago

Next step: recapcha pro. $29 a year (by CC or Googlecoin of course!) to browse the web free of recapchas and be able to use your favourite sites again.

theandrewbailey 7y ago
$29 to spam the web to my heart's content? I'll take infinity of them!
- quickthrower2 7y ago
  You did read the ToS? It can be cancelled any time for any reason, and you'll never find out why.

uniformlyrandom 7y ago

Every 3rd party service has a dark (or grey) side. This is a trade-off for offloading some functionality onto 3rd party.

shehfnfndjdj 7y ago

Recaptcha is only used on 25% of top 10k websites? Anyway, I’m very angry about the way the web is made to work, especially identity, and usually I would spew a bunch of anger and swear words describing how stupid it is and all the people who blindly support it but I don’t want this to be censored so instead I will behave myself! This is hilarious because this is the worst, most needlessly complicated solution to identity that one could ever imagine. It’s funny how it apparently takes a PhD to tell you that google isn’t analyzing your behavior on the website. They track you across every webpage you visit that has their code running. And it goes way beyond cookies. Look at the filter bubble research that duck duck go did — they have an idea of who you are regardless of what cookies you have or whatever else. And this data has informed captcha results before this latest iteration. It’s complicated, needless and also gives a bunch of sensitive data to a private company that shouldn’t have it. Nobody cares. Identity services are the alternative to this. Have a company that has multiple ways of verifying identity including operating physical locations where you can show up and prove beyond any doubt that you are person X. Once identity is established, something like a yubikey or whatever can be used to authenticate various things like making an account on a website or what have you. If you get hacked then you can rectify by engaging in one of the identity verifications tasks, up to and including coming in person and being biometrically verified with absolute certainty. The company would make money with modest fees to users and charging websites to use their service to verify their users. It should be that the government has all this in place, and you can use secondary identification numbers for websites. But I’m the United States identity is broken, based on a shitty Ssn where if it’s stolen you are basically fucked.

kwhitefoot 7y ago

Luckily Idon't need any of the sites that ues this obnoxious tool. Just vote with your feet and tell the site to drop it or lose you.

hombre_fatal 7y ago
Yet you're on a website that uses ReCaptcha. Just tried to register via Tor and got this: https://i.imgur.com/svjfLqo.png https://i.imgur.com/svjfLqo.png Kind of toothless to say "I'll NEVER use ReCaptcha (except for websites I want to use)!" In fact, I'd go a step further and assert that, while you complain about ReCaptcha, you're actively benefiting from HN using ReCaptcha since you see less spam day-to-day because of it. ;)
- kwhitefoot 7y ago
  I don't remember using recaptcha on HN.

braindead_in 7y ago

What about Google Analytics? They already have all my browsing history. reCAPTCHA data is not even as detailed as GA.

overtlypensive 7y ago
Don't 'whatabout' us and change the subject, we're talking about reCAPTCHA now. If you must know, the key difference is that you can block Analytics and still use the site, but are denied access if you block CAPTCHAs.
zuzun 7y ago
Difference is you can block Google Analytics and the websites continue to work.
- braindead_in 7y ago
  You can roll your own captcha as well. Nobody forces you to use reCAPTCHA v3.

gingerlime 7y ago

I know people are (rightfully) worried about centralisation on the Internet, but I still wonder how come there's virtually no "competition" to reCaptcha. Even from one of the "centralised" players. For example, even Cloudflare, which has its own "checking your browser" protection, still uses reCaptcha in some other cases... Why doesn't Cloudflare offer a reCaptcha alternative to their customers? (a transparent one, more like reCaptcha v3 rather than the intrusive 5-second one...).

alexnewman 7y ago

It also doesn't block bots

beart 7y ago

If it takes me longer than 5 seconds to access the content I'm looking for, I close the tab. Am I alone in this?

hombre_fatal 7y ago
I doubt you're consistent with it. You'd probably wait 10+ seconds to post an HN comment for example. Easy to say you'd bounce on a website you didn't care about. That's a bit of a tautology.
- beart 7y ago
  reCAPTCHA is often used at sign-up time. Unless I'm paying a parking ticket or something, if I can't get through your sign up process in a few seconds, then you've already lost my interest. There are so many SAAS products now, and it doesn't take much to lose out on potential users. It doesn't really impact my life much because, as you said, I probably don't have much investment in it in the first place.

dao- 7y ago

> “Google is so deeply integrated with the internet,” Khormaee says. “We want to do anything we can to protect it.” This is outright creepy.

gcbw2 7y ago

Remember every time you complained about China's citizen score system? Now remember that every interaction with the government must happen online (from requesting a US visa to going to the DMV), and all those forms are behind a Google(R) Captcha(TM) censorship system, which ranks users based on how well Google(R) can monetize the current user browser session. Let that sink in.

ksajadi 7y ago

I now leave any website that has google recaptcha unless it’s really necessary for the same reason

djsumdog 7y ago

I can't seem to find what rules for uBlock Origin and others will block reCAPTCHA v3. I'm noticing that little blue bock in the bottom right corner of more sites now and I think I just want to block it entirely. If a site won't let me login because of it, guess I'll just stop using it. If it's something like my Bank .. well guess I gotta get a new bank. Nothing really excuses this level of potential tracking.

jchook 7y ago

reCAPTCHA apparently doesn't stop bots well at all. When I published a brand new site, I got thousands of bot sign-ups in the first couple weeks. reCAPTCHA apparently had no effect on stopping them. The bots signed-up with real user emails, causing my site to send unsolicited email to them, which affected my domain's email reputation significantly. I rolled my own invisible CAPTCHA and immediately stopped ALL the bot traffic.

folkhack 7y ago
This is 100% accurate. There is no way to stop bots through reCAPTCHA, doesn't matter the version. It's honestly trivial and can be done with even the most basic web automation skillset. Rolling your own CAPTCHA is a fantastic option, because folks like 2captcha are never going to take the time to integrate against a one-off solution. When you do something like that you drastically increase the barrier by introducing the need for a reverse engineering skillset to bypass your unique solution... and that skillset is expensive lemme tell ya ;)

turrini 7y ago

Wait until they make google-webassembly-blobs mandatory, it will get even worse.

amluto 7y ago

> Because reCaptcha v3 is likely to be on every page of a website, if you’re signed into your Google account there’s a chance Google is getting data about every single webpage you go to that is embedded with reCaptcha v3—and there many be no visual indication on the site that it’s happening, beyond a small reCaptcha logo hidden in the corner. There’s a potentially bigger risk being overlooked. Google can execute first-party script. This means they get every user’s session credentials and can freely impersonate that user. So can all the other trackers in use. I don’t understand how anyone thinks this is remotely okay.

g00d_hack3r 7y ago

So you are so afraid of being tracked? you don't wanna give any ounce of your data? but you still want to have full access to the web, and for free?!! The world doesn't work this way. Either pay for what you get, or be prepared to accept ads/tracking. It is that simple.

crtasm 7y ago
I pay money to plenty of businesses and most of them still embed loads of advertising/analysis/tracking scripts. Seems less simple than you make out.

cm2187 7y ago

Stupid question: why do companies care so much about bots to the point of degrading the customer experience significantly? I can understand for things like public forums. But like why would an ecommerce website ever put a captcha between you and your order (or a news website)?

Michielvv 7y ago
For example: - bots sign up with email addresses that are owned by other people that don't appreciate your welcome/activation/etc. mails. - all that automatically generated data can start to hurt performance. Especially on a smaller site, having millions of useless users in your database can slow things down significantly.
- cm2187 7y ago
  That's one thing, but like why would the FT put a captcha on the login page. I am not signing up. I just want to access a website I already paid for. This is just terrible UX.
  - blinzy 7y ago
    I think it's again to mitigate against potential bad actors attempting to access legitimate users' accounts. You could use other methods but there's always tradeoffs, e.g., let's say that instead of using a captcha you just temporarily block login attempts to some account after X failed login attempts. This has the advantage that it's faster for legitimate users as you don't need to complete the captcha; however, the main disadvantage is that you can then get an attacker brute-forcing logins (even if they don't really care about getting users' credentials) which can disrupt your website by preventing potentially thousands of users from signing in. In my opinion the captcha is the least bad option from a security point of view, as long as it has an alternative accessible mechanism for example for blind users.
remus 7y ago
An example from another comment: bots checking stolen cc numbers which then results in high numbers of charge backs and the potential for getting blocked by visa/mastercard.

vasili111 7y ago

Is it possible to inject code that will provide that kind of reCAPCHA fake but looking as legit data and bypass its check that way?

rmolin88 7y ago

How can I complain? Where to go? How can we organize? I want to do something about this! This is complete and utter bullying. Bullying on user privacy, bullying on Firefox. Somebody please tell me where to go?

saltminer 7y ago

>For instance, if a user with a high risk score attempts to log in, the website can set rules to ask them to enter additional verification information through two-factor authentication. This defeats the purpose of using 2FA: to require a second factor every time you login. This completely negates the benefits of 2FA if a hacker has gotten my username/password through a keylogger. It's easy enough to get a good score if you just disable tracking protections and login to a Google account, then a hacker can easily break into your account. I was thinking it had to be the author not understanding how 2FA worked, but Google is actually advocating this ([0]): > login With low scores, require 2-factor-authentication or email verification to prevent credential stuffing attacks. You would think the people behind recaptcha would understand how 2FA is supposed to work. [0]: https://developers.google.com/recaptcha/docs/v3#score https://developers.google.com/recaptcha/docs/v3#score

judge2020 7y ago
I think "real" 2fa isn't going to care about what ReCaptcha v3's trust score is, the case for this is "this user has a recaptcha score of 0.2, they don't have any cookies for this site, and [other system] also thinks they are suspicious. Let's require extra email verification and/or ask to answer a security question".

verisimilitudes 7y ago

Entirely disregarding how it is browsing with Tor and finding ReCAPTCHA so often due to Cloudflare, it's a bother even on a website I regularly use over my normal connection. Bandcamp is an online music store and I'm prompted for a Google ReCAPTCHA every time I try to log in, which really causes me to do it less often than I normally would, as I must permit Google JavaScript for it to succeed. I've wanted to send a complaint about this to Bandcamp, but their email is hosted by gmail and none of my messages get to them because I host my own email. Adding reverse DNS and SPF is enough for many email servers, but not Google. I find it a bad situation that my experience with a business is worse, due to Google, and I can't even contact them to let them know, due to Google.

5830 7y ago

Actually an amazingly smart play by Google - instead of making you prove you're human they make you prove you are monetizable.

macinjosh 7y ago

Everything Google does has a dark side. They are a parasitic corporation.

miccah 7y ago

> According to two security researchers who’ve studied reCaptcha, one of the ways that Google determines whether you’re a malicious user or not is whether you already have a Google cookie installed on your browser. This makes sense to me. The presence of cookies is a strong indicator of normal human browsing, and Google would only be able to see their own cookie.

zcid 7y ago
Except a lot of people don't like Google having persistent cookies that track your web usage. Why should giving up that data be a prerequisite for accessing a website?
- themacguffinman 7y ago
  It's not a prerequisite for accessing the website, it's just a prerequisite for skipping the captcha puzzle.

edgartaor 7y ago

I just want shout out a previous article published here in HN that sparkle a quite interesting conversations. https://news.ycombinator.com/item?id=20158386 https://news.ycombinator.com/item?id=20158386 Long history short, don't use a captcha if you don't need it. And most of the time your website don't need it.

xg15 7y ago

Apart from the privacy nightmare, couldn't this also result in discrimination? > For instance, if a user with a high risk score attempts to log in, the website can set rules to ask them to enter additional verification information through two-factor authentication. Seems to me, this could easily flag genuine users who access the site through a non-standard flow - e.g. because they use assistive technologies. In the worst case, this could result in impaired users being forced to jump through additional hoops - or being blocked completely.

MR4D 7y ago

Not sure how this is any worse than the Facebook "like" button that's on every website on the planet. Sure, we hate that, but it's there, and plus, Google probably already has a cookie on your computer anyway. Given all that, this seems like a very minor privacy loss to whine about compared to all the other crap that Google/FB/etc does. Please help me if I'm missing something unique about this particular issue.

cyrksoft 7y ago

“Google’s ... has a dark side” is valid for almost everything they do.

anfilt 7y ago

Yet, I can't visit websites because I don't want be tracked. What's worse is this stupid thing even shows up on government, university websites ect...

basicplus2 7y ago

Time for a separate computer just for when i am forced to interact with websites using Googles recaptcha for paying bills etc

OrgNet 7y ago

not sure how Google can keep making their product worst and keep getting more customers...

numlock86 7y ago

Is it just me or is the site broken? I see it for a quarter second, then the page turns blank.

InTheArena 7y ago

Same box, same physical location. Chrome I get a score .2 higher then firefox, despite the fact that I never use chrome for anything...

KirinDave 7y ago

I'm... actually struggling to see what this dark side is. The data is collected under a non-reuse agreement. It's specifically there to make a good captcha. There are other captcha vendors, and they don't make that promise (and I can think of at least one who admits they collect and resell data via captcha). So the downside here is that no one has a credible way to compete with Google? Maybe because their Google cookie actually is a pretty good indicator of humanity? That's nonsense. Tons of people do. There's LOADS of great research on captcha that isn't implemented by any vendor. The roadblock is that NO ONE WANTS TO, because it's a thankless, unprofitable task that puts you dead in the crosshairs of a ton of very organized people who will devote huge resources to circumventing or breaking your offering. "A land grab," sure. Of a nuclear wasteland covered in small arms battles.

kabacha 7y ago
> The data is collected under a non-reuse agreement Oh you sweet summer child. Would you by any chance be interested in buying a bridge? Despite that, even assuming if it's true and we'll have a lovely accurate AI captcha system. The big down-side is that captcha is breaking programmable web. I maintain a lot of small software crawlers from simple notification applets to bigger analytic crawlers and the web in the past few years has been increasingly hostile towards this. API endpoints are disappearing and in general make distributing free apps very difficult. The web-crawlers are super simple to write and even maintain but services like cloudflare, distils, captcha break them and while there's always solutions to these systems they are very hard to distribute to users (you can't really pack in pupeteer, selenium or some other webengine automation stack with your app). Public data should be public. These sort of idiotic measures are not compatible with web protocol. The web only know one thing - 1 IP address == 1 person and it should be encouraged not dismissed.
- KirinDave 7y ago
  > Despite that, even assuming if it's true and we'll have a lovely accurate AI captcha system. The big down-side is that captcha is breaking programmable web. I actually find this argument to be a bit compelling, if I'm being selfishly honest. It's super annoying that crawlers are so awkward to write these days, and I miss the days when they worked better. > but services like cloudflare, distils, captcha break them and while there's always solutions to these systems they are very hard to distribute to users (you can't really pack in pupeteer, selenium or some other webengine automation stack with your app). I don't disagree, but I also think we may be asking to keep model T's or gasoline driven 1-person bikes around. These technologies made more sense once, but make much less sense now. > Public data should be public. Sure, but what you don't get to mandate is how their public. If someone wants to make public information available in a specific way and you don't like that way, the burden is on you to republish it. Outside of a very narrow accessibility scope, I'm neither legally nor morally obligated to cater to your specific needs. And indeed, as a service or data provider I have my own problems. It's by no means an imaginary threat CAPTCHAs are solving. This is not a classical phantom security issue that statism uses to justify authoritarianism. It's equivalent to locking my doors when I leave a shop or making sure that my wares are properly labeled and not spoiled. > These sort of idiotic measures are not compatible with web protocol. The web protocol as you envision it hasn't been compatible with reality for a long time now. Hell, your crawlers are themselves a violation of the spirit of the original web. You are part of the very problem you're railing against! > The web only know one thing - 1 IP address == 1 person and it should be encouraged not dismissed. I suspect this statement is why you got downvoted, for what it's worth.

kabacha 7y ago

> Google encouraging site admins to put reCaptcha all over their sites hahah, wow. Put this tracking software suit on every page please - it's for your own good! I used to kinda believe in Accelerationism[1] - philosophy where you encourage and accelerate flawed systems to promote a breaking point. However it turns out our society doesn't really have a breaking point. 1 - https://en.wikipedia.org/wiki/Accelerationism https://en.wikipedia.org/wiki/Accelerationism

kabacha 7y ago

Could anti-competitive suit be raised towards google regarding their reCaptcha? They aiming to have (if not already) a crawler blocking tool that obviously doesn't block their own crawler. Doesn't that sound a bit dystopian?

qtplatypus 7y ago
You can block googles crawler with robots.txt
- kabacha 7y ago
  That's not very relavant to my proposed problem. Here's an immaginary scenario: recaptcha blocks all crawlers except google's ones, how are competitors supposed to compete if they can't crawl anything despite robots.txt or whatever?
  - qtplatypus 7y ago
    The purpose of recaptcha is to block malicious bots from accessing parts of a site that automated bots are not supposed to go to. Why would someone be using recaptcha to block bots from the general part of their web site? Your imaginary scenario would require web masters to become hostile to crawlers.
    - kabacha 7y ago
      > web masters to become hostile to crawlers You must have been living under a rock for the past decade, haven't you? Web masters are definitely hostile towards webcrawlers. There's an entire platitude of "web-crawler" protection services - cloudflare for example is probably the biggest one.

pteredactyl 7y ago

Is this a surprise to anyone in this community?

ga-vu 7y ago

Congratulations to the reporter who found reCAPTCHA after 10 years

vinay_ys 7y ago

Any app should be clear and upfront about what data it collects and how it collects it, and what it does with it. The platforms - web-browser or operating system - that run these apps - web app or native app - for the benefit of that user - should provide well-understood intuitive experience around what is allowed/possible to be collected and used from the user's device. Now, technical mechanisms are one major part of the solution. In this regard, these mega corps should be held to a higher standards as they run the platforms as well as the biggest apps on those platforms. But we also need legal protections that make both the application owners and the platforms owners responsible for any abuse of the user. This particular case is eerily similar. Credit card fraud prevention companies do the same thing - they say they need to know as much transaction data as possible in real-time for them to know which is a legitimate transaction and which is a fraud transaction. There is misdirection and fog around how they justify this with thinly veiled technical explanations about network effects and criticisms about monopolistic by design. The reality is fraud can be prevent by designing the product differently in the first place - chip & pin - multi-factor authentication etc. technology is present to prevent theft and fraud without having to collect so much data centrally. In this case, similarly, to prevent DDoS attacks, there are other anonymous non-data collection oriented solutions possible. More research and collaboration is needed to evolve the Internet architecture to react to DDoS attackers and other types of technical abusers of your app, catch them and prevent them from growing. Instead, we get these centralized monopolistic solutions.

zipslip 7y ago

And the bright side?

neop1x 7y ago

How else do you want to detect humans in a widely-used centralized service like reCaptcha? This is the result of laziness of website developers. There could be thousands of custom captcha implementations but instead, most devs just put recaptcha there and they're done.

Mamels 7y ago

Join me here, ill give you 70 points as a sign up bonus,.we can earn $200 daily..just do the task and youll be rewarded https://coincircle.com/l/SMuyELTo~m https://coincircle.com/l/SMuyELTo~m

lg101 7y ago

_It works best with context about how humans and bots interact with your website, so for best performance include reCAPTCHA in many places_ O.o

lg101 7y ago

`It works best with context about how humans and bots interact with your website, so for best performance include reCAPTCHA in many places` O.o