7 ms·

Don't get me started on how infuriating Google's ReCaptchas are on Tor Browser. Buster captcha solver fails immediately. And when you do actually manually solv

Don't get me started on how infuriating Google's ReCaptchas are on Tor Browser. Buster captcha solver fails immediately. And when you do actually manually solve the captcha correctly, sometimes Google still thinks you're a robot. And sometimes it asks me to select all "bicycles" in the images and there are NO GODDAMN BICYCLES in any of the images whatsover. So I hit Skip and eventually google thinks I'm a robot. Everybody please either switch to hcaptcha or..., although I've not seen a website use this yet, upgrade to ReCaptcha v3 maybe? I read somewhere that ReCaptcha v3 is far less annoying than v2? Is that true?

maxgashkov 6y ago
Don't get me started on hCaptcha! I've spent good 5 minutes yesterday trying to guess what the 'boat' is and is not according to its moderators.
- ghayes 6y ago
  hCaptcha, for me, has such weird angles of objects, like a boat cropped to just the hull. Makes it super easy to pass over correct answers.
rahidz 6y ago
It seems like Google punishing you for taking actions to increase your privacy, which not-so-coincidentally reduces the data they're able to hoover up from you.
- arp242 6y ago
  That's just silly; it's well known that Tor nodes are widely abused by spam bots. Google is "punishing" known sources of spam. When I ran a forum many Tor nodes ended up being outright blocked, since there was so much spam coming from them.
  - ev1 6y ago
    I'm not sure how to feel about this. I run Tor relays to support the network, but at the same time having moderated a forum that received tens of thousands of signups per day over Tor and NordVPN and PIA, all of which were able to verify email via various domains,, all of which were for spam...
    - arp242 6y ago
      It's not like I intentionally targetted Tor relays or anything, we just targetted source of spam, which ended up being a lot of Tor relays. Because we were (and actually, still are) running a rather outdated version of vBulletin (upgrading is difficult) things were getting pretty dire if we didn't do ... something.
StavrosK 6y ago
It's just that the classification gap between human and computer is closing, so now computers are better than a good percentage of humans, which means that there's a chunk of humans that now cannot conclusively prove they aren't bots.
- rcxdude 6y ago
  I suspect there's no way to pass some of recaptcha's challenges, they appear to work like a tarpit.
1f60c 6y ago
> upgrade to ReCaptcha v3 maybe? Funny you should say that. reCAPTCHA v3 is meant to be invisible, watching the behavior of a user in the background, and then returning a score between 0.0 and 1.0 for the website to do with as they please.
- DarkWiiPlayer 6y ago
  so if you don't pass, say, by using TOR or even just a VPN, you don't even get a chance to prove you're not a bot? Cool, really cool, I can't see that being illegal at all. EDIT: This comment is stupidly worded, please see clarification below.
  - 1f60c 6y ago
    Why would it be illegal? Being able to access a website (be it Twitter, Hacker News, or your hometown newspaper) is a privilege, not a right.
    - DarkWiiPlayer 6y ago
      My comment was poorly phrased. My point is that this can quickly lead to legal problems, when such a captcha restricts your access to something you do have a legal right to. Say I buy a new phone and it stops working after 3 weeks. I want to contact the seller, but they only have a web contact form and I fail to get past the captcha. This is already getting very close to being a huge legal problem, and the only reason why it's probably not that bad is that technically that website is supposed to give at least a contact address so I could just send them a letter which, while hugely inconvenient, is legally still a good enough way for me to contact them. I'm sure if you spend a while longer you could find a few cases where the problem is even worse (also considering more than just one legal system). So what I should have said: Using this technology to block users from the wrong endpoints could end up being illegal. For context: I'm talking German laws here.
      - judge2020 6y ago
        It's definitely a problem regarding government sites - the UK even has a page advising their own government agencies to not rely on them unless absolutely necessary[0]. US government sites have simply resorted to putting everything behind a login wall and verifying identity, such as is the case for ssa.gov and healthcare.gov, or just not caring and letting spammers do whatever they'd like (typical for local-level governments). 0: https://www.gov.uk/service-manual/technology/using-captchas https://www.gov.uk/service-manual/technology/using-captchas
fctorial 6y ago
So they fingerprint you based on your interaction with captcha if you're using tor.
rcxdude 6y ago
I'm pretty sure recatcha has a punitive/tarpit mode where it had already decided to reject you but just gives a series of slow tests which it will never pass you on anyway.
blueblisters 6y ago
ReCaptcha v3 is basically a means for Google to let the site owner take the blame for bad UX patterns while still getting browsing data from much of the web.

maxgashkov 6y ago

Don't get me started on hCaptcha! I've spent good 5 minutes yesterday trying to guess what the 'boat' is and is not according to its moderators.

ghayes 6y ago
hCaptcha, for me, has such weird angles of objects, like a boat cropped to just the hull. Makes it super easy to pass over correct answers.

rahidz 6y ago

It seems like Google punishing you for taking actions to increase your privacy, which not-so-coincidentally reduces the data they're able to hoover up from you.

arp242 6y ago
That's just silly; it's well known that Tor nodes are widely abused by spam bots. Google is "punishing" known sources of spam. When I ran a forum many Tor nodes ended up being outright blocked, since there was so much spam coming from them.
- ev1 6y ago
  I'm not sure how to feel about this. I run Tor relays to support the network, but at the same time having moderated a forum that received tens of thousands of signups per day over Tor and NordVPN and PIA, all of which were able to verify email via various domains,, all of which were for spam...
  - arp242 6y ago
    It's not like I intentionally targetted Tor relays or anything, we just targetted source of spam, which ended up being a lot of Tor relays. Because we were (and actually, still are) running a rather outdated version of vBulletin (upgrading is difficult) things were getting pretty dire if we didn't do ... something.

StavrosK 6y ago

It's just that the classification gap between human and computer is closing, so now computers are better than a good percentage of humans, which means that there's a chunk of humans that now cannot conclusively prove they aren't bots.

rcxdude 6y ago
I suspect there's no way to pass some of recaptcha's challenges, they appear to work like a tarpit.

1f60c 6y ago

> upgrade to ReCaptcha v3 maybe? Funny you should say that. reCAPTCHA v3 is meant to be invisible, watching the behavior of a user in the background, and then returning a score between 0.0 and 1.0 for the website to do with as they please.

DarkWiiPlayer 6y ago
so if you don't pass, say, by using TOR or even just a VPN, you don't even get a chance to prove you're not a bot? Cool, really cool, I can't see that being illegal at all. EDIT: This comment is stupidly worded, please see clarification below.
- 1f60c 6y ago
  Why would it be illegal? Being able to access a website (be it Twitter, Hacker News, or your hometown newspaper) is a privilege, not a right.
  - DarkWiiPlayer 6y ago
    My comment was poorly phrased. My point is that this can quickly lead to legal problems, when such a captcha restricts your access to something you do have a legal right to. Say I buy a new phone and it stops working after 3 weeks. I want to contact the seller, but they only have a web contact form and I fail to get past the captcha. This is already getting very close to being a huge legal problem, and the only reason why it's probably not that bad is that technically that website is supposed to give at least a contact address so I could just send them a letter which, while hugely inconvenient, is legally still a good enough way for me to contact them. I'm sure if you spend a while longer you could find a few cases where the problem is even worse (also considering more than just one legal system). So what I should have said: Using this technology to block users from the wrong endpoints could end up being illegal. For context: I'm talking German laws here.
    - judge2020 6y ago
      It's definitely a problem regarding government sites - the UK even has a page advising their own government agencies to not rely on them unless absolutely necessary[0]. US government sites have simply resorted to putting everything behind a login wall and verifying identity, such as is the case for ssa.gov and healthcare.gov, or just not caring and letting spammers do whatever they'd like (typical for local-level governments). 0: https://www.gov.uk/service-manual/technology/using-captchas https://www.gov.uk/service-manual/technology/using-captchas

fctorial 6y ago

So they fingerprint you based on your interaction with captcha if you're using tor.

rcxdude 6y ago

I'm pretty sure recatcha has a punitive/tarpit mode where it had already decided to reject you but just gives a series of slow tests which it will never pass you on anyway.

blueblisters 6y ago

ReCaptcha v3 is basically a means for Google to let the site owner take the blame for bad UX patterns while still getting browsing data from much of the web.