19 ms·

Google has been doing the same with reCAPTCHA v2 [1]. They are aware of the legal risk of outright blocking users from accessing services, so reCAPTCHA v3 conta

• stri8ed 7y ago
  Is it that different from the way Google Analytics works?
  • tinus_hn 7y ago
    You can’t block recaptcha!
    • edraferi 7y ago
      Why not? Is it always self-hosted?
      • blacksmith_tb 7y ago
        I think they meant "you can't block reCAPTCHA and still access services behind it" - technically you could add a rule to uBlock Origin etc. to block it, but then you'd be unable to use those site/services.
  • dessant 7y ago
    You should expect a similar impact on your privacy. The important difference is that unlike Google Analytics, reCAPTCHA v3 is inescapable. You cannot prevent the collection of your personal data, because then you would loose access to large portions of the web.
  • frenchyatwork 7y ago
    It is, in the sense that it's easy to disable Google Analytics by disabling tracking in Firefox, and there's no consequences. If a website uses reCAPTCHA, and you have tracking disabled, the website will break.
    • behringer 7y ago
      Works for me. Assuming one uses something like Privacy Badger and it if it were programmed to block reCaptcha, these websites that require recaptcha will go the way of anti-adblocker popups. People will simply say no and hit the X and go to their competitors.
      • joaobeno 7y ago
        Sure, my gov (Brazil) uses reCaptcha on the page where you can check your electoral status (For example: if you can vote, where, and if not, what is missing). Where can I find a competitor for that?
        • behringer 7y ago
          Ask your political representative why they're relying on a foreign ad service to manage their government websites.
• dao- 7y ago
  I'm not sure there's a significant legal difference in the end. If someone could demonstrate that alternative browsers regularly get a lower score than Chrome, that seems like a pretty good antitrust case. Or were you referring to the risk that individuals would sue Google for getting blocked from random, potentially essential websites?
  • bduerst 7y ago
    Not GP but they most likely meant the second. The V2 prompt blocks people from accessing services, which could be construed as damages at scale. You do bring up a good point about the V3 being potential antitrust issue, but that has always been a potential problem even with earlier versions of recaptcha. With V3, it's also deferring the liability to the webmaster. The action that the website takes with the score is up to them - in the end it's just a number.
• deleted 7y ago
  [deleted]
• benreesman 7y ago
  Your comment adds a lot to the conversation, so I don’t want to be more contrary than necessary. It’s nonetheless a shame that it’s so universally misunderstood how ad-supported megacorps make their money that even highly sophisticated users of the web still talk about the value of personal data (source: I ran Facebook’s ads backend for years). Much like the highest information-gain feature for the future price of a security is it’s most recent price: ad historical CTR and user historical CTR (called “clickiness” in the business) are basically the whole show when predicting user cross ad CTR. The big shops like to ham up their data advantage with one hand (to advertisers) while washing the other hand of it (to regulators). As with so many things Hanlon’s Razor cuts deeply here: if your browsing history can juice CTR prediction then I’ve never seen it. I have seen careers premised on that idea, but I’ve never seen it work.
  • gfosco 7y ago
    I think it's worth pointing out that the comment you replied to didn't mention money, advertising, or CTR. People are concerned about data collection for more reasons than that. You've seen these attempts and entire careers about it without "juicing" CTR, so perhaps that isn't the true intent.
    • benreesman 7y ago
      I admit that I inferred the proposed intent for grabbing maximum personal data, but if you’re interested in anecdotes from the trenches: no one below senior director level gets a couple million in stock for any other reason than they pushed CTR by a few basis points. What I was trying to say is that seen through the lens of mechanism design no one is incentivized to query the like button table because there’s no upside in it.
      • EpicEng 7y ago
        The fact that so much potentially sensitive data exists in a few repositories is in itself a bit foreboding. Who knows what companies will be able to glean from it one, five, or twenty years down the road? My behavior on the web being tracked by corporations with little incentive to do right by me is worrisome.
• dessant 7y ago
  This comment has been detached, originally it was a reply to https://news.ycombinator.com/item?id=20295333 https://news.ycombinator.com/item?id=20295333.
• modzu 7y ago
  in other words this is a callout to all webmasters: please consider not using recaptcha.
• thekyle 7y ago
  > Since reCAPTCHA v3 scripts must be loaded on every page of a site, you must send Google your browsing history and detailed data about how you interact with sites in order to access basic services on the internet, such as paying your bills, or accessing healthcare services. I don't believe this is true. You only need to include the JavaScript on pages which actively use the reCAPTCHA score. For example, you might only include it on the login and user registration pages.
  • luckylion 7y ago
    Isn't the idea that they can decide whether it's a user or a bot based on what the user does in general, not just whether their browser executes JS on this page that you want to protect? Running headless chrome is trivial, so just having it sit on the one page where you need to check it won't help much. Collecting more data on the user's action on your site will provide a much clearer picture, much like a video from somebody walking through a store will help you make a decision about whether he's trying to steal something than a single picture of him standing at the check out.
    • judge2020 7y ago
      The big "if" here is whether or not Google is actually factoring the user's activity into the score. For all we know, there could be a 80/20 split between "Google account activity" and "human-like behavior on website" when Google outputs a trust score.
  • zymhan 7y ago
    Did you read the article? > To make this risk-score system work accurately, website administrators are supposed to embed reCaptcha v3 code on all of the pages of their website, not just on forms or log-in pages.
    • thekyle 7y ago
      Google recommends that you include the code on multiple pages, however, it makes it clear in the official docs that this is absolutely NOT required for the reCAPTCHA v3 system to work. So if the article stated that websites were required to put the code on multiple pages (as the comment I replied to did) then the article is factually incorrect.
• bscphil 7y ago
  > Since reCAPTCHA v3 scripts must be loaded on every page of a site, you must send Google your browsing history and detailed data about how you interact with sites in order to access basic services on the internet, such as paying your bills, or accessing healthcare services. > If you'll refuse to transmit personal data to Google, websites will hinder or block your access. I wonder how true this really is. 20% or so of web users have ad blockers, and most ad blockers block scripts like Google Analytics out of the box. It isn't hard to see that most of them will not make exceptions for a new Google tracking script. So any site that does any kind of testing at all is going to see that ~15% or so of their users drop off if they block users who don't have a reCaptcha v3 score. The only sane business decision in response to this is to go with some alternative. (Of course, there will be some sites that continue to block users, it's just that they will mostly be the sites that already block users running ad blockers.)
  • judge2020 7y ago
    Even UBO doesn't block ReCaptcha by default, so I don't see Rv3 being added to easylist anytime soon.
    • AgentME 7y ago
      It doesn't block it because it's generally not active on all pages of a site. The description of v3 sounds more like Google Analytics and will probably be treated similarly.
      • judge2020 7y ago
        I find a v3 block to be unlikely for the same reason v2 isn't in easylist - too much friction for the list users. Websites will likely break completely when performing actions if they don't receive any sort of verify token from the browser. It would probably be best to have a list for recaptcha v3 as a built-in optional filter so that users know they've enabled it and know why websites might be breaking.
        • 7y ago
• miohtama 7y ago
  From the service provider and devops perspective I find reCAPTCHA beautiful. It brings down malicious form fill, form spam, user creation and password brute forcing rates. Also as a VPN user, I found out that migrating to more expensive, higher grade VPN, solved a lot of my problems. In the end it is not privacy, not your VPN that matters from the service provider point of view. It matters that your IP address is spewing malicious garbage. I do not want to spend time sorting it out, as I can focus my activities to revenue generating tasks. Harming some cheap VPN users in the process is collateral damage, but I rather take it than build a form with a perfect attack mitigation and 10x cost. I hope to see some alternative for reCAPTCHA that does not come with such a strong privacy oriented risks. hCAPTCHA https://www.hcaptcha.com/ https://www.hcaptcha.com/ seems to be interesting, also monetization point of view. But they are not yet well established company and I do not know what other risks their approach would bring.
  • OrgNet 7y ago
    I don't even use a VPN and have lots of issues solving google's captcha...
    • miohtama 7y ago
      Potential other causes - Your ISP is a source of a lot of malicious traffic - You have some browser extension or other adjustments that makes it harder to analyse you as a genuine web browser For example, using a browser automation like Selenium testing triggers "hard" reCAPTCHA. Not sure if this because of some automated API that Selenium exposes, or just because your browser profile looks virgin (no cookies) without any prior reCAPTCHA solves.
      • OrgNet 7y ago
        I use pretty standard extensions... uBlockO, decentral eyes, smart referrer... I just wish that companies would stop using Google's reCAPTCHA service. Also my IP address rarely changes and I don't think that any malicious traffic is coming from it. And I have Comcast, so I hope that they didn't blacklist all of us... (I did talk bad about Google a few times though, maybe that's it)
• _Codemonkeyism 7y ago
  "reCAPTCHA v2 is superseded by v3 because it presents a broader opportunity for Google to collect data, and do so with reduced legal risk." And if you use something to prevent tracking - in my case Brave - reCAPTCHA is a huge pain that often takes dozens of clicks to make it through - delayed by Google to wait out bots. Some times I think reCAPTCHAs main goal is to bring back those opposing tracking back into the fold of Chrome with painful recaptchas.
• bad_user 7y ago
  If the v3 script is supposed to be installed on all pages of the website, in order to track the user's actions, I don't understand how that can be done without explicit user consent under GDPR.
  • snowwolf 7y ago
    As long as the ONLY processing of the data is for fraud detection/prevention, then GDPR specifically allows it as a “Legitimate Interest” Recital 47: “The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned…” Recital 71: “decision-making based on … profiling should be allowed where expressly authorised by … law … including for fraud or tax evasion monitoring and prevention purposes”
    • bad_user 7y ago
      First of all the "legitimate interest" part only works if the publisher can prove that the user data is only used for the stated purpose. The fact that a third party server handles this is a problem. Because then the publisher has to have a data processing agreement in place with the third party. This is what makes Google Analytics problematic too. The collection of analytics for improving the service can be a legitimate interest, however the data amendment for Google Analytics basically passes the blame on the publisher. I don't think many publishers read carefully Google's data processing amendment, otherwise they would drop usage of Google Analytics. Actually most publishers aren't even with GDPR for more serious reasons, like not anonymizing the user's IP or sharing data with Google for the purposes of ads targeting. And there are many questions to be asked here. Is that data private, for the use of the publisher in question, or is this a shared pool of knowledge between publishers? If the later, then we have a problem, because even if there is a legitimate interest, it only applies to the publisher being visited. Can a user be blocked due to a profile that was built on another website? We are in murky waters. --- Then there's always the question ... does the publisher really have a legitimate interest? Claiming that you can have one under the law, doesn't mean you actually have it. There's a set of conditions that you have to comply with. For example for the purposes of preventing fraud, at the very least you have to be able to show that fraud is possible. Just because you have a login form that's about managing the user's color preferences on the website doesn't mean that you can transmit the user's traffic to Google. The requirements for legitimate interests are hard to comply with. And I have a hunch that in this case many websites won't comply.
• tus87 7y ago
  > They are aware of the legal risk of outright blocking users from accessing services What does this mean? Any sources about these legal risks?
• erklik 7y ago
  > Since reCAPTCHA v3 scripts must be loaded on every page of a site, you must send Google your browsing history and detailed data about how you interact with sites in order to access basic services on the internet, such as paying your bills, or accessing healthcare services. From a technical pov, how does one access a user's browsing history from client-side javascript. Isn't that something the browser should protect? or do you mean more that since the reCAPTCHA gets loaded on each page, Google can track what that IP is visiting by where reCAPTCHA gets loaded?
  • kevingadd 7y ago
    If the script is loaded in the host site's context (it would have to be), it knows your current location and can use DOM APIs to inspect your browsing history (on the current site, at least) and I believe on first page visit it will also be able to identify what website sent you there. It could also potentially register event listeners to watch what links you click.
• DyslexicAtheist 7y ago
  the amount of sites asking me to identify fire-hydrants and traffic lights has dramatically increased since I turned on content-blocking that ships out of the box in firefox. Have been aggressively blocking already before (combo of: UBO, NandoDefender and steve black#s host file), but since turning on this inside FF ... there is no peace. Anyone got some URL's that I can block all captcha attempts or does it mean I have to also sinkhole www.google.com[1] ? ( I don't have a problem not being able to access captcha enabled sites. ) [1] quick check tells me I would have to banish this endpoint which sucks because I'd have to parse the URL on every request and can't do it in DNS: https://www.google.com/recaptcha/api.js https://www.google.com/recaptcha/api.js