6 ms·

> reCAPTCHA > anonymous Pick one. reCAPTCHA is based on tracking users in countless unknown ways, which is why it's basically unusable with any kind of known

by akalsz 6y ago

> reCAPTCHA > anonymous Pick one. reCAPTCHA is based on tracking users in countless unknown ways, which is why it's basically unusable with any kind of known proxy (i.e. Google usually classifies Tor users or users from 3rd world countries as bots by default). It may be stopping "dark web hackers", exactly because it's unsolvable by anyone Google decides to be a potential threat, and that also includes bots. Honestly, I feel like everyone would be better off if instead of reCAPTCHA, websites just used some service that automatically blocks proxies. That way you aren't getting Google to track legit users, and still forbidding potential users from joining who would otherwise be blocked by reCAPTCHA. And maybe if Google isn't watching me on your website, perhaps I'll be more inclined to visit you from my actual IP. Or just use something that is actually solvable by humans, like hCaptcha. Cloudflare did that and it's wonderful (well, compared to reCAPTCHA), I can solve it in a few seconds, unlike reCAPTCHA which I can keep clicking on for countless minutes only to get told that "my network is sending too many requests" or something.

arbol 6y ago
I also can't get through Google recaptcha. Proxy services rotate their up blocks so you can't simply block them all. Captchas are in their infancy. We need to move beyond something that involves simply clicking to identify images - we're providing free training for AI, not to mention the fact that it's incredibly inconvenient for blind people. I think a measure of uniqueness is required based answers to questions that don't necessarily have correct answers. The distance between the question and answer would be the measure. Identifying questions that provide consistent distances for individuals would be the hard thing.
- throwaway3699 6y ago
  Captcha have audio versions for the blind, no?
  - y7 6y ago
    They're usually inaccessible if the system already suspects you of being a bot.
  - akalsz 6y ago
    Yes, and it's absolutely solvable by bots (there's even a browser plugin for it[1]) so it isn't available if Google decides you are one. But it does work if you aren't that suspicious, so most of the time it should let blind users through. Well it's a bit more complicated because there are scores and such, but from an end-user perspective that's how it usually works. Though if you aren't considered suspicious, image captchas are way less ridiculous, too. The scoring system goes all the way from .1 to .9, but usually you're either in one or the other category based on who knows what (probably mostly ip addresses, but Google doesn't tell us so who knows?). So in the end the service is mostly just something that arbitrarily classifies users as one or the other, bots can absolutely solve them when classified as "probably human" and they're impossible for humans when classified as "probably bot". If you want to actually present users a challenge to verify they're human, you're even better off giving them something like captchouli[2], or just a good old scrambled letters on a picture thing (which is what Google uses for their login as well, BTW). hCaptcha is also a great alternative (anything is, really) since it's still mostly about classifying users by making suspicious ones solve challenges. reCAPTCHA is absolutely not, it judges you before the challenge. And that's fine, some websites want that. It's their choice, I'm not mad if they ban me for not wanting to be tracked, it's probably for the better. What does make me angry is that reCAPTCHA is advertised falsely, that the challenge is a joke and a crime against humanity at once, and that despite that, people seem to believe that it's the challenge that is magically blocking the bots without realizing they're also blocking legitimate users. [1]: https://github.com/dessant/buster https://github.com/dessant/buster [2]: https://github.com/bakape/captchouli https://github.com/bakape/captchouli
    - arbol 6y ago
      I like the idea of captchouli as it plays on the weaknesses of ML in differentiating between similar images. However, I still think advances in AI will force us to go further and use philosophical/psychological based captchas instead of pattern matching.
      - Fnoord 6y ago
        I wouldn't be able to solve the example captcha. I've liked a few anime. GITS, Death Note, I believe that's about it. I would need to search for the solution. Now, you may argue that is no problem for visitors of an anime board, but I believe its going to scare new visitors away. Due to this, websites would be less inclusive. My guess about the future path is as follows: your government ID allows you to authenticate to generate a keypair you can use online for services such as Google and Facebook. It would include things such as a nickname, and an e-mail address as a derived public/private keypair you are able to use, including a scope (domain). Then, only such authenticated logins get full access (they are not going to phase this in like a wrecking ball, it would be slowly). Its perhaps a tad dystopian, but it has its pros and cons, and websites like GAB will continue to exist on darknet.
  - miki123211 6y ago
    for the english-speaking and not hard-of-hearing part of the blind population, yes. And the english speaking part is a pretty small one.
qertoip 6y ago
Tor/VPN/proxy users are legit users, for fucks sake.
- akalsz 6y ago
  They can't be distinguished from bots with tracking, and tracking is pretty much all v3 does. Google doesn't seem to care about collateral damage, I suppose it's the "why use VPNs/proxies if you have nothing to hide" mindset.
  - lrvick 6y ago
    Maybe because not all countries function like yours. Maybe they are studying security in a country where that is considered illegal hacking. Maybe not everyone wants their data sold to parties that sell the ability to manipulate them to the highest bidder. Honestly people that even think about blocking Tor reek of privilege and an assumption that they are above being manipulated by well trained AI fed a lot of their data. Personally I use Tor on most devices and refuse to use sites that block it.
  - mindslight 6y ago
    ReCAPTCHA demonstrates exactly what we all have to hide - being pervasively tracked by surveillance companies such as Google. My only browsing activity that exits from my direct ISP's IP is my online banking VM, and that's only because one site got insistent about hard blocking everything else. These companies don't understand that they're screwing over real customers with this crap. It's especially galling when my long lived static IP VPS exit [0] gets hassled. It's clear there isn't abusive usage from this IP, since I control it. I've had it for years, so it doesn't have a bad reputation. Yet these sites still want to fuck with me for their snake oil. [0] Which doesn't win any awards for nym rotation, but at least hides my location and disassociates activity from my direct ISP IP.
  - GoblinSlayer 6y ago
    >why use VPNs/proxies if you have nothing to hide https://www.bbc.com/news/technology-50150981 https://www.bbc.com/news/technology-50150981
y7 6y ago
> Honestly, I feel like everyone would be better off if instead of reCAPTCHA, websites just used some service that automatically blocks proxies. That's even worse than reCAPTCHA. At least as a human using Tor you have some shot at solving a captcha, even though you usually have to try 5 times or move to a different end node.
- 0xdeadb00f 6y ago
  I've been caught in captcha loops before. It will flat out refuse to let me in and I will solve captcha after captcha after captcha. This has happened to me when using Tor, being prompted by that annoying Cloudflare "Attention Required!" page both when they were using reCaptcha AND when they more recently switched to hCaptcha. It would have saved me quite a lot of time if those sites had just flat out said "403 Forbidden".
ClawsOnPaws 6y ago
Their accessibility mode is "Give us your email and we'll probably think you're a human for a while... until we don't and make you use privacy pass... until we take away your tokens because yeah you're absolutely a bot.". yeah... no. Absolutely not. Also that thing doesn't work with incognito, nor vpn's/tor/whatever. I've stopped trying to bother with numerous sites, all running behind Cloudflare, for exactly this reason.
BlueTemplar 6y ago
> Cloudflare I'm starting to think that Cloudflare is even worse than the GAFAMs, due to its impact on so many of the other websites : https://www.gigablast.com/blog.html https://www.gigablast.com/blog.html (If it can even be separated from them, considering that Cloudflare has received up to $110M from Microsoft, Google and Baidu !! https://techcrunch.com/2015/09/22/cloudflare-locks-down-110m-from-fidelity-microsoft-google-baidu-and-qualcomm/ https://techcrunch.com/2015/09/22/cloudflare-locks-down-110m...

by akalsz 6y ago

arbol 6y ago

I also can't get through Google recaptcha. Proxy services rotate their up blocks so you can't simply block them all. Captchas are in their infancy. We need to move beyond something that involves simply clicking to identify images - we're providing free training for AI, not to mention the fact that it's incredibly inconvenient for blind people. I think a measure of uniqueness is required based answers to questions that don't necessarily have correct answers. The distance between the question and answer would be the measure. Identifying questions that provide consistent distances for individuals would be the hard thing.

throwaway3699 6y ago
Captcha have audio versions for the blind, no?
- y7 6y ago
  They're usually inaccessible if the system already suspects you of being a bot.
- akalsz 6y ago
  Yes, and it's absolutely solvable by bots (there's even a browser plugin for it[1]) so it isn't available if Google decides you are one. But it does work if you aren't that suspicious, so most of the time it should let blind users through. Well it's a bit more complicated because there are scores and such, but from an end-user perspective that's how it usually works. Though if you aren't considered suspicious, image captchas are way less ridiculous, too. The scoring system goes all the way from .1 to .9, but usually you're either in one or the other category based on who knows what (probably mostly ip addresses, but Google doesn't tell us so who knows?). So in the end the service is mostly just something that arbitrarily classifies users as one or the other, bots can absolutely solve them when classified as "probably human" and they're impossible for humans when classified as "probably bot". If you want to actually present users a challenge to verify they're human, you're even better off giving them something like captchouli[2], or just a good old scrambled letters on a picture thing (which is what Google uses for their login as well, BTW). hCaptcha is also a great alternative (anything is, really) since it's still mostly about classifying users by making suspicious ones solve challenges. reCAPTCHA is absolutely not, it judges you before the challenge. And that's fine, some websites want that. It's their choice, I'm not mad if they ban me for not wanting to be tracked, it's probably for the better. What does make me angry is that reCAPTCHA is advertised falsely, that the challenge is a joke and a crime against humanity at once, and that despite that, people seem to believe that it's the challenge that is magically blocking the bots without realizing they're also blocking legitimate users. [1]: https://github.com/dessant/buster https://github.com/dessant/buster [2]: https://github.com/bakape/captchouli https://github.com/bakape/captchouli
  - arbol 6y ago
    I like the idea of captchouli as it plays on the weaknesses of ML in differentiating between similar images. However, I still think advances in AI will force us to go further and use philosophical/psychological based captchas instead of pattern matching.
    - Fnoord 6y ago
      I wouldn't be able to solve the example captcha. I've liked a few anime. GITS, Death Note, I believe that's about it. I would need to search for the solution. Now, you may argue that is no problem for visitors of an anime board, but I believe its going to scare new visitors away. Due to this, websites would be less inclusive. My guess about the future path is as follows: your government ID allows you to authenticate to generate a keypair you can use online for services such as Google and Facebook. It would include things such as a nickname, and an e-mail address as a derived public/private keypair you are able to use, including a scope (domain). Then, only such authenticated logins get full access (they are not going to phase this in like a wrecking ball, it would be slowly). Its perhaps a tad dystopian, but it has its pros and cons, and websites like GAB will continue to exist on darknet.
- miki123211 6y ago
  for the english-speaking and not hard-of-hearing part of the blind population, yes. And the english speaking part is a pretty small one.

qertoip 6y ago

Tor/VPN/proxy users are legit users, for fucks sake.

akalsz 6y ago
They can't be distinguished from bots with tracking, and tracking is pretty much all v3 does. Google doesn't seem to care about collateral damage, I suppose it's the "why use VPNs/proxies if you have nothing to hide" mindset.
- lrvick 6y ago
  Maybe because not all countries function like yours. Maybe they are studying security in a country where that is considered illegal hacking. Maybe not everyone wants their data sold to parties that sell the ability to manipulate them to the highest bidder. Honestly people that even think about blocking Tor reek of privilege and an assumption that they are above being manipulated by well trained AI fed a lot of their data. Personally I use Tor on most devices and refuse to use sites that block it.
- mindslight 6y ago
  ReCAPTCHA demonstrates exactly what we all have to hide - being pervasively tracked by surveillance companies such as Google. My only browsing activity that exits from my direct ISP's IP is my online banking VM, and that's only because one site got insistent about hard blocking everything else. These companies don't understand that they're screwing over real customers with this crap. It's especially galling when my long lived static IP VPS exit [0] gets hassled. It's clear there isn't abusive usage from this IP, since I control it. I've had it for years, so it doesn't have a bad reputation. Yet these sites still want to fuck with me for their snake oil. [0] Which doesn't win any awards for nym rotation, but at least hides my location and disassociates activity from my direct ISP IP.
- GoblinSlayer 6y ago
  >why use VPNs/proxies if you have nothing to hide https://www.bbc.com/news/technology-50150981 https://www.bbc.com/news/technology-50150981

y7 6y ago

> Honestly, I feel like everyone would be better off if instead of reCAPTCHA, websites just used some service that automatically blocks proxies. That's even worse than reCAPTCHA. At least as a human using Tor you have some shot at solving a captcha, even though you usually have to try 5 times or move to a different end node.

0xdeadb00f 6y ago
I've been caught in captcha loops before. It will flat out refuse to let me in and I will solve captcha after captcha after captcha. This has happened to me when using Tor, being prompted by that annoying Cloudflare "Attention Required!" page both when they were using reCaptcha AND when they more recently switched to hCaptcha. It would have saved me quite a lot of time if those sites had just flat out said "403 Forbidden".

ClawsOnPaws 6y ago

Their accessibility mode is "Give us your email and we'll probably think you're a human for a while... until we don't and make you use privacy pass... until we take away your tokens because yeah you're absolutely a bot.". yeah... no. Absolutely not. Also that thing doesn't work with incognito, nor vpn's/tor/whatever. I've stopped trying to bother with numerous sites, all running behind Cloudflare, for exactly this reason.

BlueTemplar 6y ago

> Cloudflare I'm starting to think that Cloudflare is even worse than the GAFAMs, due to its impact on so many of the other websites : https://www.gigablast.com/blog.html https://www.gigablast.com/blog.html (If it can even be separated from them, considering that Cloudflare has received up to $110M from Microsoft, Google and Baidu !! https://techcrunch.com/2015/09/22/cloudflare-locks-down-110m-from-fidelity-microsoft-google-baidu-and-qualcomm/ https://techcrunch.com/2015/09/22/cloudflare-locks-down-110m...