12 ms·

ReCAPTCHA and the Anonymous Experience

91 points by simonpure 6y ago

bzb6 6y ago
Why haven’t they considered using other captcha solution?
S04dKHzrKT 6y ago
As someone that hasn't had to use any captcha services, does an alternate like hCaptcha not have feature parity with reCaptcha?
- ve55 6y ago
  On the surface it does, but many more users will have to complete the captcha, since they cannot judge your 'humanness' by your Google cookies+account. Although I like services like hCaptcha a lot more myself, it may be possible that this notably bothers users and decreases conversion rates.
  - feanaro 6y ago
    I don't have a Google account, I fanatically block Google's tracking and I still usually don't see captchas. For this reason, I don't think this holds.
    - seniorivn 6y ago
      depends on where do you live
    - intellirogue 6y ago
      On the other hand I do have a Google account but block tracking, and I have to do about 6 rounds of reCAPTCHA every time. So either you're in a country that Google has decided is "good" (i'm in Germany), or you're not blocking Google's tracking as well as you think.
      - feanaro 6y ago
        That's interesting. Without disclosing my location, let's just say I'm in a much less powerful (and hence, I would imagine, less reputable) country than Germany. I doubt it is in the "good" set, but who knows. I also doubt I'm not blocking it well enough. I'm running Firefox with CanvasBlocker, uBlock Origin (with strict rulesets) and uMatrix. I also turn on restrictFingerprinting.
    - BlueTemplar 6y ago
      How do you manage ? These days it seems like almost every website where you have to make an account requires reCAPTCHA... (I'm using uMatrix too, but this doesn't solve the issue that if I don't allow reCAPTCHA, I'm stuck on the first step of account creation…)
- daveoc64 6y ago
  Its approach to accessibility is terrible. https://dashboard.hcaptcha.com/signup?type=accessibility https://dashboard.hcaptcha.com/signup?type=accessibility As a user that can't answer the challenges, you have to register with hCaptcha in advance of using the website you want to. This lets you bypass the verification checks for a while. The discoverability of this is poor
  - lrvick 6y ago
    And throws privacy out the window.
- miyuru 6y ago
  hCaptcha does not have IPv6 support. It breaks the web, when trying IPv6 only.
- whatsmyusername 6y ago
  Sooooo hcaptcha is way more aggressive. Like when it first went into cloudflare it made browsing the web miserable. They've since seemed to put a lot of work into it. To the point where I don't notice it anymore. They're iterating, and that's what I want to see.
sofixa 6y ago
Out of the loop, didn't know reCAPTCHA became paid. After a quick Google search I can only see that the Enterprise version is paid,but v3 isn't. Can one still use v3 and not pay for Enterprise?
- GlitchMr 6y ago
  reCAPTCHA v3 has 1000000 calls per month limit, after that for commercial purposes you need to migrate to reCAPTCHA Enterprise.
  - octoberfranklin 6y ago
    So can I boot lame websites out of the free tier by making 1000000 bot requests to the captcha page? Or does Google only count successful human detections towards the 1000000-request limit?
    - deleted 6y ago
      [deleted]
    - a_imho 6y ago
      I would not shed any tears for sites which abuse users with recaptcha.
ffpip 6y ago
Guess they got tired of training their AI for free. Started charging now
- Contax 6y ago
  > Started charging now So... a web/company has to pay Google for the service... while the company's users/visitors will still do free AI training for Google? If that is how it works, that's some bold business plan (money on top of free labor).
akalsz 6y ago
> reCAPTCHA > anonymous Pick one. reCAPTCHA is based on tracking users in countless unknown ways, which is why it's basically unusable with any kind of known proxy (i.e. Google usually classifies Tor users or users from 3rd world countries as bots by default). It may be stopping "dark web hackers", exactly because it's unsolvable by anyone Google decides to be a potential threat, and that also includes bots. Honestly, I feel like everyone would be better off if instead of reCAPTCHA, websites just used some service that automatically blocks proxies. That way you aren't getting Google to track legit users, and still forbidding potential users from joining who would otherwise be blocked by reCAPTCHA. And maybe if Google isn't watching me on your website, perhaps I'll be more inclined to visit you from my actual IP. Or just use something that is actually solvable by humans, like hCaptcha. Cloudflare did that and it's wonderful (well, compared to reCAPTCHA), I can solve it in a few seconds, unlike reCAPTCHA which I can keep clicking on for countless minutes only to get told that "my network is sending too many requests" or something.
- arbol 6y ago
  I also can't get through Google recaptcha. Proxy services rotate their up blocks so you can't simply block them all. Captchas are in their infancy. We need to move beyond something that involves simply clicking to identify images - we're providing free training for AI, not to mention the fact that it's incredibly inconvenient for blind people. I think a measure of uniqueness is required based answers to questions that don't necessarily have correct answers. The distance between the question and answer would be the measure. Identifying questions that provide consistent distances for individuals would be the hard thing.
  - throwaway3699 6y ago
    Captcha have audio versions for the blind, no?
    - y7 6y ago
      They're usually inaccessible if the system already suspects you of being a bot.
tleb_ 6y ago
It troubles me how a company can say in the same post that it respects user privacy and used Google reCAPTCHA. It's not only about what you collect, it's also about what third-party services collect. Otherwise the magic solution to respecting user privacy would be using a back-end as a service (e.g. Firebase). I might try navigating the web while blocking reCAPTCHA. How limited would my reach be? And what about blocking CloudFlare's solution?
CGamesPlay 6y ago
Charging for reCAPTCHA, and even removing the free tier, seems like a good win for consumers. By having a non-zero price tag, companies are forced to actually attach a monetary value to the service, which will discourage them from using it so frivolously. As it stands today, reCAPTCHA costs consumers both privacy and time, and costs the companies nothing.
- octoberfranklin 6y ago
  Yeah the amount of website laziness that reCAPTCHA has prompted is ridiculous. Guess what, folks, every visit to your website involves some mix of humans and software. Nobody uses the web without a browser, and every browser was written by a human. You aren't entitled to make hair-splitting distinctions and dump the enforcement burden on the public.
- swebs 6y ago
  >As it stands today, reCAPTCHA costs consumers both privacy and time Also it forces users to perform unpaid labor for Google.
- dheera 6y ago
  Why not simply just not differentiate between humans and bots, and enforce a usage policy that works for your business? You don't want them scraping 1000 articles an hour? Just put a limit on viewing 20 articles an hour, no need to differentiate between human and robot. The boundary between humans and robots will blur over the next few centuries. At some point it will just be a spectrum from all-inorganic to mixed to all-organic beings that roam the planet. We might as well prepare for that future by abolishing chemistryism (discrimination against organic vs. inorganic chemistry of a being) today. (Yes this sounds stupid, but 200 years ago, abolishing racism sounded stupid too.)
  - marcinzm 6y ago
    Limit by what? IP? Bots are distributed across IPs while certain users share IPs (NAT, universities, etc.). Cookie? Bots won't store cookies. Overall? Then human users will be blocked outright if there's enough bots.
02020202 6y ago
fuck recaptcha and all websites that make it impossible to use without it. the state of current things is insane. i can't even talk with the government or pay some bills without letting google spy on me. this is ridiculous.
- Contax 6y ago
  I feel your pain. Google is cancer for the web. And it should be illegal for sites to require third-parties you want no business with, at the very least for public or utility sites.
fab1an 6y ago
Consider hCaptcha - it's basically a superset of reCAPTCHA's functionality, but much more privacy-friendly and more affordable at scale. Also, it lets anyone label their data on it, not just Google. Full disclosure, I work with their excellent team.
- milankragujevic 6y ago
  Just wanted to thank you for mentioninf hCaptcha. I had tried it some time before but IIRC it was either invite-only or enterprise-only or had some "size" requirements. Just saw that it's available for all. Thank you!
- lrvick 6y ago
  Cloudflare/hcaptcha are the bane of my existence. Privacypass itself is a privacy violation and not available on most browsers and I don't want to spend an half hour a day doing free labor training someone else's AI to just use the internet anonymously.
  - gruez 6y ago
    Privacypass itself is a privacy violation and not available on most browsers what? https://support.cloudflare.com/hc/en-us/articles/115001992652-Using-Privacy-Pass-with-Cloudflare https://support.cloudflare.com/hc/en-us/articles/11500199265... It has addons for firefox and chrome, which makes up 90+% (by market share) of the browsers out there.
    - hundchenkatze 6y ago
      It's still a privacy violation. This add-on needs to: Access browser tabs Access browser activity during navigation Access your data for all websites
  - whatsmyusername 6y ago
    Cloudflare was a blessing for us. It's an incredible service for the price. Business tier (we needed custom certs) + advanced ssl is like $220/month and you get a WAF, a world class cdn, and DDOS protection.
qertoip 6y ago
The only long term solution is to request anonymous users to commit a tiny amount of cryptocurrency. If you don't want to deal with cryptocurrency then this could be simply a provable burn - purely an IT thing with no accounting team involved.
- beagle3 6y ago
  Bitcoin is pseudonymous, NOT anonymous, and is often easy to connect to a real identity (and there’s already legal action against tumblers, etc, that would make it even more so) Monero and ZCash supposedly offer real anonymity, but IIRC all implementations so far have been found vulnerable to (at least partial) deanonymization. Crypto currencies may have good uses, but so far, anonymity is not one of them - most definitely not for the masses (and hard-to-impossible for the very disciplined and knowledgeable pros)
  - qertoip 6y ago
    We are talking about relative anonymity against specific service provider and not necessarily absolute anonymity when the government descends upon you. VPN or proxy users are not really anonymous anyway and would certainly welcome an option to pay $0.1 in cryptocurrency instead of fighting infuriating CAPTCHA-s all the time.
    - rightbyte 6y ago
      Captchas for website access (not signups etc) seem to be mostly about preventing scrapers that are not from major companies and spying ofcourse. I don't see how they are in the interest of the site owner. It is just an annoying default for no fee caching/CDN by Cloudflare etc. If I would have to pay 10c to visit a website I would like it to "burn up". Most websites I visit I don't support in any sense.
    - beagle3 6y ago
      But it's not even relative anonymity. It's psudeonimity. It's a completely different thing we are not used to dealing with. Unless you actively try to hide your tracks, every single transaction you make is related. You may pay your friend at work $5 back for coffee using Bitcoin -- and at that second -- since he knows your wallet id -- he can check the blockchain for every transaction your wallet has ever participated in - every website you paid for (as a captcha, as a registration fee for that totally-legal-but-morally-questionable site, the money you contributed to support/oppose a political cause, etc.) This is NOT paranoia. People who aren't the NSA are constantly analyzing and making public identities related to wallets and transactions they made. Psudonimity is not anonymity - it's one step away from being an identity; and the fact that the blockchain is public makes all history public for an identity once that step was taken. Take cash from ATM. Put in wallet. Use cash in wallet to pay for drugs. Use cash from same ATM from same wallet to donate to church. Only NSA/FBI has the means to track this, and they have to work for it. Put money in bitcoin wallet. Use wallet to pay for drugs. Use same wallet to donate to church. Now church knows you paid for drugs, and your dealer knows which church you contribute to. Brandan Eich was forced to resign because of his political beliefs, as evidenced by his monetary contribution to some political cause[0]. If pseudonymous blockchain payments become mainstream, such events are going to become an everyday occurrence. For some things, that's a net positive for society (you want to know who the hypocrite politicians are). For some things, it's a net negative (losing privacy for individua). [0] I'm tryting to word this as neutrally as possible.
shuringai 6y ago
just use hcaptcha. even cloudflare switched to it
pdkl95 6y ago
reCAPTCHA won't even try to work if your UserAgent isn't on Google's short list[1] of supported browsers. If they don't like your browser, the reCAPTCHA widget simply gives up with a fatal error[2]. Any new browser, browser variant, or browser-like tool cannot access any website that requires reCAPTCHA. Same for anyone obscuring their UserAgent or using an older browser for any reason. reCAPTCHA is de facto restriction against any new competition in the browser market. [1] https://support.google.com/recaptcha/answer/6223828?hl=en https://support.google.com/recaptcha/answer/6223828?hl=en [2] https://user-images.githubusercontent.com/20207154/29577170-264e4872-8788-11e7-8b77-5d272b0c2f80.png https://user-images.githubusercontent.com/20207154/29577170-...
- GoblinSlayer 6y ago
  UserAgent variability is a bug anyway. Apple was right when tried to freeze it. It shouldn't affect browser market, because browser is a user-facing tool, UserAgent isn't.
known 6y ago
ReCAPTCHA has forced me to use https://www.qwant.com/ https://www.qwant.com/ as my default search engine in tor browser
protoduction 6y ago
I built FriendlyCaptcha [1], it's a proof of work based alternative to reCaptcha that is accessible. While it's not the perfect captcha either (which I think is impossible), it makes a better tradeoff in terms of UX, price and privacy. [1]: https://friendlycaptcha.com https://friendlycaptcha.com
- bo1024 6y ago
  I think this is a great solution! I have been thinking over the problems with captchas and also came to the conclusion that a proof-of-work puzzle is a fair, private, and hopefully-effective solution. You can look around for "useful" work, similar to how recaptcha was originally about transcription. If you can find some problems of the right difficulty that people want solved (e.g. I dunno, protein folding or something), then the electricity isn't wasted and you might even be able to sell the solutions.
  - gruez 6y ago
    AFAIK there used to be a service that did exactly that - it used cpu cycles to mine cryptocurrencies.
    - Forbo 6y ago
      There's a few like that, Golem and Gridcoin are the two that immediately come to mind for me. Gridcoin uses the Berkeley Open Infrastructure for Network Computing (BOINC).
- gruez 6y ago
  >The problem with other CAPTCHAs > It's broken >Tasks that are easy for all humans but difficult for computers may no longer exist. >Using machine learning or even browser plugins one can solve ReCAPTCHA in under a second. There are even CAPTCHA solving companies that offer thousands of solves for $1. This is probably a bad argument when your proof of work captcha can be solved for much cheaper. Your site says "Solving it will take a few seconds on a desktop computer", which I'll interpret as 5 seconds. The spot price for a c5a.2xlarge instance (8 thread zen2 CPU) is 21.6 cents/hr. That works out to 0.03 cents per solve, an order of magnitude less than the 0.1 cents per solve for commercial recaptcha solving services. It probably gets even cheaper if you get your compute through non-cloud providers, or through GPUs.
whywhywhywhy 6y ago
For a system designed to weed out bots, whomever lead the redesign of reCAPTCHA to the crossing and traffic light identification unpaid labour system had nothing but utter contempt for humans and their time. I actually can't think of another user interaction I've had with a computer that had less respect for me as a person.
swiley 6y ago
Having to use recaptcha just to download minecraft has to be one of the biggest things that has completely pissed me off about it being sold to Microsoft.
modzu 6y ago
false dichotomy!!!
typenil 6y ago
I'm happy to hear Google is charging for ReCAPTCHA. I hope they make it completely unaffordable and get rid of any free tier. Any disincentive for sites to force users to train AI for Google is a good thing. Every time I run into it, it makes me hate the site I'm on. Google punishes my crimes of Firefox use and not being logged into Google by giving challenge after challenge - along with those infuriating "slow fade in" images to take bigger bites out of my day. The world would be better off without ReCAPTCHA.
- mtmail 6y ago
  And it also opens the chance for innovative (or not) competition. Hard to compete with a free Google service.
mdifrgechd 6y ago
For most low value sites e.g. inc.com type random news that ask me to sign up to continue, I just dont use them, because the value they provide is lower than how I value creating an account. The same is true for recaptcha, I usually just don't use a site if they make me use it. I have stopped donating to charities because they use recaptcha and would never buy from an online store that uses it. The same as I would never go to a bar where you are searched on the way in, or buy a pizza from a place with a central call center that makes me wait to make an order. If a business wants to treat me like shit, I just wont use it.
luord 6y ago
This reminds me that I've got to remove recaptcha from the contact form in my website. I rarely get contacted so I wouldn't have to pay any time soon, but I want to remove all third party services from my site anyway and I have to find a way to prevent spam that would nevertheless be less annoying for someone who would actually want to contact me.

91 points by simonpure 6y ago

bzb6 6y ago

Why haven’t they considered using other captcha solution?

As someone that hasn't had to use any captcha services, does an alternate like hCaptcha not have feature parity with reCaptcha?

ve55 6y ago
On the surface it does, but many more users will have to complete the captcha, since they cannot judge your 'humanness' by your Google cookies+account. Although I like services like hCaptcha a lot more myself, it may be possible that this notably bothers users and decreases conversion rates.
- feanaro 6y ago
  I don't have a Google account, I fanatically block Google's tracking and I still usually don't see captchas. For this reason, I don't think this holds.
  - seniorivn 6y ago
    depends on where do you live
  - intellirogue 6y ago
    On the other hand I do have a Google account but block tracking, and I have to do about 6 rounds of reCAPTCHA every time. So either you're in a country that Google has decided is "good" (i'm in Germany), or you're not blocking Google's tracking as well as you think.
    - feanaro 6y ago
      That's interesting. Without disclosing my location, let's just say I'm in a much less powerful (and hence, I would imagine, less reputable) country than Germany. I doubt it is in the "good" set, but who knows. I also doubt I'm not blocking it well enough. I'm running Firefox with CanvasBlocker, uBlock Origin (with strict rulesets) and uMatrix. I also turn on restrictFingerprinting.
  - BlueTemplar 6y ago
    How do you manage ? These days it seems like almost every website where you have to make an account requires reCAPTCHA... (I'm using uMatrix too, but this doesn't solve the issue that if I don't allow reCAPTCHA, I'm stuck on the first step of account creation…)
daveoc64 6y ago
Its approach to accessibility is terrible. https://dashboard.hcaptcha.com/signup?type=accessibility https://dashboard.hcaptcha.com/signup?type=accessibility As a user that can't answer the challenges, you have to register with hCaptcha in advance of using the website you want to. This lets you bypass the verification checks for a while. The discoverability of this is poor
- lrvick 6y ago
  And throws privacy out the window.
miyuru 6y ago
hCaptcha does not have IPv6 support. It breaks the web, when trying IPv6 only.
whatsmyusername 6y ago
Sooooo hcaptcha is way more aggressive. Like when it first went into cloudflare it made browsing the web miserable. They've since seemed to put a lot of work into it. To the point where I don't notice it anymore. They're iterating, and that's what I want to see.

sofixa 6y ago

Out of the loop, didn't know reCAPTCHA became paid. After a quick Google search I can only see that the Enterprise version is paid,but v3 isn't. Can one still use v3 and not pay for Enterprise?

GlitchMr 6y ago
reCAPTCHA v3 has 1000000 calls per month limit, after that for commercial purposes you need to migrate to reCAPTCHA Enterprise.
- octoberfranklin 6y ago
  So can I boot lame websites out of the free tier by making 1000000 bot requests to the captcha page? Or does Google only count successful human detections towards the 1000000-request limit?
  - deleted 6y ago
    [deleted]
  - a_imho 6y ago
    I would not shed any tears for sites which abuse users with recaptcha.

ffpip 6y ago

Guess they got tired of training their AI for free. Started charging now

Contax 6y ago
> Started charging now So... a web/company has to pay Google for the service... while the company's users/visitors will still do free AI training for Google? If that is how it works, that's some bold business plan (money on top of free labor).

akalsz 6y ago

> reCAPTCHA > anonymous Pick one. reCAPTCHA is based on tracking users in countless unknown ways, which is why it's basically unusable with any kind of known proxy (i.e. Google usually classifies Tor users or users from 3rd world countries as bots by default). It may be stopping "dark web hackers", exactly because it's unsolvable by anyone Google decides to be a potential threat, and that also includes bots. Honestly, I feel like everyone would be better off if instead of reCAPTCHA, websites just used some service that automatically blocks proxies. That way you aren't getting Google to track legit users, and still forbidding potential users from joining who would otherwise be blocked by reCAPTCHA. And maybe if Google isn't watching me on your website, perhaps I'll be more inclined to visit you from my actual IP. Or just use something that is actually solvable by humans, like hCaptcha. Cloudflare did that and it's wonderful (well, compared to reCAPTCHA), I can solve it in a few seconds, unlike reCAPTCHA which I can keep clicking on for countless minutes only to get told that "my network is sending too many requests" or something.

arbol 6y ago
I also can't get through Google recaptcha. Proxy services rotate their up blocks so you can't simply block them all. Captchas are in their infancy. We need to move beyond something that involves simply clicking to identify images - we're providing free training for AI, not to mention the fact that it's incredibly inconvenient for blind people. I think a measure of uniqueness is required based answers to questions that don't necessarily have correct answers. The distance between the question and answer would be the measure. Identifying questions that provide consistent distances for individuals would be the hard thing.
- throwaway3699 6y ago
  Captcha have audio versions for the blind, no?
  - y7 6y ago
    They're usually inaccessible if the system already suspects you of being a bot.

tleb_ 6y ago

It troubles me how a company can say in the same post that it respects user privacy and used Google reCAPTCHA. It's not only about what you collect, it's also about what third-party services collect. Otherwise the magic solution to respecting user privacy would be using a back-end as a service (e.g. Firebase). I might try navigating the web while blocking reCAPTCHA. How limited would my reach be? And what about blocking CloudFlare's solution?

CGamesPlay 6y ago

Charging for reCAPTCHA, and even removing the free tier, seems like a good win for consumers. By having a non-zero price tag, companies are forced to actually attach a monetary value to the service, which will discourage them from using it so frivolously. As it stands today, reCAPTCHA costs consumers both privacy and time, and costs the companies nothing.

octoberfranklin 6y ago
Yeah the amount of website laziness that reCAPTCHA has prompted is ridiculous. Guess what, folks, every visit to your website involves some mix of humans and software. Nobody uses the web without a browser, and every browser was written by a human. You aren't entitled to make hair-splitting distinctions and dump the enforcement burden on the public.
swebs 6y ago
>As it stands today, reCAPTCHA costs consumers both privacy and time Also it forces users to perform unpaid labor for Google.
dheera 6y ago
Why not simply just not differentiate between humans and bots, and enforce a usage policy that works for your business? You don't want them scraping 1000 articles an hour? Just put a limit on viewing 20 articles an hour, no need to differentiate between human and robot. The boundary between humans and robots will blur over the next few centuries. At some point it will just be a spectrum from all-inorganic to mixed to all-organic beings that roam the planet. We might as well prepare for that future by abolishing chemistryism (discrimination against organic vs. inorganic chemistry of a being) today. (Yes this sounds stupid, but 200 years ago, abolishing racism sounded stupid too.)
- marcinzm 6y ago
  Limit by what? IP? Bots are distributed across IPs while certain users share IPs (NAT, universities, etc.). Cookie? Bots won't store cookies. Overall? Then human users will be blocked outright if there's enough bots.

02020202 6y ago

fuck recaptcha and all websites that make it impossible to use without it. the state of current things is insane. i can't even talk with the government or pay some bills without letting google spy on me. this is ridiculous.

Contax 6y ago
I feel your pain. Google is cancer for the web. And it should be illegal for sites to require third-parties you want no business with, at the very least for public or utility sites.

fab1an 6y ago

Consider hCaptcha - it's basically a superset of reCAPTCHA's functionality, but much more privacy-friendly and more affordable at scale. Also, it lets anyone label their data on it, not just Google. Full disclosure, I work with their excellent team.

milankragujevic 6y ago
Just wanted to thank you for mentioninf hCaptcha. I had tried it some time before but IIRC it was either invite-only or enterprise-only or had some "size" requirements. Just saw that it's available for all. Thank you!
lrvick 6y ago
Cloudflare/hcaptcha are the bane of my existence. Privacypass itself is a privacy violation and not available on most browsers and I don't want to spend an half hour a day doing free labor training someone else's AI to just use the internet anonymously.
- gruez 6y ago
  Privacypass itself is a privacy violation and not available on most browsers what? https://support.cloudflare.com/hc/en-us/articles/115001992652-Using-Privacy-Pass-with-Cloudflare https://support.cloudflare.com/hc/en-us/articles/11500199265... It has addons for firefox and chrome, which makes up 90+% (by market share) of the browsers out there.
  - hundchenkatze 6y ago
    It's still a privacy violation. This add-on needs to: Access browser tabs Access browser activity during navigation Access your data for all websites
- whatsmyusername 6y ago
  Cloudflare was a blessing for us. It's an incredible service for the price. Business tier (we needed custom certs) + advanced ssl is like $220/month and you get a WAF, a world class cdn, and DDOS protection.

qertoip 6y ago

The only long term solution is to request anonymous users to commit a tiny amount of cryptocurrency. If you don't want to deal with cryptocurrency then this could be simply a provable burn - purely an IT thing with no accounting team involved.

beagle3 6y ago
Bitcoin is pseudonymous, NOT anonymous, and is often easy to connect to a real identity (and there’s already legal action against tumblers, etc, that would make it even more so) Monero and ZCash supposedly offer real anonymity, but IIRC all implementations so far have been found vulnerable to (at least partial) deanonymization. Crypto currencies may have good uses, but so far, anonymity is not one of them - most definitely not for the masses (and hard-to-impossible for the very disciplined and knowledgeable pros)
- qertoip 6y ago
  We are talking about relative anonymity against specific service provider and not necessarily absolute anonymity when the government descends upon you. VPN or proxy users are not really anonymous anyway and would certainly welcome an option to pay $0.1 in cryptocurrency instead of fighting infuriating CAPTCHA-s all the time.
  - rightbyte 6y ago
    Captchas for website access (not signups etc) seem to be mostly about preventing scrapers that are not from major companies and spying ofcourse. I don't see how they are in the interest of the site owner. It is just an annoying default for no fee caching/CDN by Cloudflare etc. If I would have to pay 10c to visit a website I would like it to "burn up". Most websites I visit I don't support in any sense.
  - beagle3 6y ago
    But it's not even relative anonymity. It's psudeonimity. It's a completely different thing we are not used to dealing with. Unless you actively try to hide your tracks, every single transaction you make is related. You may pay your friend at work $5 back for coffee using Bitcoin -- and at that second -- since he knows your wallet id -- he can check the blockchain for every transaction your wallet has ever participated in - every website you paid for (as a captcha, as a registration fee for that totally-legal-but-morally-questionable site, the money you contributed to support/oppose a political cause, etc.) This is NOT paranoia. People who aren't the NSA are constantly analyzing and making public identities related to wallets and transactions they made. Psudonimity is not anonymity - it's one step away from being an identity; and the fact that the blockchain is public makes all history public for an identity once that step was taken. Take cash from ATM. Put in wallet. Use cash in wallet to pay for drugs. Use cash from same ATM from same wallet to donate to church. Only NSA/FBI has the means to track this, and they have to work for it. Put money in bitcoin wallet. Use wallet to pay for drugs. Use same wallet to donate to church. Now church knows you paid for drugs, and your dealer knows which church you contribute to. Brandan Eich was forced to resign because of his political beliefs, as evidenced by his monetary contribution to some political cause[0]. If pseudonymous blockchain payments become mainstream, such events are going to become an everyday occurrence. For some things, that's a net positive for society (you want to know who the hypocrite politicians are). For some things, it's a net negative (losing privacy for individua). [0] I'm tryting to word this as neutrally as possible.

shuringai 6y ago

just use hcaptcha. even cloudflare switched to it

pdkl95 6y ago

reCAPTCHA won't even try to work if your UserAgent isn't on Google's short list[1] of supported browsers. If they don't like your browser, the reCAPTCHA widget simply gives up with a fatal error[2]. Any new browser, browser variant, or browser-like tool cannot access any website that requires reCAPTCHA. Same for anyone obscuring their UserAgent or using an older browser for any reason. reCAPTCHA is de facto restriction against any new competition in the browser market. [1] https://support.google.com/recaptcha/answer/6223828?hl=en https://support.google.com/recaptcha/answer/6223828?hl=en [2] https://user-images.githubusercontent.com/20207154/29577170-264e4872-8788-11e7-8b77-5d272b0c2f80.png https://user-images.githubusercontent.com/20207154/29577170-...

GoblinSlayer 6y ago
UserAgent variability is a bug anyway. Apple was right when tried to freeze it. It shouldn't affect browser market, because browser is a user-facing tool, UserAgent isn't.

known 6y ago

ReCAPTCHA has forced me to use https://www.qwant.com/ https://www.qwant.com/ as my default search engine in tor browser

protoduction 6y ago

I built FriendlyCaptcha [1], it's a proof of work based alternative to reCaptcha that is accessible. While it's not the perfect captcha either (which I think is impossible), it makes a better tradeoff in terms of UX, price and privacy. [1]: https://friendlycaptcha.com https://friendlycaptcha.com

bo1024 6y ago
I think this is a great solution! I have been thinking over the problems with captchas and also came to the conclusion that a proof-of-work puzzle is a fair, private, and hopefully-effective solution. You can look around for "useful" work, similar to how recaptcha was originally about transcription. If you can find some problems of the right difficulty that people want solved (e.g. I dunno, protein folding or something), then the electricity isn't wasted and you might even be able to sell the solutions.
- gruez 6y ago
  AFAIK there used to be a service that did exactly that - it used cpu cycles to mine cryptocurrencies.
  - Forbo 6y ago
    There's a few like that, Golem and Gridcoin are the two that immediately come to mind for me. Gridcoin uses the Berkeley Open Infrastructure for Network Computing (BOINC).
gruez 6y ago
>The problem with other CAPTCHAs > It's broken >Tasks that are easy for all humans but difficult for computers may no longer exist. >Using machine learning or even browser plugins one can solve ReCAPTCHA in under a second. There are even CAPTCHA solving companies that offer thousands of solves for $1. This is probably a bad argument when your proof of work captcha can be solved for much cheaper. Your site says "Solving it will take a few seconds on a desktop computer", which I'll interpret as 5 seconds. The spot price for a c5a.2xlarge instance (8 thread zen2 CPU) is 21.6 cents/hr. That works out to 0.03 cents per solve, an order of magnitude less than the 0.1 cents per solve for commercial recaptcha solving services. It probably gets even cheaper if you get your compute through non-cloud providers, or through GPUs.

whywhywhywhy 6y ago

For a system designed to weed out bots, whomever lead the redesign of reCAPTCHA to the crossing and traffic light identification unpaid labour system had nothing but utter contempt for humans and their time. I actually can't think of another user interaction I've had with a computer that had less respect for me as a person.

swiley 6y ago

Having to use recaptcha just to download minecraft has to be one of the biggest things that has completely pissed me off about it being sold to Microsoft.

modzu 6y ago

false dichotomy!!!

typenil 6y ago

I'm happy to hear Google is charging for ReCAPTCHA. I hope they make it completely unaffordable and get rid of any free tier. Any disincentive for sites to force users to train AI for Google is a good thing. Every time I run into it, it makes me hate the site I'm on. Google punishes my crimes of Firefox use and not being logged into Google by giving challenge after challenge - along with those infuriating "slow fade in" images to take bigger bites out of my day. The world would be better off without ReCAPTCHA.

mtmail 6y ago
And it also opens the chance for innovative (or not) competition. Hard to compete with a free Google service.

mdifrgechd 6y ago

For most low value sites e.g. inc.com type random news that ask me to sign up to continue, I just dont use them, because the value they provide is lower than how I value creating an account. The same is true for recaptcha, I usually just don't use a site if they make me use it. I have stopped donating to charities because they use recaptcha and would never buy from an online store that uses it. The same as I would never go to a bar where you are searched on the way in, or buy a pizza from a place with a central call center that makes me wait to make an order. If a business wants to treat me like shit, I just wont use it.

luord 6y ago

This reminds me that I've got to remove recaptcha from the contact form in my website. I rarely get contacted so I wouldn't have to pay any time soon, but I want to remove all third party services from my site anyway and I have to find a way to prevent spam that would nevertheless be less annoying for someone who would actually want to contact me.