3 ms·

I still pick bikes and road signs and markets in the same frequency as before. Didn't notice anywhere before reading this comment. I use Firefox.

gen220 6y ago
Same here. My SO teases me whenever she sees one on my laptop, because she thinks I’m getting punished for being “bad” at identifying crosswalks and boats. Of course she uses chrome and never sees them. I swear the algorithm is: (if isFirefox and isUMatrixLoaded) It makes me wonder, are bots really more likely to use FF and ad blockers? Whenever I write scrapers and want to come off as human, I always use headless chrome spoofing non-headless chrome, and I never get captchas... I’m also vaguely aware of headless chrome botnets used to mine ads. They definitely don’t use uMatrix. :/ Is this anticompetitive in some way?
- judge2020 6y ago
  Headless browser scrapers might blacklist things they don't need, like ad domains and trackers, since all they do is slow down how long it takes for their desired content to load. The algorithm simply checks to see how often you check in with Google and how "human" your actions are based on the data you send to them via things like Search, Maps Location History, YouTube, Gmail, probably Chrome Sync, etc. If you're using a completely new Google Account and block all of Google's Trackers, choose to use FastMail for your actual email communications, and only occasionally watch YouTube, Google has every reason to believe your IP is a residential proxy that's being used by a bot or perhaps someone in a third world country working at a recaptcha farm. They can't completely prevent the latter from solving their Captchas but at that point all they need is for the farm worker to help Google tune its self driving dataset.
- mcpeepants 6y ago
  I don't think there's anything going on here explicitly targeting Firefox. Adblock/UMatrix/etc are doing their job, blocking cookies and other tracking and heuristics that allow sites to decide you are "likely human" and skip showing you a captcha. Using Chrome (and being logged in with your account connected to Chrome) is providing a heuristic that Firefox cannot, allowing you to skip captcha since you are being tracked by the browser itself. So it's more implicit than explicit.
judge2020 6y ago
They're talking about ReCaptcha v3[0], which is completely different in comparison to current ReCaptcha that requires you tick a checkbox. The new version analyzes your behavior across an entire website and, when the website requests your threat score, it returns 0.0-1.0 with 1.0 being considered human. The problem with this new system is that it doesn't solve the problem developers wanted to solve before: preventing unauthorized signups. Most developers don't want to know how likely it is that a user is actually a bot, they just don't want bots signing up for user accounts. With the new system, Developers have to decide what to do with a threat score. Should 0.5 require some interstellar page with a v2 captcha? Does a 1 or 0.9 mean they should give them access to certain data that might be otherwise hidden from boys? It's something developers generally didn't need before. We likely won't see the "i'm not a robot" checkbox (/invisible recaptcha[1]) go away anytime soon since v3 solves different problems, but it does mean websites might start sending you down different verification funnels depending on how human Google thinks you are with no way to solve a Captcha that proves Google otherwise. 0: https://developers.google.com/recaptcha/docs/v3 https://developers.google.com/recaptcha/docs/v3 1: https://developers.google.com/recaptcha/docs/invisible https://developers.google.com/recaptcha/docs/invisible
sli 6y ago
Firefox + VPN and I have to do that and I get pretty blatant fake failures and end up having to do it numerous times. It honestly feels like Google is trying to punish me.

gen220 6y ago

Same here. My SO teases me whenever she sees one on my laptop, because she thinks I’m getting punished for being “bad” at identifying crosswalks and boats. Of course she uses chrome and never sees them. I swear the algorithm is: (if isFirefox and isUMatrixLoaded) It makes me wonder, are bots really more likely to use FF and ad blockers? Whenever I write scrapers and want to come off as human, I always use headless chrome spoofing non-headless chrome, and I never get captchas... I’m also vaguely aware of headless chrome botnets used to mine ads. They definitely don’t use uMatrix. :/ Is this anticompetitive in some way?

judge2020 6y ago
Headless browser scrapers might blacklist things they don't need, like ad domains and trackers, since all they do is slow down how long it takes for their desired content to load. The algorithm simply checks to see how often you check in with Google and how "human" your actions are based on the data you send to them via things like Search, Maps Location History, YouTube, Gmail, probably Chrome Sync, etc. If you're using a completely new Google Account and block all of Google's Trackers, choose to use FastMail for your actual email communications, and only occasionally watch YouTube, Google has every reason to believe your IP is a residential proxy that's being used by a bot or perhaps someone in a third world country working at a recaptcha farm. They can't completely prevent the latter from solving their Captchas but at that point all they need is for the farm worker to help Google tune its self driving dataset.
mcpeepants 6y ago
I don't think there's anything going on here explicitly targeting Firefox. Adblock/UMatrix/etc are doing their job, blocking cookies and other tracking and heuristics that allow sites to decide you are "likely human" and skip showing you a captcha. Using Chrome (and being logged in with your account connected to Chrome) is providing a heuristic that Firefox cannot, allowing you to skip captcha since you are being tracked by the browser itself. So it's more implicit than explicit.

judge2020 6y ago

They're talking about ReCaptcha v3[0], which is completely different in comparison to current ReCaptcha that requires you tick a checkbox. The new version analyzes your behavior across an entire website and, when the website requests your threat score, it returns 0.0-1.0 with 1.0 being considered human. The problem with this new system is that it doesn't solve the problem developers wanted to solve before: preventing unauthorized signups. Most developers don't want to know how likely it is that a user is actually a bot, they just don't want bots signing up for user accounts. With the new system, Developers have to decide what to do with a threat score. Should 0.5 require some interstellar page with a v2 captcha? Does a 1 or 0.9 mean they should give them access to certain data that might be otherwise hidden from boys? It's something developers generally didn't need before. We likely won't see the "i'm not a robot" checkbox (/invisible recaptcha[1]) go away anytime soon since v3 solves different problems, but it does mean websites might start sending you down different verification funnels depending on how human Google thinks you are with no way to solve a Captcha that proves Google otherwise. 0: https://developers.google.com/recaptcha/docs/v3 https://developers.google.com/recaptcha/docs/v3 1: https://developers.google.com/recaptcha/docs/invisible https://developers.google.com/recaptcha/docs/invisible

sli 6y ago

Firefox + VPN and I have to do that and I get pretty blatant fake failures and end up having to do it numerous times. It honestly feels like Google is trying to punish me.