6 ms·

Another sinister way of doing this is having users solve captchas in order to comment and keeping a badness score of the troublemakers. Then pretend they failed

Another sinister way of doing this is having users solve captchas in order to comment and keeping a badness score of the troublemakers. Then pretend they failed the captchas at a rate proportionally to their score.

hanoz 7y ago
If that's going on then what on earth have I done to offend Google?
- Avamander 7y ago
  Are you blocking their tracking and fingerprinting? Do you sit behind a massive CG-NAT?
- chillfox 7y ago
  Adblock? I ended up switching mine off just to make the internet usable.
- Tenoke 7y ago
  Not using Chrome?
  - jjoonathan 7y ago
    Is it just me or has the web's compatibility with Firefox taken a nosedive recently? It used to just be my employer's HR software that was chrome-only, but in the last year my power utility website, apartment complex website, and even major websites like https://www.deviantart.com/ https://www.deviantart.com/ (which I was trying to visit just 10 minutes ago) have broken in Firefox but not chrome. Badly, too. These aren't "the layout is different in FF and nobody noticed" bugs, they're "site infinitely redirects" bugs or "login button doesn't submit" bugs. Debug steps: turn off bitwarden, my only extension. Never helps. Ctrl+Shift+Del cookies. Never helps. Sigh, open chrome. Works first time. Is it just me or did the web up and dump firefox just when it started to get good? :(
    - 1_player 7y ago
      Some tech demo sites are Chrome only but I’ve yet to encounter a broken site on Firefox. The only issues I have are mostly due to adblock or my Pi Hole. I haven’t used Chrome in years.
    - JoshuaDavid 7y ago
      I've noticed some of this lately - in a significant fraction of cases, it comes from Firefox honoring X-FRAME- OPTIONS while chrome ignores them, so e.g. payments work on chrome on sites that don't work on FF.
    - chrisweekly 7y ago
      I've unexpectedly had precisely the opposite experience; as of recent changes to cookie handling and 3rd party content in Chrome, several sites / webapps have either stopped working at all in chrome, or have serious issues -- while rendering and performing just fine in FF.
    - zo1 7y ago
      We recently had some "FE devs" make a spiffy new SPA for some internal product. When I got to testing it on Firefox cause that's my main browser, I got a blank white page. I asked them and they're like "yeah, it only works on chrome-based browsers". Or something to that effect. It's not like some CSS was wonky, or a bug somewhere... No, the default process of them building the SPA somehow yielded a completely non-functioning app for Firefox.
    - ornornor 7y ago
      At my current employer, the web apps are only ever tested on chrome. If it works on chrome, it ships. I think I’m the only one using Firefox and making sure it works there before chrome.
      - jjoonathan 7y ago
        Thanks for fighting the good fight.
    - laktak 7y ago
  - kempbellt 7y ago
    > Not using Chrome? A truly deplorable act... I also added about 30 seconds of latency to every page I visit, but for completely different reasons as op. Switching to Brave and blocking all cookies and JS by default made me have to manually enable it for nearly every site that I actually wanted to use. About a week later, Chrome was reinstalled. Maybe I'll try it again once I level up my willpower.
    - david-s 7y ago
      i find blacklisting sites that abuse JS works better for me than the whitelist approach
    - aabbcc1241 7y ago
      I'm using nextdns.io and no-script with firefox, it works quite smooth when you accumulate the settings. You can export/import the no-script settings and merge with meld to keep the setting in sync between your PCs and laptops
      - aabbcc1241 7y ago
        Also "Privacy Badger" which smartly block scripts by checking cross site cookie, preset whitelist and custom whitelist/blocklist
    - GoblinSlayer 7y ago
      I have 15 whitelisted sites. I think it took negligible effort to add them, you whitelist a site once and it stays there from there on.
- heartbeats 7y ago
  You haven't opted in. For the modern web, using it without JavaScript and the requisite accounts isn't a supported option.
- baq 7y ago
  you use a vpn and have anti tracking features enabled in a browser. actually it's sometimes impossible to win the puzzle, they just keep serving you new ones to keep you busy. maybe it's effective against 3rd world click farms.
  - Hitton 7y ago
    Just having anti-tracking features without vpn is enough. I suffer from it all the time.
  - cascom 7y ago
    Yup - it’s a great way to lose real customers - but I suspect it’s a trade off they’re ok with
- stewartm 7y ago
  https://patents.google.com/patent/US9407661B2/en https://patents.google.com/patent/US9407661B2/en
aj7 7y ago
For about six months, the Fidelity mobile site gave false indications of incorrect username/password on purpose. No idea why they did this.
- bennyelv 7y ago
  I can see that it could be effective against brute force attacks. A real user would assume they fat fingered their password and try it again, a brute force attack would miss the password and carry on forever.
matheusmoreira 7y ago
> pretend they failed the captchas That explains a lot... I frequently have to solve 10+ captchas when I'm using Firefox, many of them rate-limited. It feels like a punishment for resising surveilance. These things should be illegal due to the accessibility problems they cause if not the fact they're a nuisance.
- floriol 7y ago
  It's more of an automatic thing (it's usually due to VPN) since many people connect from the same IP at near the same time. It's even worsr with TOR
  - matheusmoreira 7y ago
    Why should people be punished for using VPNs, Tor, an ISP with CGNAT? All of these should be supported regardless of how much abuse originates from them.
    - fragmede 7y ago
      Should be, but unfortunately we're still trying to invent a better abuse-resistance system than a captcha. Invent a better one and the world will throw money at you. Telemarketing calls are an example where better abuse-resistant systems would be awesome.
      - matheusmoreira 7y ago
        > we're still trying to invent a better abuse-resistance system than a captcha. > Invent a better one and the world will throw money at you. It already exists. The abuse stems from the fact servers connected to the wider internet are designed to respond to anyone who tries to talk to it. That's the fundamental problem with internet security today: computers talk to strangers they don't know much less trust. What if computers dropped all packets by default and networked only with authorized users? The risk of exploitation and abuse becomes negligible because to unauthorized users it's like the computer is not even there to begin with. This can be done with single packet authorization. The internet would lose its mass market appeal but it's much better than normalized widespread surveillance.

hanoz 7y ago

If that's going on then what on earth have I done to offend Google?

Avamander 7y ago
Are you blocking their tracking and fingerprinting? Do you sit behind a massive CG-NAT?
chillfox 7y ago
Adblock? I ended up switching mine off just to make the internet usable.
Tenoke 7y ago
Not using Chrome?
- jjoonathan 7y ago
  Is it just me or has the web's compatibility with Firefox taken a nosedive recently? It used to just be my employer's HR software that was chrome-only, but in the last year my power utility website, apartment complex website, and even major websites like https://www.deviantart.com/ https://www.deviantart.com/ (which I was trying to visit just 10 minutes ago) have broken in Firefox but not chrome. Badly, too. These aren't "the layout is different in FF and nobody noticed" bugs, they're "site infinitely redirects" bugs or "login button doesn't submit" bugs. Debug steps: turn off bitwarden, my only extension. Never helps. Ctrl+Shift+Del cookies. Never helps. Sigh, open chrome. Works first time. Is it just me or did the web up and dump firefox just when it started to get good? :(
  - 1_player 7y ago
    Some tech demo sites are Chrome only but I’ve yet to encounter a broken site on Firefox. The only issues I have are mostly due to adblock or my Pi Hole. I haven’t used Chrome in years.
  - JoshuaDavid 7y ago
    I've noticed some of this lately - in a significant fraction of cases, it comes from Firefox honoring X-FRAME- OPTIONS while chrome ignores them, so e.g. payments work on chrome on sites that don't work on FF.
  - chrisweekly 7y ago
    I've unexpectedly had precisely the opposite experience; as of recent changes to cookie handling and 3rd party content in Chrome, several sites / webapps have either stopped working at all in chrome, or have serious issues -- while rendering and performing just fine in FF.
  - zo1 7y ago
    We recently had some "FE devs" make a spiffy new SPA for some internal product. When I got to testing it on Firefox cause that's my main browser, I got a blank white page. I asked them and they're like "yeah, it only works on chrome-based browsers". Or something to that effect. It's not like some CSS was wonky, or a bug somewhere... No, the default process of them building the SPA somehow yielded a completely non-functioning app for Firefox.
  - ornornor 7y ago
    At my current employer, the web apps are only ever tested on chrome. If it works on chrome, it ships. I think I’m the only one using Firefox and making sure it works there before chrome.
    - jjoonathan 7y ago
      Thanks for fighting the good fight.
  - laktak 7y ago
- kempbellt 7y ago
  > Not using Chrome? A truly deplorable act... I also added about 30 seconds of latency to every page I visit, but for completely different reasons as op. Switching to Brave and blocking all cookies and JS by default made me have to manually enable it for nearly every site that I actually wanted to use. About a week later, Chrome was reinstalled. Maybe I'll try it again once I level up my willpower.
  - david-s 7y ago
    i find blacklisting sites that abuse JS works better for me than the whitelist approach
  - aabbcc1241 7y ago
    I'm using nextdns.io and no-script with firefox, it works quite smooth when you accumulate the settings. You can export/import the no-script settings and merge with meld to keep the setting in sync between your PCs and laptops
    - aabbcc1241 7y ago
      Also "Privacy Badger" which smartly block scripts by checking cross site cookie, preset whitelist and custom whitelist/blocklist
  - GoblinSlayer 7y ago
    I have 15 whitelisted sites. I think it took negligible effort to add them, you whitelist a site once and it stays there from there on.
heartbeats 7y ago
You haven't opted in. For the modern web, using it without JavaScript and the requisite accounts isn't a supported option.
baq 7y ago
you use a vpn and have anti tracking features enabled in a browser. actually it's sometimes impossible to win the puzzle, they just keep serving you new ones to keep you busy. maybe it's effective against 3rd world click farms.
- Hitton 7y ago
  Just having anti-tracking features without vpn is enough. I suffer from it all the time.
- cascom 7y ago
  Yup - it’s a great way to lose real customers - but I suspect it’s a trade off they’re ok with
stewartm 7y ago
https://patents.google.com/patent/US9407661B2/en https://patents.google.com/patent/US9407661B2/en

aj7 7y ago

For about six months, the Fidelity mobile site gave false indications of incorrect username/password on purpose. No idea why they did this.

bennyelv 7y ago
I can see that it could be effective against brute force attacks. A real user would assume they fat fingered their password and try it again, a brute force attack would miss the password and carry on forever.

matheusmoreira 7y ago

> pretend they failed the captchas That explains a lot... I frequently have to solve 10+ captchas when I'm using Firefox, many of them rate-limited. It feels like a punishment for resising surveilance. These things should be illegal due to the accessibility problems they cause if not the fact they're a nuisance.

floriol 7y ago
It's more of an automatic thing (it's usually due to VPN) since many people connect from the same IP at near the same time. It's even worsr with TOR
- matheusmoreira 7y ago
  Why should people be punished for using VPNs, Tor, an ISP with CGNAT? All of these should be supported regardless of how much abuse originates from them.
  - fragmede 7y ago
    Should be, but unfortunately we're still trying to invent a better abuse-resistance system than a captcha. Invent a better one and the world will throw money at you. Telemarketing calls are an example where better abuse-resistant systems would be awesome.
    - matheusmoreira 7y ago
      > we're still trying to invent a better abuse-resistance system than a captcha. > Invent a better one and the world will throw money at you. It already exists. The abuse stems from the fact servers connected to the wider internet are designed to respond to anyone who tries to talk to it. That's the fundamental problem with internet security today: computers talk to strangers they don't know much less trust. What if computers dropped all packets by default and networked only with authorized users? The risk of exploitation and abuse becomes negligible because to unauthorized users it's like the computer is not even there to begin with. This can be done with single packet authorization. The internet would lose its mass market appeal but it's much better than normalized widespread surveillance.