4 ms·

If I were Google, I would let it pass (at least where it's not in my own services, not in crucial places), and use that obviously simple heuristic for machine l

by comboy 6y ago

If I were Google, I would let it pass (at least where it's not in my own services, not in crucial places), and use that obviously simple heuristic for machine learning so that distinction between human and robot can be taught using many other available variables. Well, I wouldn't really do that if I were Google. But I think it could be happening.

gnopgnip 6y ago
Google doesn't pass or fail, it gives a score and leaves it up to the site operator.
- comboy 6y ago
  s/let it pass/give lower score Although I admit my idea looks less probable this way. It's still less ridiculous to me that not using keyboard or mouse data. But on the other hand they may be afraid of people screaming "Google is sending your keystrokes to their servers" etc.
- saagarjha 6y ago
  They only did that so they could shift the blame/responsibility of making the classification to website operators instead of themselves.
  - chris_va 6y ago
    It's a library for web developers... Is it so terrible to return a float instead of a bool?
    - saagarjha 6y ago
      Yes, because it's going to return a small float for anything that Google thinks is "suspicious" (including using Safari or Firefox) and websites will block it as if Google returned "no", except Google is absolved of the criticism that they return bad results for people who value their privacy ("if you don't like it, you should set your confidence lower…")
- chrismorgan 6y ago
  You’re dealing with two different things. reCAPTCHA v2 and the badly named Invisible reCAPTCHA¹ assess the user and either let them in, or gate them on puzzle solving. So, it does pass or fail you, where fail means trap you in purgatory indefinitely (though some hold it’s actually hell rather than purgatory). reCAPTCHA v3 never presents a CAPTCHA for you to solve, but decides a score (in practice, I’ve only seen 0.1, 0.3, 0.7 and 0.9) where higher means it’s feeling more friendly towards you, and it’s up to the site operator to decide what to do with it. (You should provide alternative means, e.g. if you’re doing fraud prevention for signup, fall back to SMS verification. Too many sites provide no recourse for a low score, which is illegal to do in various countries on accessibility grounds. With reCAPTCHA v2 and Invisible reCAPTCHA the site owners can at least blame Google, not that that gets them off the hook.) Given the use of Rekognition here, I presume this project is breaking reCAPTCHA v2 and possibly Invisible reCAPTCHA, and not reCAPTCHA v3. ——— ¹ I call Invisible reCAPTCHA badly named because it’s only invisible on the happy path—all it’s doing is hiding the “I’m not a robot” widget, effectively having the code “click” it when submitting. And given that reCAPTCHA v3 is then invisible, never showing anything to the user… yeah, it’s confusing. Arguably reCAPTCHA v3 isn’t even a CAPTCHA any more either, so… yeah, the names are all a bit of a mess.
  - notatoad 6y ago
    your comment is reasonable, using rekognition for recaptcha v3 wouldn't seem to make sense. but the linked source code is pretty clearly interpreting scores and referencing recaptcha v3, so i'm not sure what images they're running rekognition on. (unless there's a bunch of stuff going on in this repo and this file is unrelated to the title) https://bitbucket.org/Pirates-of-Silicon-Hills/voightkampff/src/master/checkScore.sh https://bitbucket.org/Pirates-of-Silicon-Hills/voightkampff/...
    - chrismorgan 6y ago
      It seems to be using the reCAPTCHA v3 score to guess how reCAPTCHA v2 will behave, and therefore influence its behaviour so it doesn’t dig itself into a ditch. (c.f. main.sh lines 755–758, notabot.sh lines 47–57.)
  - deleted 6y ago
- notatoad 6y ago
  they suggest a default 0.5 threshold in their documentation. if you're testing "passing" their captcha, it'd be pretty reasonable to consider anything below that a fail.

by comboy 6y ago

gnopgnip 6y ago

Google doesn't pass or fail, it gives a score and leaves it up to the site operator.

comboy 6y ago
s/let it pass/give lower score Although I admit my idea looks less probable this way. It's still less ridiculous to me that not using keyboard or mouse data. But on the other hand they may be afraid of people screaming "Google is sending your keystrokes to their servers" etc.
saagarjha 6y ago
They only did that so they could shift the blame/responsibility of making the classification to website operators instead of themselves.
- chris_va 6y ago
  It's a library for web developers... Is it so terrible to return a float instead of a bool?
  - saagarjha 6y ago
    Yes, because it's going to return a small float for anything that Google thinks is "suspicious" (including using Safari or Firefox) and websites will block it as if Google returned "no", except Google is absolved of the criticism that they return bad results for people who value their privacy ("if you don't like it, you should set your confidence lower…")
chrismorgan 6y ago
You’re dealing with two different things. reCAPTCHA v2 and the badly named Invisible reCAPTCHA¹ assess the user and either let them in, or gate them on puzzle solving. So, it does pass or fail you, where fail means trap you in purgatory indefinitely (though some hold it’s actually hell rather than purgatory). reCAPTCHA v3 never presents a CAPTCHA for you to solve, but decides a score (in practice, I’ve only seen 0.1, 0.3, 0.7 and 0.9) where higher means it’s feeling more friendly towards you, and it’s up to the site operator to decide what to do with it. (You should provide alternative means, e.g. if you’re doing fraud prevention for signup, fall back to SMS verification. Too many sites provide no recourse for a low score, which is illegal to do in various countries on accessibility grounds. With reCAPTCHA v2 and Invisible reCAPTCHA the site owners can at least blame Google, not that that gets them off the hook.) Given the use of Rekognition here, I presume this project is breaking reCAPTCHA v2 and possibly Invisible reCAPTCHA, and not reCAPTCHA v3. ——— ¹ I call Invisible reCAPTCHA badly named because it’s only invisible on the happy path—all it’s doing is hiding the “I’m not a robot” widget, effectively having the code “click” it when submitting. And given that reCAPTCHA v3 is then invisible, never showing anything to the user… yeah, it’s confusing. Arguably reCAPTCHA v3 isn’t even a CAPTCHA any more either, so… yeah, the names are all a bit of a mess.
- notatoad 6y ago
  your comment is reasonable, using rekognition for recaptcha v3 wouldn't seem to make sense. but the linked source code is pretty clearly interpreting scores and referencing recaptcha v3, so i'm not sure what images they're running rekognition on. (unless there's a bunch of stuff going on in this repo and this file is unrelated to the title) https://bitbucket.org/Pirates-of-Silicon-Hills/voightkampff/src/master/checkScore.sh https://bitbucket.org/Pirates-of-Silicon-Hills/voightkampff/...
  - chrismorgan 6y ago
    It seems to be using the reCAPTCHA v3 score to guess how reCAPTCHA v2 will behave, and therefore influence its behaviour so it doesn’t dig itself into a ditch. (c.f. main.sh lines 755–758, notabot.sh lines 47–57.)
- deleted 6y ago
notatoad 6y ago
they suggest a default 0.5 threshold in their documentation. if you're testing "passing" their captcha, it'd be pretty reasonable to consider anything below that a fail.