20 ms·

There is no evil like reCAPTCHA

• Spooky23 7y ago
  I prefer the newer captchas personally.
• arange 7y ago
  turn on comments on your blog without recaptcha, i dare you.
  • jMyles 7y ago
    There are other techniques that do a reasonable job at stemming the flood. The "hidden field" technique still reduces spam by quite a lot.
    • arkitaip 7y ago
      That technique hasn't worked for years. Try setting up a vanilla WordPress installation with the most popular forms plugins. The only anti-spam measure that works is reCaptcha v. 3.
      • ksangeelee 7y ago
        From experience, Akismet works well, so reCaptcha is not the only anti-spam measure that works for WordPress.
    • inimino 7y ago
      I wrote about another technique at the end of my own captcha rant: https://inimino.org/~inimino/blog/kill_captcha https://inimino.org/~inimino/blog/kill_captcha The proposed solution would replace captcha entirely, but to my knowledge nobody has tried it.
      • basicplus2 7y ago
        How about different revocable secret keys to your mailbox given only to those who you wish to contact you
        • inimino 7y ago
          If people have to request to be able to contact you, it is not a public inbox anymore. This is the way most walled gardens work, you have a separate step before you can interact, so it works, but it lacks some of the affordances of the public inbox model of email or blog posts, such as allowing anonymity.
  • CraneWorm 7y ago
    better yet, get rid of the comments all together. having no comments saves you from having to moderate them and it's just not worth it. if you're writing anything tech related and worthwhile you can just proxy the discussion to HN ;)
    • rtkwe 7y ago
      Not really a great option. People only really see stuff on HN that's relatively fresh so anyone coming in after the initial wave of engagement dies down won't see any discussion.
      • megous 7y ago
        Also you can't discuss on old content anyway. It's blocked.
        • rtkwe 7y ago
          Yeah, somewhere around 2 weeks after a post they completely seal the comments on HN.
  • aquabeagle 7y ago
    https://akismet.com/ https://akismet.com/
  • celsoazevedo 7y ago
    For WordPress there are plugins like Akismet (a service), Antispam Bee (local), etc, that are pretty good at filtering spam without the need to display annoying captchas.
    • neop1x 7y ago
      While sending comment bodies to these services :) what a privacy
  • maximente 7y ago
    that's just a tell that you value ease of moderation and selling your potential community members out to G more than inviting new members to your community. certainly telling of the person running the blog. i've had success with bayesian filters and shadowbanning myself, but it does require some effort.
• maxerickson 7y ago
  It's quite the rant, meanwhile I don't quite remember the last time I did something where I had to solve a captcha that wasn't the "click once" one.
  • bsamuels 7y ago
    if you aren't logged into a google account, you will always get escalated to puzzle challenges
    • xur17 7y ago
      Or if you are using tor, are blocking tracking, etc. I regularly have to solve 5 or 6 puzzle challenges in a row. I would happily pay a monthly fee to get around these ridiculous captchas, even though it's absurd to have to do so.
      • rtkwe 7y ago
        Is that particularly surprising though? Coming from a TOR exit node where a bunch of spam also comes from and blocking tracking so it looks like you're appearing on the site from no where... Both of those are pretty suspicious and reasonable things to crater your humanness score.
        • cyphar 7y ago
          Except solving reCAPTCHA shouldn't be necessary in order to read a website. I get (though still don't like) the justification for any modification actions, but GETs shouldn't ever trigger a reCAPTCHA check. Of course, the Tor folks told the CloudFlare folks about this many years ago and CloudFlare still acts as a giant censorship machine and continues to block anonymous users from reading content on the internet. Not to worry though -- you can install their extension[+] to "protect your privacy" to bypass the reCAPTCHA that CloudFlare themselves erected in front of other people's websites! It's definitely not in any way comparable to an arsonist selling fire insurance as a side gig -- at least with fire insurance you actually got something out of the exchange! [+] Which does have a paper that explains the security of the cryptosystem, but a single paper does not make a protocol secure by default. I'm not a cryptographer, but the Tor folks did raise some concerns in the issue where PrivacyPass was discussed, and there's no doubt that combining Tor with a system that is nowhere nearly as battle-tested should be a major point of concern.
• sgjohnson 7y ago
  I love competition, but I hate Google. So I wish them luck while hoping that they’ll go die in a fire. Manifest v3, tracking everything, this... Only validates my decision to scrap all Google services 2 years ago.
  • webninja 7y ago
    I can’t get behind this google hate. I can think of many companies that aren’t providing any sort of public good.
• have_faith 7y ago
  What's the next best alternative to reCaptcha? this is something I will be in need of soon.
  • webninja 7y ago
    People on the other side of the world that solve captchas for $1 an hour. Sadly, I’m not kidding.
• throwawaylolx 7y ago
  There's plenty to write about this, but this is just a rambling rant that struggles to stay coherent
• tdb7893 7y ago
  What's the alternative to the recaptchas? Is the difference to just to use a different captcha service?
  • Avamander 7y ago
    Proof of Work is one that can help, but the HN crowd does not like those.
  • shakna 7y ago
    CAPTCHA is a divisive topic on HN, so you'll get a lot of people suggesting it's vital, and a lot saying it just isn't, depending on their own experiences. "You probably don't need ReCAPTCHA" [0] is an article discussing techniques that has had decent discussion [1] on HN before. [0] https://kevv.net/you-probably-dont-need-recaptcha/ https://kevv.net/you-probably-dont-need-recaptcha/ [1] https://news.ycombinator.com/item?id=20158386 https://news.ycombinator.com/item?id=20158386
• nyuszika7h 7y ago
  The title mentions reCAPTCHA v3 but then the article goes on to rant about the challenges you have to solve. reCAPTCHA v3 is completely automatic, there are no challenges at all. Of course, it's not perfect either, because occasionally actual humans fail the challenge too.
  • saagarjha 7y ago
    > reCAPTCHA v3 is completely automatic, there are no challenge at all. Yeah, if you're signed into Chrome and Google has enough information to know who you are (yes, I know the new one is score-based…this just means that anyone who isn't the above is going to get a poor score and be blocked.)
    • christudor 7y ago
      You can actually set the minimum score requirements to whatever you want. The default is 0.5, but there's nothing stopping you setting it to 0.0 and letting everyone through.
      • a1369209993 7y ago
        Can you set it to only allow people with score < 0.5? No, I'm not joking.
  • magashna 7y ago
    The challenge is looking at your privacy and deciding it's not worth a few seconds clicking on store fronts
• CodesInChaos 7y ago
  Isn't the author talking about recaptcha v2? My understanding of recaptcha v3 is, that it just gives you a score for how well google can track you and then leaves it up to the site operator to block users who aren't transparent enough. What I really hate about recaptcha v2 are those artificial delays before loading the next image (which it can happen to several times on a single card). And then in the end you frequently fail, despite answering everything correctly.
  • saagarjha 7y ago
    > Isn't the author talking about recaptcha v2? Yes. > My understanding of recaptcha v3 is, that it just gives you a score for how well google can track you and then leaves it up to the site operator to block users who aren't transparent enough. Yeah, that's the one where you're supposed to put it on every page of your website so that Google can collect more information on your users. If they can't, they'll return a low score that you'll use to mark users as "bots". > What I really hate about recaptcha v2 are those artificial delays before loading the next image (which it can happen to several times on a single card). And then in the end you frequently fail, despite answering everything correctly. I think this is just what Google does when it thinks you're a "bot": i.e. they don't know who you are.
    • Wowfunhappy 7y ago
      > I think this is just what Google does when it thinks you're a "bot": i.e. they don't know who you are. I do wonder why though. For a long time, I assumed it was a rate limiter, but then another HN commenter pointed out to me that time is more valuable to humans than bots. Bots can work on multiple captcha's in parallel.
      • GraemeL 7y ago
        My thoughts exactly. A bot doesn't care if it takes 2 seconds to fade the images out and in for another challenge round, but a human viewing it perceives it as a frustrating delay. I've become accustomed to just closing any page that presents me with a v2 reCAPTCHA.
• ronnier 7y ago
  With some of these I'm left debating what is a traffic light. Is the pole itself a traffic light? I really don't know. Also when it asks to select all the cars. Is a bus a car? Is a truck a car? I really don't know what it is expecting and I must pick wrong as I often fail.
  • hobbes 7y ago
    Perhaps that's Google's intention. They are using your human intelligence to make educated guesses, rather than using AI. Your choices will be added to their dataset.
    • Mindwipe 7y ago
      Yes, but my guess would be much more educated if they would tell me the question in sufficient detail.
  • ceejayoz 7y ago
    It's very frustrating that there's no "your AI is an idiot, there isn't one" button. I saw an example of one that said "click the tiles containing the bus" where it was clear what the AI thought was a bus, but it definitely wasn't.
    • dwyerm 7y ago
      This reminds me of Janelle C. Shane's work on AI[1]. Computer vision's been learning based on the photos that people take, not the visions that people see, and this is giving AI a preference for photogenics instead of reality. People generally don't take pictures of rolling green hillsides. But they very often take pictures of rolling green hillsides with sheep on them. So if you ask the robot to draw a picture of rolling green hillsides, it will include sheep. Or, if you ask it to draw a picture of the savanna, it will want to include giraffes. Now you're being asked to find a bus in a photo without a bus because it's a street scene, and every street scene has a bus in it. I haven't read her book, yet, but her Twitter[2] is often full of amusing anecdotes like this. [1] https://aiweirdness.com/ https://aiweirdness.com/ [2] https://twitter.com/JanelleCShane https://twitter.com/JanelleCShane
• ve55 7y ago
  For those of you asking for alternatives, I've tried a few of the things posted in https://kevv.net/you-probably-dont-need-recaptcha/ https://kevv.net/you-probably-dont-need-recaptcha/ to some success, but obviously it depends on your use case.
  • tkp 7y ago
    thanks for your overview ! Does anyone knows a recapthca2-like service/software, that would help solve such tasks (OCR, object recognition..) on a custom provided dataset ? It could provide an alternative to recaptcha, and a "Mechanical Turk"/crowdsourcing for universities, institutions or companies to help solve some of their repetitive tasks.
• tanzbaer 7y ago
  Not true. Google has made a new capture system that only requires you to click a checkbox.
  • saagarjha 7y ago
    …which will only work if Google can track you.
  • cyphar 7y ago
    Try using Tor with one of those captchas -- you will get a whole load of puzzles and picture matching goodness (usually having to solve multiple in a row). It can easily take me several minutes to pass a reCAPTCHA challenge when using Tor. And even then, sometimes Google will even refuse to give you a challenge at all!
• ofrzeta 7y ago
  That article aside, what are everyone's experiences with reCAPTCHA? We are using it to secure one of our contact forms and get a lot of spam through it. Upon research (googling) I found that reCAPTCHA is "broken", e.g. https://threatpost.com/uncaptcha-googles-recaptchas/140593/ https://threatpost.com/uncaptcha-googles-recaptchas/140593/
  • hedora 7y ago
    I can’t reliably pass them without altering browser settings (and even then, answering correctly doesn’t seem to matter one way or another shrug). I switch services whenever it is possible and I see a reCAPTCHA prompt. (I am a human.)
  • kwhitefoot 7y ago
    My experience is pretty much the same as the article. And because I value my time you risk simply not having me contact you if you use any kind of captcha.
  • tadzik_ 7y ago
    We use it to stop bots from opening thousands of trial accounts. We don't have bots anymore, but instead we have humans who open hundreds of trial accounts hourly. I guess it's an improvement.
    • ackbar03 7y ago
      Whats the service fir? I know game miners and some other niche services that attract these kind of actors. Do you know what they want from your site?
      • tadzik_ 7y ago
        An email provider. Interestingly enough they don't even send anything. They just... sit there. And who knows why. Not really doing anything harmful afaik, but obviously fradulent so our support still kills them in bulk just in case they were a proper threat waiting for the activation.
• sieabahlpark 7y ago
  The current new captcha is invisible. It's no less evil since Google recommends to put it on all your pages...
  • andrewl-hn 7y ago
    Well, it's only invisible if all pages / tabs you visit share the same cookie / session store. With browsers implementing more and more of privacy-focusing features this becomes less and less frequent. If I use Safari private mode (each tab has its own cookie store) or Firefox with containers and cookie auto delete extension every tab I open, every page I visit gets a brand new Google session. Obviously, Google treats my like a bot.
• Wowfunhappy 7y ago
  It's such a shame that this poor article is getting attention, given that reCAPTCHA v3 is actually a terrible privacy violation. Sadly, I don't think the author knows the difference between v2 and v3. The article is definitely not talking about v3.
  • kodt 7y ago
    Yes, I thought the article would be about privacy concerns. Instead it was a rant about v2, not mentioning v3 at all (except for mistaking v2 for v3). Ultimately there was little substance here.
  • SQueeeeeL 7y ago
    A lot of articles posted on hacker news are by people who don't really understand what they're talking about, but use a lot of emotionally charged language. A lot of times this is fine, because it's articulating something that bothers a lot of people and wastes their time. But in this case it's absurd. I don't think he understand just how much crap bots were/are putting out there, especially before we had good services like cloudflare and the whole web hosting cloud to filter it. It's not Google's fault every small/medium sized company decided to put important customer services on a web portal which could be easily abused, they just capitalized on it. Sys admins can't stop random executives from making crap decisions like having an inherently insecure system, but at least they can pitch on reCaptcha to fix it a tiny bit. But they wrote an article where they used a lot of CAPS LOCK, so they must be an authority.
    • jonas21 7y ago
      > A lot of articles posted on hacker news are by people who don't really understand what they're talking about, but use a lot of emotionally charged language. This seems to be the best strategy for getting to the top of the front page these days. Even better if the target of the emotionally charged language is Facebook, Google, or Amazon.
  • judge2020 7y ago
    The article really should have focused on this, it's the only valid concern. There's no proof or references behind the later claims like "THE AVERAGE TIME IS OVER 30 SECONDS!" and " It doesn't matter if you're logged into your Google account and allowing all manner of cookies.", not even anecdotal or personal videos of trying to solve a recaptcha like this post[0] had from two months ago. > I don't think the author knows the difference between v2 and v3 The author doesn't seem to have ever visited google.com/recaptcha to know what Google refers to as different versions of its service. The author instead is talking about "versions of bot detection", ie. The "detect human mouse movement" was v2, "scan your Google history to see how human-like your activities are" is v3, and the author envisions "v4" as doing the silly things from the latter half of the article. 0: https://news.ycombinator.com/item?id=20158386 https://news.ycombinator.com/item?id=20158386
• bitL 7y ago
  Google moved puzzles from interviews onto random Internet users ;-) There must be some sophisticated internal metrics registering increase of puzzle takers somewhere, with a hidden goal of increasing general intelligence levels, adversarial-style. It's the only scientific explanation! :D
• brokensegue 7y ago
  the tone of this article is awful. it also has the history of recaptcha wrong. I can't imagine it actually taking 30 seconds to solve a reCAPTCHA. That needs a citation.
  • michaelt 7y ago
    In Firefox, log out of your google account, block cookies and enable the anti-fingerprinting features. Or just browse with Tor Browser. You will start getting challenged more often, you'll find you're asked to solve several multi-select challenges in a row even if you get them right, the multi-select challenges will replace tiles after you select them, and the tiles will start fading in and out very slowly. See https://www.youtube.com/watch?v=en5KSZSpDFY https://www.youtube.com/watch?v=en5KSZSpDFY for an example video. These are (AFAIK) intentional features deployed Google - you just don't see them if they can already track you via something like your Google account.
    • brokensegue 7y ago
      Ok I did as you suggested and then went to https://www.google.com/recaptcha/api2/demo https://www.google.com/recaptcha/api2/demo Took me all of 5 seconds to solve
      • mindslight 7y ago
        The most insidious thing about this two-tiered surveillance society is that its effects are invisible to people in the "good" class, and they insist on remaining ignorant of what happens if you're not in that class. Google still has plenty of other tracking points on you. And of course reCAPTCHA looks reasonable to a prospective developer - it wouldn't be adopted otherwise! If someone tells you it routinely takes 30 seconds to solve, you should really just accept their experience rather than discarding it with "works fine for me!". If you still need to see it with your own eyes, go setup a TOR browser and become one of the undesirables, rather than just imagining. You just might end up adopting the marginalized view.
      • cyphar 7y ago
• athenot 7y ago
  reCAPTCHA is turning into a punishement for those who don't want to consent to full tracking by Google. Apple is working on their SSO project (Sign in with Apple); I hope they will also consider the use-case of being able to tell a site that you're a human without sending any information.
• buboard 7y ago
  Recaptcha is a free mechanical turk for Google. Right now they re training waymo's cars, but soon they 'll need to train other networks. Prepare for "Click on all images showing intraductal papillary biliary neoplasm". C'mon, don t be lazy
  • deleted 7y ago
    [deleted]
  • LeonM 7y ago
    This conspiracy theory has been debunked many times.
    • Dylan16807 7y ago
      The conspiracy theory of "google is doing what they promised to do"? Half the point of recaptcha was classifying images.
    • stordoff 7y ago
      What conspiracy theory? That's what Google say it is for: > Hundreds of millions of CAPTCHAs are solved by people every day. reCAPTCHA makes positive use of this human effort by channeling the time spent solving CAPTCHAs into annotating images and building machine learning datasets. This in turn helps improve maps and solve hard AI problems. https://www.google.com/recaptcha/intro/v3.html https://www.google.com/recaptcha/intro/v3.html (under "Creation of Value - Help everyone, everywhere - One CAPTCHA at a time.")
    • hnburnsy 7y ago
      Just wondering but does this explain why the images always seem to be driving related like traffic lights, crosswalks, bridges, etc.
• Osiris 7y ago
  My payment provider (Braintree) required me to implement reCAPTCHA v3, despite the fact that I had already implemented server-side fraud checks (MaxMind). I didn't have a choice if I wanted to continue taking credit card payments.
  • saagarjha 7y ago
    Do they specifically require reCAPTCHA v3, or just any sort of bot-prevention CAPTCHA?
    • Osiris 7y ago
      The specifically told me to use reCAPTCHA v3. I don't know if they would have accepted another one. I didn't want to take the time to research them. Honestly, from a UX perspective I also preferred the "no user interaction" part of reCAPTCHA.
• brightball 7y ago
  I’m curious, what’s the best option for protecting web forms if not using reCAPTCHA? Specifically for things like account sign ups?
  • _-___________-_ 7y ago
    It depends what value there is in an account, but for a service I run, I just let the bots sign up accounts. Accounts don't really cost me anything, and they get automatically deactivated if they didn't get any activity in the first 30 days anyway. Activity on my service costs money, so if someone wants to make a bot that pays me money, I have no problem with that. The only time I'd consider implementing something like reCAPTCHA is if I was giving something away for free (e.g. a free trial) such that a signup actually had a cost for me.
    • brightball 7y ago
      I was more concerned about triggering activation emails to people
      • _-___________-_ 7y ago
        If you collect email addresses, then yeah that's a concern. Then again, if you send a single activation email and never send another email unless the link is clicked, there's no value to the bot in signing up accounts, so it's unlikely to be a major problem.
• octosphere 7y ago
  I'm glad someone is talking about this and we can have a healthy discussion about it. Things like PrivacyPass[0] are a step forward, but for those who don't know about such a tool, they will continue to be 'tortured' and get repetitive strain injury from constantly having to solve recaptcha v2, at least, well if they browse under Tor heavily and will have to pass recaptcha's test multiple times, and even after proving they were not a bot countless times. [0] https://privacypass.github.io/ https://privacypass.github.io/
  • dfxg987fdlkj 7y ago
    You will find the Google ecosystem is more joined up than you realise. If you use the DNS it will make the search engine results more personal, if you block everything to do with google at the firewall level, you will find recaptures don't actually work, you can spend an hour before it comes up with a web page where you have reached the end of all the recaptures you could possibly do. If you use Firefox, and write addons, you will find the addons don't work, their website api's, analytics, absolutely everything to do with Google is joined up so the internet is one giant Google Panaopticon. Don't believe me, try it for yourself, lock everything down at the firewall and see for yourself.
    • stordoff 7y ago
      > If you use the DNS it will make the search engine results more personal Google claim not to use DNS in this way: > Is any of the information collected stored with my Google account? > No. > Does Google correlate or combine information from temporary or permanent logs with any personal information that I have provided Google for other services? > No. https://developers.google.com/speed/public-dns/faq https://developers.google.com/speed/public-dns/faq
  • cyphar 7y ago
    The problem with PrivacyPass is that it is a (not nearly as peer-reviewed as Tor) privacy-related cryptosystem that lets you bypass the reCAPTCHA that CloudFlare put in your way in the first place. Using it with Tor is almost certainly not a good idea because it changes your own behavior from other Tor users thus compromising your anonymity (and the Tor folks are not in favour of PrivacyPass, because they think the solution is that CloudFlare shouldn't be putting the reCAPTCHA in the way in the first place). And that's assuming that the cryptography is actually solid and there is no way to distinguish between different PrivacyPass users. Tor has decades worth of research put into it -- what level of scrutiny does PrivacyPass have? How many people actually use it and how many have tried to break it?
• zzo38computer 7y ago
  I agree that reCAPTCHA (all versions) are terrible. (At least, sometimes it is possible to avoid the problems by selecting the audio CAPTCHA, which tends to work better as far as I can tell.) Instead, use the protocol-independent CAPTCHA. It is a SASL mechanism, which sends a challenge with plain ASCII text (and may include line breaks), and then accepts a single response of plain ASCII text, and then the server decides whether or not the response is acceptable. The similar thing can also be done with a simple HTML form, but using SASL would then allow working with any protocols and work with command-line interface just as well as HTML interface, too.
• deleted 7y ago
  [deleted]
• VeninVidiaVicii 7y ago
  >Select all pictures of storefronts. Hmm, if only I could read Bengali, I could tell if this were a storefront or not.
• cascom 7y ago
  life's too short to solve these things - i view it as the equivalent of a rude host at a restaurant (meaning I'll take my business elsewhere)
• elehack 7y ago
  Google did not create reCAPTCHA. They bought it; it was started by Luis von Ahn, who went on to create Duolingo. When reCAPTCHA was created, the alternative was CAPTCHA, which tried to impede bots but did not generate any social benefit. This was the genius of the original reCAPTCHA concept: the time taken to 'confirm humanity' could be channeled into the socially-useful endeavor of digitizing books. Capture some of the heat emissions of impeding bots for a useful purpose, rather than letting it all go to waste. Now, yes, Google is using it to train their self-driving car AI, and there's a bunch else happening in it to connect to Google's surveillance apparatus. There's much to legitimately criticize there. I personally don't view training Google's proprietary AI as the same kind of intrinsically altruistic purpose as digitizing the world's pre-digital books. But putting the entire concept on blast with erroneous history that can be corrected with about 60 seconds on Wikipedia doesn't help the argument at all.
  • djsumdog 7y ago
    Yep, it was originally run by Carnegie Mellon (as you mentioned, by its creator Luis von Ahn and others). This article also doesn't seem to touch on the newer reCaptcha that tracks you everywhere on a website (you'll notice a little blue box on the bottom right with the logo where this happens), not just on login or user input pages. There is a lot to criticize about reCaptcha, including privacy concerns for sure, and there were some other posts about it on HN before.
  • iagooar 7y ago
    I wonder if in some jurisdiction Google shouldn't pay money for forcing people to train their AI. I imagine it could be possible to do that in Germany, or under some EU laws.
    • iamnotacrook 7y ago
      Perhaps in Germany Google can charge for their services, but waive the fee if they solve captchas.
  • inlined 7y ago
    > but putting the entire concept on blast with erroneous history that can be corrected with about 60 seconds on Wikipedia doesn’t help the article at all. Nor does an entirely fallacious premise. ReCAPTCAH v3 is entirely transparent and non invasive to users. In fact it’s retroactive to help the site admin figure out what to do with the score: https://developers.google.com/recaptcha/docs/v3 https://developers.google.com/recaptcha/docs/v3
• squirrelicus 7y ago
  > human right of mental comfort Hahahahahah hahhaha ahhah hah. Lol. I'm sorry, I just can't help myself. This cultural tendency toward naming everything you prefer as a right is just... It's hilarious to the extent it's not just sad. I'm willing to give the author the benefit of the doubt that it was just hyperbole. In which case, bravo.
  • imgabe 7y ago
    That was the exact point when I decided this article was a waste of time. What a ridiculous statement. Even if it was meant to be comedic hyperbole, the effect is that it's impossible to take seriously anything else the author has to say.
    • Retra 7y ago
      Well I suppose "Hahahahahah hahhaha ahhah hah. Lol" is a better example of the kind thought-provoking serious writing one should aspire to consume.
      • lucb1e 7y ago
        Yeah I'm not sure whether to flag the comment as an unconstructive personal attack on the author or if it's just within the lines of what we like to see in this community.
        • carapace 7y ago
          If it's marginal enough to give you pause for more than a few seconds, down-vote it. If HN becomes too dry and technical there's always Reddit...
      • JasonFruit 7y ago
        To be fair, the comment included more significant content than that (unnecessary) outburst.
• anonu 7y ago
  tldr: Author claims reCAPTCHAs will get incrementally harder and force users to do strange things like turn on their webcams or open other devices to confirm their identity. Eventually people will pay Google to bypass the system. All plausible...
• Jagat 7y ago
  Hmm I don't know. It's been 10 years since I've been hearing that self driving cars are right around the horizon. And we now know we're nowhere close to it. If this recaptcha helps google, or for that matter, any company, accelerate their self driving capability, I'd fully support it.
  • garaetjjte 7y ago
    https://xkcd.com/1897/ https://xkcd.com/1897/
  • djsumdog 7y ago
    Billions of tax dollars and breaks are going to self-driving research, which is fucking insane. America needs to build back it's public rail infrastructure. Passenger rail is a solved problem, and the US use to have more passenger rail that Europe. We have one of the best freight rail systems in the world, but we have high speed rail in New England and Florida. That's it. Maybe California if they can get their shit together. I wrote an article about this before, and talk about how even if you had a four lane high way with nothing but self driving cars, all filled and traveling at 120kph bumper to bumper, you wouldn't even come close to approaching 10% of the capacity of a single track metro light rail line running with 2 minute headway (during rush hour headways can be less than 2min, and with automated systems like those in Singapore and the new ones coming to London's underground--DLR is already automated--you can get headways of less than a minute or even 30 seconds) https://penguindreams.org/blog/self-driving-cars-will-not-solve-the-transportation-problem/ https://penguindreams.org/blog/self-driving-cars-will-not-so... Sure self driving cars could help in Europe with the last leg where they have real transport infrastructure, but the US is so far behind that successful self driving cars would just add to grid-lock.
    • toasterlovin 7y ago
      Some thoughts: I think rail adoption becomes a lot more feasible if people can summon self driving cars on demand. The problem with rail is that it's hard for people who are currently driving to get behind because its usefulness is dependent on how built out the network is and building out rail networks is slow and expensive. And while the network has low coverage, getting to and from rail stations is a pain in the ass. But if you can just hail an Uber or Lyft, but the Uber or Lyft is really cheap because it doesn't require a human driver, then getting to and from the rail station becomes a non-issue. And I think that can turn the all or nothing paradigm of rail as it currently exists into something where incremental progress is just as useful whether you're starting from 0% existing coverage or 80% existing coverage.
• davesmith1983 7y ago
  reCAPTCHA on a site forces me to use Google and quite a few sites now use it. There are other ways of detecting bots that aren't as intrusive nor require you to allow Google everywhere.
• hrjet 7y ago
  Would appreciate thoughts on this alternative that we are developing: https://github.com/librecaptcha/lc-core https://github.com/librecaptcha/lc-core The idea is to develop a framework for Captcha generators. A few sample generators are provided out of the box, but new ones can be written easily. The framework takes care of storing entries in the database, serving them as challenges through an HTTP API, and checking the responses. From the README, why libreCaptcha: * Eliminate dependency on a third-party * Respecting user privacy * More variety of CAPTCHAs, tailored to your audience The implementation has a long way to go (it was written by students trying to learn Scala), but would appreciate thoughts on the concept.
  • ackbar03 7y ago
    If you give me a captcha generator I can give you a captcha solver. You have no idea
    • hrjet 7y ago
      Agreed; a determined programmer could solve almost any Captcha given sufficient time and resources. But we are not trying to create an unsolvable Captcha. For those websites that need something good enough to deter generic bots while not compromising privacy of their users, this might be a good enough alternative to reCaptcha. Imagine a docker image which just works with out-of-the-box generators. Those who need more variety could create a custom generator with Javascript and drop it into a docker volume.
      • SubiculumCode 7y ago
        e.g. the difference between a general intelligence and the AI we have today. Generators that vary what is being asked from site to site make generic solutions much more difficult.
• mnm1 7y ago
  Another technology that needs to be regulated and banned in many cases. Paying bills and handling finances online should be accessible to everyone. This prevents it from being so. It may already be a violation of the ADA. After all, how is a blind person supposed to pass? Impossible. For other websites, well they can do whatever. The internet is mostly a cesspool and anything that can't be visited with JavaScript turned off is not worth visiting. That includes "clever" spa blogs that could just be static sites and all types of other garbage. Maybe one in a thousand or one in a million sites other than finance, shopping, etc might be an exception to that but no website with recaptcha is. I wonder if we can sue Google for ada violations. I'm sure there are plenty of disabled people on the internet for q class action.
  • nyuszika7h 7y ago
    > After all, how is a blind person supposed to pass? There's an audio captcha option.
    • bluGill 7y ago
      I have a friend who is both blind and deaf: audio is also out. It is possible to use a braille terminal to access the web, so while I don't know if he uses the internet, it is possible. Okay, he isn't really a friend, I only met him once. We have a friend in common who speaks sign language and was able to translate. Seeing him read sign language with his hand was interesting.
    • mnm1 7y ago
      I haven't seen that option in the picture captchas, probably because it can now easily be defeated. So the question still stands.
  • aykutcan 7y ago
    So bots can request billing and finance services and take it down ?
• breck 7y ago
  One of my favorite takes on captchas is John Mulaney's SNL skit from the past year: https://youtu.be/en5_JrcSTcU?t=337 https://youtu.be/en5_JrcSTcU?t=337
• db48x 7y ago
  I agree completely. I've just stopped using any website which asks me to do reCAPTCHA. In fact, I've got uBlock to block it from even loading. If you use reCAPTCHA for any reason then you don't deserve my business.
• radcon 7y ago
  I didn't realize how bad reCAPTCHA is until I started trying to protect my privacy. The internet became practically unusable thanks to the constant, unsolvable CAPTCHAs. You can click the correct image tiles until your finger falls off but you still won't get through.
• paulcarroty 7y ago
  Absolutely, trying to avoid any website with reCAPTCHA. If you're non-Chrome user, don't even try playing with images - Google force you to click 3-5 times more than Chrome users, it's just stupid.
  • ultimoo 7y ago
    This! I use FF with uBlock Origin without being signed into Google and it is absurd how many tries it takes to solve the crosswalks, bikes, and storefront riddles. Sometimes I give up due to frustration and open the site in Chrome.
    • samb1729 7y ago
      Seems like just another way for Google to funnel non-Chrome users into Chrome
      • Avamander 7y ago
        Hate to say this, EU please help.
• emptyparadise 7y ago
  Recaptcha is now a rate limiting service for people not signed into their Google account. That's about all it does. The score on v3 falls through the floor if you block third-party Google cookies.
• jsf01 7y ago
  reCAPTCHA v2 has prevented me from doing so many things. A recent example: I attempted to make a LinkedIn account. When I got to the captcha, it gave me one of the really nasty ones where you wait for each new image square to slowly appear, and almost every new square also contains a bus or whatever it wants me to click. Then after hitting submit, it still thinks I’m a bot, so I get sent back to another captcha, infinitely. I never ended up creating the account. I attribute this to me using ublock and not using google products, but I can’t say for certain, and I’m not changing that just so I can pass a captcha. One of the stated purposes of reCAPTCHA v2 is to prevent actions from taking place altogether by wasting a user/bot’s time, so this was probably one of those cases. Somehow it felt certain I was a bot, so to prevent the signup from being possible it instead sent me on an infinite captcha solving tangent. It would have been nice to know before solving tons of them that this would never work and I was just wasting my time.
  • lucb1e 7y ago
    Same here. I got a gift card, went to the site to check its value, didn't get a cookie banner but they still hired this third party from the other side of the planet to try and identify which human I am, allegedly the only way to tell whether I'm human (y'know, a 21 digit account number isn't proof enough). The third party decided I'm not. Wanted to contact customer support, guess what? Form broken. Turned of tracking protection, ad blocker, etc. No dice. Tried a second browser, same issue. Called the next day and finally got to the amount... Of course they couldn't reproduct the ReCAPTCHA issue and the form didn't give them an Internal Server Error either. Must be me. If this were about not being able to see cat pictures, alright, but this is about accessing money that I'm supposed to own. This is so backwards to me.
    • jaclaz 7y ago
      Which brings us back to the old way of using cash instead of gift cards, it might have a number of other issues, still it remains simpler.
• azhenley 7y ago
  I just tweeted a video of me doing nonsensical "Rotate the ball" puzzles to login to Hotels.com. I couldn't even tell what the pictures were! https://twitter.com/AustinZHenley/status/1158430726888407040 https://twitter.com/AustinZHenley/status/1158430726888407040
• EvanAnderson 7y ago
  I joke about signs of the robot apocalypse eventually showing-up in reCAPTCHA: "Click on the photos of humans with weapons." Sometimes I feel like I'm only half-joking, though.
• commandlinefan 7y ago
  I’ve had a blog for about a decade now - I wanted to host it myself rather than use some blogging infrastructure, since I was afraid that blogging infrastructures would become evil in the future (see: Medium). I also wanted a comment section, but as soon as I turned it on, I got hundreds of spam messages every. single. day. I shut it down and started working on adding captcha support. My custom captcha solution did pretty much nothing to slow down the spammers, and I realized how much time and effort I was going to have to spend developing and maintaining it… I decided to hand the reins over to the fine folks at Google, instead. If they want to recoup their costs by having visitors on my site spend a few seconds training self-driving cars, that’s a trade-off that’s worth it. It’s also worth noting that the article doesn’t actually point out anything that’s particularly evil - just points out the potential for some evil in the unspecified future. Although I agree that the best time to tackle evil is now rather than later, I also don’t see any alternative for recaptcha, so I’m going to continue to use it and hope for the best.
  • judge2020 7y ago
    Perhaps the wordpress method of comments would work for you without a captcha - you allow comments but hold for review any comment that has a potential link in it. Most spammers skip posting links in WP comment sections unless they specifically are trying to market to the site admins.
    • flemhans 7y ago
      No they don't, WP sites left unattended this way will amass millions of posts pending approval
  • david422 7y ago
    I have a small website. The spammers found it quickly. I added a simple form field eg "name" that was hidden with css. If filled in, the request was rejected, but with a 200 response. Spam disappeared instantly. I did find out later that some legitimate users were getting rejected due to auto fill or something.
• megous 7y ago
  Companies use recpatcha in inappropriate ways. Especially on contact forms. Imagine you'd have to solve a captcha before sending every mail (or possibly be rejected completely). Contact forms should just send an e-mail and let the e-mail's content based statistical filter deal with spam. Blocking people from communicating with your company based on Google's whims is really not smart. It's giving too much power to Google.
• OJFord 7y ago
  My two main frustrations with reCaptcha: 1. No (or at least piss poor) localisation. It asks me to locate English words, sure, but the images are of things familiar only from American films - sorry, movies. ReCaptcha is how I know (and my only use for knowing) what a 'crosswalk' is. 2. Sometimes it's just wrong. But I have to select the images that it incorrectly thinks is a bridge or whatever anyway, otherwise I'm not allowed to login. Everyone's one of N top complaints: - How much of the damn structure counts as a traffic light?!
  • nickflood 7y ago
    Yep, they've trained my neuronet that they always show the images in a 3-2-1 or a 3-1-1 sequence, so now even if shows me something weird, I know I need to select the number of most likely things they want me to. This way I almost always finish it on first try.
• caiocaiocaio 7y ago
  I got dragged into clickbait, read 15 paragraphs of fluff till I actually got to the point of the article, and now I hate myself.
• marykimm00 7y ago
  Ug, can't stand reCAPTCHA. But seems like a necessary evil.
• throwaway66666 7y ago
  Didn't facebook try "Is this your friend Bob?" (showing you a picture of some random people) as their forgot password captcha, in the past? Now that was evil!
  • aitchnyu 7y ago
    In India it is common to set your profile pic as flowers and little girls for women, supercars and superbikes for men.
• 1f60c 7y ago
  See also: “You (probably) don’t need ReCAPTCHA”[0] (submitted to HN here: https://news.ycombinator.com/item?id=20158386 https://news.ycombinator.com/item?id=20158386) [0]: https://kevv.net/you-probably-dont-need-recaptcha/ https://kevv.net/you-probably-dont-need-recaptcha/
• the_watcher 7y ago
  This article seems to be confused about reCaptcha v2 vs. v3, as others have mentioned. That said, the broader point about the amount of time they take and the fact that Google is farming out labeling has some validity. It seems like the value to Google is high enough that they could easily remit some money or value to the people taking them. There's an argument to be made that this would incentivize even more investment in bots that can pass them. My reply: Google should just create a bounty for anyone who successfully beats it worth more than the black hat value.
• deleted 7y ago
  [deleted]
• ElijahLynn 7y ago
  Would downvote this if I could. 1) Google bough reCAPTCHA in the first place. 2) Google's latest captcha isn't even a captcha, you just click a button saying you are human and it analyzes your mouse movement and probably a fingerprint of sorts and you are in. The article just isn't accurate and seems unnecessarily hateful about things that are not exactly true.
  • christudor 7y ago
    Google's latest reCAPTCHA is v3, which works behind the scenes to generate a 'trustworthiness' score for each user. There is no longer any button for the user to click. You're thinking of v2, I think.
    • ElijahLynn 7y ago
      I am talking about V3 it appears, just checked here https://www.google.com/recaptcha/intro/v3.html https://www.google.com/recaptcha/intro/v3.html, at 0:11 on the splash video is the image I am talking about (https://youtu.be/tbvxFW4UJdU?t=11 https://youtu.be/tbvxFW4UJdU?t=11). I guess I didn't mean a button, but a checkbox.
• miohtama 7y ago
  Here is my earlier comment when somebody was bashing reCAPTCHA https://news.ycombinator.com/item?id=20297764 https://news.ycombinator.com/item?id=20297764 - Running a high profile, or even low profile. service which attracts automated or spearhead attacks makes you appreciate reCAPTCHA - Web services and users are often low value and reCAPTCHA offers a free medicine - Cleaning up attacks and such as a devops/webmasters is pain in the ass - getting all those alerts ad Saturdat 11:00pm in a bar - you do not want to cover them from your $100 budget - reCAPTCHA makes many problems go away for a service provider - People complaining about reCAPTCHA are often low value users (they do not buy anything) - though I have only subjective point to confirm this Long term solutions can be only moving away for CAPTCHAs to strongly authenticated humans by a trusted party - Strong human authentication on every service controlled by Apple/Google/Facebook who has vast data to keep bots in the check - Start paying for the services - though you still need to do CAPTCHA at least once in the card authorization to prevent cardsters Alternative for reCAPTCHA - though I do not vouch in for the quality yet: hcaptcha.com/ Bonus: Micropayments instead of ads or make botting too expensive - welcome to cryptocurrency land
  • Avamander 7y ago
    We had an alternative to reCAPTCHA for a moment - proof of work coin miners, when properly set up it is also very privacy-friendly by having the possibility of fully self-hosting it. Yes it had it's downsides, but IMHO less downsides than doing work for Google. Same goes for coinminers instead of adsense.
    • RL_Quine 7y ago
      No you didn’t. A few seconds of proof of work is trivial for a bot, any amount that makes it hard for a bot is unusable to a human. This is why nobody uses hashcash.
      • Avamander 7y ago
        The same way you can buy captcha solves, it's trivial for a bot.
  • 7y ago
• midnightdiesel 7y ago
  Google sucks nowadays. So much of what it does just makes technology and the web worse, not better.
• zelphirkalt 7y ago
  reCAPTCHA is the most annoying and presumptuous tracking spyware online. I've come to close websites almost immediately when I discover that they use it. "Discover" is the correct word here, as website developers are usually too careless, to provide any noscript hint that reCAPTCHA is even used and I find myself wondering, why that damn website does not work, until I check my uMatrix and see the evil that reCAPTCHA is. If the service is really needed, I need to allow stuff and reload pages up to 5 times, as script loads script loads script from other domain loads frame ... This makes for the most shitty experience ever, when I try to use such a website and I give the middle finger to the person who decided they need to have a reCAPTCHA there and to the person who put it there and I tell them the F work in my mind. The disregard for people's privacy cannot get much worse than with reCAPTCHA.
• sbhn 7y ago
  If recaptcha is so good at finding bots, then why does google still show ads to bots?
• MakiXx 7y ago
  I wish they mentioned https://github.com/dessant/buster https://github.com/dessant/buster which I love using
• strawman666 7y ago
  Not that I would do it, but couldn't someone create a bot to purposely give incorrect results and screw up Googles AI learning machine?
• My1 7y ago
  The post talks about recaptcha v3 but shouldn't it be v2? Because correct me if I'm wrong, but as far as i remember recaptcha v3 does NOTHING with the user as far as i remember and only tells the admin what it thinks about the user and then he can spawn a normal recaptcha v2 if needed.