8 ms·

One of the more insidious elements of ReCAPTCHA is its propensity to challenge users who have robust cookie blocking in place. So as we encourage people to be m

One of the more insidious elements of ReCAPTCHA is its propensity to challenge users who have robust cookie blocking in place. So as we encourage people to be more privacy-aware, the web gets harder and harder to use. We've seen ReCAPTCHA pop all over ecommerce, all over benign websites with little to no need to challenge use almost completely because of the increase in privacy-aware users. ReCAPTCHA essentially flies in the face of the recent blocking features rolling into Safari and Firefox and more privacy-aware users...growing by the day. In many ways it's a genius structure from Google. 1. Convince people to use your privacy challenge. 2. Serve it when you don't see Google tracking cookies. 3. Offer a way around that with the least privacy-aware browser available (Chrome use is growing steadily month over month. So good on Cloudflare.

noad 6y ago
You're forgetting the main benefit for google, which is getting humans to train all their vision models for free. At one point they were just forcing X% of clicks to fill out a captcha regardless of origin or identity just to get more data. I for one am getting quite tired of trillion dollar corporations getting things for free out of me. Hard pass.
- 0xff00ffee 6y ago
  Did you even RTFA and look at hCAPTCHA? hCAPTCHA couldn't be more grossly focused on neural-net training. Hell, one challenge asks you to draw a bounding box and another is a classification tagging.
  - Nicksil 6y ago
    There was no argument being made for HCAPTCHA in the post to which you replied. So, yeah, everything you mentioned is indeed gross, including Google's behavior.
    - 0xff00ffee 6y ago
      The parent post was edited.
- weinzierl 6y ago
  > You're forgetting the main benefit for google, which is getting humans to train all their vision models for free. Is this still true? I keep seeing the same type of images for years and there might be 7 or 8 different categories but that's it. To me reCaptcha looks like a service well in its maintenance phase. If it was actually in use for training purposes you might expect images to match a wider range of tasks.
  - krut-patel 6y ago
    I could swear I've seen challenges with night scenes (low light conditions) in the wild. Those were definitely not present earlier.
  - airstrike 6y ago
    I've lost track of how many times I've had to read house numbers from Google Street View...
    - sli 6y ago
      I haven't gotten one of those in years. These days it's just picking out buses, cars, traffic signals, and sometimes motorcycles. Maybe once in a while it'll ask for storefronts.
      - eythian 6y ago
        Most of mine lately have been traffic features also. This is a little tricky in some cases, e.g. with crossings, as it sometimes gives me things that I don't think are crossings but it insists I select, perhaps they are in the US, or the perspective is weird, or someone else has told it that a series of white squares is a crossing and it requires me to agree.
  - sixothree 6y ago
    Like trees, bridges, fire hydrants, cars, buses, house numbers, etc?
- derefr 6y ago
  If that was still the main benefit for them, they wouldn’t be planning to start charging for it, because that would—and, as this article shows, has—cut off much of that data flow, as reCAPTCHA clients abandon the service for another one that isn’t charging them.
- Analemma_ 6y ago
  This really shows how popular perceptions of Google have changed for the worse over the years. I remember when RECAPTCHA was first launched, everyone knew right away that it was just helping Google train their vision models, but at the time we all thought it was cool, like "Wow, I'm helping the cause of AI research at the same time as stopping spam". But now it just pisses everyone off. Hell, for a little while Google had a game (can't remember the name of it) which was labeling images with another person to get points and people loved it.
  - hombre_fatal 6y ago
    > But now it just pisses everyone off. Though we're still just talking about a few HNers here who complain about doing "free work for Google", not the broad population.
  - machello13 6y ago
    At least the original reCAPTCHA was used for OCR'ing public domain books. Even if it had the effect of training Google's OCR tech, it was at least making literature searchable and indexable for the public good. Modern reCAPTCHA is nothing more than training for Google Maps and, seemingly, self-driving cars, both of which are commercialized.
- grishka 6y ago
  Except in this wonderful new world, you don't get the choice to "hard pass". As someone whose ISP has too few public IP addresses, I see Cloudflare's "one more step" pages at least several times a month. It's terrifying to realize just how much of the internet is behind that thing right now.
- mikkelam 6y ago
  I really don't think the challenges we're giving at still hard for computers.. a lot of these are super simple.. google would've cracked many of the driving ones years ago
tcd 6y ago
I would love to see the raw data on how many transactions have been abandoned because of ReCaptcha; if I had to solve a test to purchase my shopping, I'd go elsewhere (and there are places that are not as hostile out there). I cannot understand the stupidity of putting your entire business in the hands of an advertisement company who gives no shits about you as a business or a person, apart from your data. I can say for certain ReCaptcha has made me reconsider a purchase and is a major factor in my purchasing decision. If I can't use all my privacy tools (including noscript, and I only whitelist a few times to get the right scripts), then I don't care about what you're selling. Hopefully in the near future ReCaptcha breaks altogether due to enhanced privacy protection.
jjoonathan 6y ago
That, and ReCAPTCHA had hellbans. If you blocked cookies or were otherwise problematic, it would sometimes lock you out of all ReCAPTCHA-gated resources not by giving you a message describing what was happening, why, and how to fix it, but rather by simply pretending that your every attempt to solve the captcha failed. Obviously this is extremely frustrating, by design, but it gets even more so with compounding factors like "the library is closed at this hour, so I can't get a fresh connection." The worst I've seen has been when it happens to people who aren't well equipped to guess what's happening. When my friend's younger brother got hellbanned from his PlayStation account, he spent 30 minutes trying to identify traffic lights (or whatever) and then retreated crying to his room, because he wasn't able to deduce that Google was gaslighting him. He trusted Google. They had him convinced that he was such a failure he couldn't even identify traffic lights correctly, and he was -- quite reasonably -- inconsolable for a while. Thanks a lot, Google.
- _jal 6y ago
  Captchas are fundamentally anti-human. I'm not saying there isn't a problem to be solved, I'm saying Captchas are a behavior enforcement mechanism overseen by robots and are anti-human. I write the site owner short note when they go bad explaining why they just lost a customer and go somewhere else. Life is too short to put up with shitty tech.
  - quotemstr 6y ago
    You've made an assertion, not an argument. What does "anti-human" even mean? You're angry, sure, but you haven't expressed what exactly it is that you're angry about. Nor have you proposed a realistic alternative way to distinguish bots from humans. This kind of histrionic, sweeping hot take is not productive.
    - karatestomp 6y ago
      Considering captchas operate by pushing the work of avoiding bots on your site (your problem) onto all the human users of your site, I think on the basis of that alone "anti-human" is warranted. Or "anti-social", if you prefer, which might better capture the fundamental problem with that aspect of it. That they proceed to perform textbook gaslighting on some of those people makes it even worse ("no, you didn't select all the buses in those images" but, of course, you did). Whether these things are necessary for it to operate is beside the point.
GuB-42 6y ago
> One of the more insidious elements of ReCAPTCHA is its propensity to challenge users who have robust cookie blocking in place. It is understandable and I expect HCAPTCHA to do the same thing. The goal of a CAPTCHA is to identify you as a human. I don't know how ReCAPTCHA works, but I expect it to be like spam filters: they have a sample of bots, a sample of humans and assign weights to every aspect, in the end, the algorithm spits out a probability of you being human, and it will challenge you until it reaches a set value. The thing is: if you hide everything for privacy reasons, you are making yourself indistinguishable from anything else using HTTP, including bots. That's the point, but it also means the only way to prove you are human is through a challenge. Think of it like a private club. If you a regular and the bouncer is likely to recognize you and let you in without asking anything. But if you don't want to show your face, you will need to show your membership card every single time. That's the price of anonymity.
Kalium 6y ago
One of the non-obvious consequences is that any system designed to use technical measures to distinguish between humans and computers will wind up very sensitive. There's an arms race, and us real users are caught in the middle. There's a vast army of computers doing their best to pretend to be human. The whole point of any kind of CAPTCHA is to try to catch them out - and every measure gets worse over time. So companies like Google look at everything they can see that helps them distinguish typical humans from robots. This has a nasty side-effect. A lot of measures intended to preserve privacy have the incidental effect of making the privacy-sensitive user look more like a computer and less like a human. Not saving cookies and not executing JS are classic bot moves. This plays directly into the sensitivity that has been engineered over time in order to catch more computers posing as humans. I don't know any easy resolution to this tension. Maybe you do? I really hope so. The internet is overrun with abusive behavior and the amount of work that goes into keeping it at bay is staggering.
gsich 6y ago
I use buster to solve recaptcha.
andrenotgiant 6y ago
> One of the more insidious elements of ReCAPTCHA is its propensity to challenge users who have robust cookie blocking in place... ...So good on Cloudflare. Just to be clear: Cloudflare is only changing the _provider_ of CAPTCHA's. They are not changing the _criteria_ for showing CAPTCHA's. So users who have robust cookie blocking in place will continue to be penalized.
deleted 6y ago
[deleted]

noad 6y ago

You're forgetting the main benefit for google, which is getting humans to train all their vision models for free. At one point they were just forcing X% of clicks to fill out a captcha regardless of origin or identity just to get more data. I for one am getting quite tired of trillion dollar corporations getting things for free out of me. Hard pass.

0xff00ffee 6y ago
Did you even RTFA and look at hCAPTCHA? hCAPTCHA couldn't be more grossly focused on neural-net training. Hell, one challenge asks you to draw a bounding box and another is a classification tagging.
- Nicksil 6y ago
  There was no argument being made for HCAPTCHA in the post to which you replied. So, yeah, everything you mentioned is indeed gross, including Google's behavior.
  - 0xff00ffee 6y ago
    The parent post was edited.
weinzierl 6y ago
> You're forgetting the main benefit for google, which is getting humans to train all their vision models for free. Is this still true? I keep seeing the same type of images for years and there might be 7 or 8 different categories but that's it. To me reCaptcha looks like a service well in its maintenance phase. If it was actually in use for training purposes you might expect images to match a wider range of tasks.
- krut-patel 6y ago
  I could swear I've seen challenges with night scenes (low light conditions) in the wild. Those were definitely not present earlier.
- airstrike 6y ago
  I've lost track of how many times I've had to read house numbers from Google Street View...
  - sli 6y ago
    I haven't gotten one of those in years. These days it's just picking out buses, cars, traffic signals, and sometimes motorcycles. Maybe once in a while it'll ask for storefronts.
    - eythian 6y ago
      Most of mine lately have been traffic features also. This is a little tricky in some cases, e.g. with crossings, as it sometimes gives me things that I don't think are crossings but it insists I select, perhaps they are in the US, or the perspective is weird, or someone else has told it that a series of white squares is a crossing and it requires me to agree.
- sixothree 6y ago
  Like trees, bridges, fire hydrants, cars, buses, house numbers, etc?
derefr 6y ago
If that was still the main benefit for them, they wouldn’t be planning to start charging for it, because that would—and, as this article shows, has—cut off much of that data flow, as reCAPTCHA clients abandon the service for another one that isn’t charging them.
Analemma_ 6y ago
This really shows how popular perceptions of Google have changed for the worse over the years. I remember when RECAPTCHA was first launched, everyone knew right away that it was just helping Google train their vision models, but at the time we all thought it was cool, like "Wow, I'm helping the cause of AI research at the same time as stopping spam". But now it just pisses everyone off. Hell, for a little while Google had a game (can't remember the name of it) which was labeling images with another person to get points and people loved it.
- hombre_fatal 6y ago
  > But now it just pisses everyone off. Though we're still just talking about a few HNers here who complain about doing "free work for Google", not the broad population.
- machello13 6y ago
  At least the original reCAPTCHA was used for OCR'ing public domain books. Even if it had the effect of training Google's OCR tech, it was at least making literature searchable and indexable for the public good. Modern reCAPTCHA is nothing more than training for Google Maps and, seemingly, self-driving cars, both of which are commercialized.
grishka 6y ago
Except in this wonderful new world, you don't get the choice to "hard pass". As someone whose ISP has too few public IP addresses, I see Cloudflare's "one more step" pages at least several times a month. It's terrifying to realize just how much of the internet is behind that thing right now.
mikkelam 6y ago
I really don't think the challenges we're giving at still hard for computers.. a lot of these are super simple.. google would've cracked many of the driving ones years ago

tcd 6y ago

I would love to see the raw data on how many transactions have been abandoned because of ReCaptcha; if I had to solve a test to purchase my shopping, I'd go elsewhere (and there are places that are not as hostile out there). I cannot understand the stupidity of putting your entire business in the hands of an advertisement company who gives no shits about you as a business or a person, apart from your data. I can say for certain ReCaptcha has made me reconsider a purchase and is a major factor in my purchasing decision. If I can't use all my privacy tools (including noscript, and I only whitelist a few times to get the right scripts), then I don't care about what you're selling. Hopefully in the near future ReCaptcha breaks altogether due to enhanced privacy protection.

jjoonathan 6y ago

That, and ReCAPTCHA had hellbans. If you blocked cookies or were otherwise problematic, it would sometimes lock you out of all ReCAPTCHA-gated resources not by giving you a message describing what was happening, why, and how to fix it, but rather by simply pretending that your every attempt to solve the captcha failed. Obviously this is extremely frustrating, by design, but it gets even more so with compounding factors like "the library is closed at this hour, so I can't get a fresh connection." The worst I've seen has been when it happens to people who aren't well equipped to guess what's happening. When my friend's younger brother got hellbanned from his PlayStation account, he spent 30 minutes trying to identify traffic lights (or whatever) and then retreated crying to his room, because he wasn't able to deduce that Google was gaslighting him. He trusted Google. They had him convinced that he was such a failure he couldn't even identify traffic lights correctly, and he was -- quite reasonably -- inconsolable for a while. Thanks a lot, Google.

_jal 6y ago
Captchas are fundamentally anti-human. I'm not saying there isn't a problem to be solved, I'm saying Captchas are a behavior enforcement mechanism overseen by robots and are anti-human. I write the site owner short note when they go bad explaining why they just lost a customer and go somewhere else. Life is too short to put up with shitty tech.
- quotemstr 6y ago
  You've made an assertion, not an argument. What does "anti-human" even mean? You're angry, sure, but you haven't expressed what exactly it is that you're angry about. Nor have you proposed a realistic alternative way to distinguish bots from humans. This kind of histrionic, sweeping hot take is not productive.
  - karatestomp 6y ago
    Considering captchas operate by pushing the work of avoiding bots on your site (your problem) onto all the human users of your site, I think on the basis of that alone "anti-human" is warranted. Or "anti-social", if you prefer, which might better capture the fundamental problem with that aspect of it. That they proceed to perform textbook gaslighting on some of those people makes it even worse ("no, you didn't select all the buses in those images" but, of course, you did). Whether these things are necessary for it to operate is beside the point.

GuB-42 6y ago

> One of the more insidious elements of ReCAPTCHA is its propensity to challenge users who have robust cookie blocking in place. It is understandable and I expect HCAPTCHA to do the same thing. The goal of a CAPTCHA is to identify you as a human. I don't know how ReCAPTCHA works, but I expect it to be like spam filters: they have a sample of bots, a sample of humans and assign weights to every aspect, in the end, the algorithm spits out a probability of you being human, and it will challenge you until it reaches a set value. The thing is: if you hide everything for privacy reasons, you are making yourself indistinguishable from anything else using HTTP, including bots. That's the point, but it also means the only way to prove you are human is through a challenge. Think of it like a private club. If you a regular and the bouncer is likely to recognize you and let you in without asking anything. But if you don't want to show your face, you will need to show your membership card every single time. That's the price of anonymity.

Kalium 6y ago

One of the non-obvious consequences is that any system designed to use technical measures to distinguish between humans and computers will wind up very sensitive. There's an arms race, and us real users are caught in the middle. There's a vast army of computers doing their best to pretend to be human. The whole point of any kind of CAPTCHA is to try to catch them out - and every measure gets worse over time. So companies like Google look at everything they can see that helps them distinguish typical humans from robots. This has a nasty side-effect. A lot of measures intended to preserve privacy have the incidental effect of making the privacy-sensitive user look more like a computer and less like a human. Not saving cookies and not executing JS are classic bot moves. This plays directly into the sensitivity that has been engineered over time in order to catch more computers posing as humans. I don't know any easy resolution to this tension. Maybe you do? I really hope so. The internet is overrun with abusive behavior and the amount of work that goes into keeping it at bay is staggering.

gsich 6y ago

I use buster to solve recaptcha.

andrenotgiant 6y ago

> One of the more insidious elements of ReCAPTCHA is its propensity to challenge users who have robust cookie blocking in place... ...So good on Cloudflare. Just to be clear: Cloudflare is only changing the _provider_ of CAPTCHA's. They are not changing the _criteria_ for showing CAPTCHA's. So users who have robust cookie blocking in place will continue to be penalized.

deleted 6y ago

[deleted]