6 ms·

I understand the purpose of CAPTCHAs when used as a security measure, but recently it seems like there has been a huge proliferation of them in all sorts of ran

I understand the purpose of CAPTCHAs when used as a security measure, but recently it seems like there has been a huge proliferation of them in all sorts of random places and it’s becoming very annoying. Even Google has taken to occasionally popping up CAPTCHAs just so I can see search results! (“suspicious activity on your network” - I’m using a reputable, top-tier UK mobile provider) Is there grounds to legally challenge CAPTCHAs on the basis that they’re discriminatory? They must be a nightmare for those using assistive technologies, or who have forms of cognitive impairment.

cesarb 6y ago
> Even Google has taken to occasionally popping up CAPTCHAs just so I can see search results! The most annoying one for me recently has been stackoverflow. The most basic use of stackoverflow (other than arriving through a web search) is to use its own search bar to search for something. Every time I do so, it asks for a captcha. It would make some sense to ask for a captcha when asking or answering a question, but why ask for a captcha when searching? And it's always the first search after opening the browser (the browser is set up to clear cookies on close), so it's not some sort of rate limiting.
- smichel17 6y ago
  Yep, and this resulted in me just searching duckduckgo for the stackoverflow page I wanted to find, instead.
- paulryanrogers 6y ago
  Probably too stop automated abuse and reduce unnecessary searches. Search can be expensive.
- segfaultbuserr 6y ago
  Search is restricted because it's an expensive operation and prone to abuse. This practice is not just found at Stack Exchange, now GitHub doesn't even display the full code search result to visitors. The only option is to log in (if you are already an established SE/GitHub user and doesn't mind the web tracking)...
  - ric2b 6y ago
    Even if search is expensive you can just rate limit it, a captcha is a dumb solution.
Jestar342 6y ago
> (“suspicious activity on your network” - I’m using a reputable, top-tier UK mobile provider) So are a _lot_ of other people, for all kinds of purposes, including nefarious purposes.
- Reason077 6y ago
  Well, exactly. And of course the IP addresses are dynamic. So it seems a bit silly to treat a whole network as suspicious because someone on it (amongst thousands or millions) is doing something suspicious... I get the same thing on Wikipedia sometimes because someone, who at some point in the past had my randomly assigned IP address, once made some dodgy edits. (Solution: reboot router to get new IP address!) I suppose if we had static IPv6 addresses (each account always gets assigned the same IP) then this would be less of an issue.
  - Jestar342 6y ago
    That's the point though, it's not just someone doing it that has triggered their defences, it's many - most probably unwittlingly because of malware or even some of those cheap shitty games that mysteriously steal your battery and/or data allocation with unknown background processes. The point is thus: they are receiving enough bad traffic from that range to have determined they need to filter it somehow.
  - dosethree 6y ago
    Companies need to stop treating IPs or groups of IPs like identifiers. When I'm in my office, I can't access yelp. They blocked that ip range for some reason, maybe because of something we did. We block entire countries at work because we were getting a lot of DDOS from those countries and we don't do business their but it ends up blocking a lot of legit use cases and wasting a lot of time.
    - dvtrn 6y ago
      I worked at a company once that decided to add an entire range of IP addresses to their firewall’s deny list. Seems an executive had their personal home network pwned, and an unknown figure told him it was from a certain part of the world. Said executive made enough noise and put enough pressure on the network engineers to get it done without question or delay or...most critically..a reviewed and authorized change control ticket that would have caught what was about to happen Following Monday help desk was underwater triaging tickets from the entire office full of team members we had just denied from the corporate network, and customers who now couldn’t use our product at all.
flurdy 6y ago
I see a lot of captchas that I was missing now that I am using the temporary container plugin [1] Also for sites that I don't know why they need captchas... [1] https://addons.mozilla.org/en-US/firefox/addon/temporary-containers/ https://addons.mozilla.org/en-US/firefox/addon/temporary-con...
- salawat 6y ago
  That would be because they're trying to leverage browser fingerprinting, and you're screwing with the fingerprint. The sad thing is, if you're privacy conscious and don't play ball with the rest of the world, and actively mitigate these surveillance/data leaking mechanisms, you're assumed to be a malicious actor by corporate risk departments the world over. Welcome to the web. Give us your data, and enjoy being tracked.
  - Kalium 6y ago
    In a world where bot herders try to blend in with the crowd, and historically lots of them aren't great at it, you have to be careful about your choices. It's very easy to look like a bot by accident, and odds are pretty good that anyone who sticks out is likely to be a bot. Just like odds are quite good that any HTTP request coming through Tor is quite likely to be malicious. This is a pretty shitty scenario all around. It shouldn't have happened. It should never have come to this! That said, I've yet to see a better solution on offer for general-purpose low-effort anti-abuse purposes. People here on HN generally seem to either hate CAPTCHAs with the passion of a million blazing suns (but have nothing better to offer) or want everyone to use something strictly worse (like argon2 hashing).
tomxor 6y ago
> I’m using a reputable, top-tier UK mobile provider I'm in the UK too and have found that If you use any mobile internet provider, and have a browser configuration that dumps cookies etc on close, you will get a google captcha every - single - fucking - time... I just end up tunneling everything through sshuttle to one of my servers to save time, but these days you also get a bunch of websites blocking IP address blocks assigned to datacenters, so you can't win :( As far as I can tell all mobile internet IP addresses are black listed for google captcha - I assume because they are frequently rotated between users. I've found this to be the case for Three, EE, and O2 so far (been testing them all out to find the fastest because fixed line internet always sucks around here). I presume it's not the same on a smart phone mostly because people don't have such aggressive browser cache/cookie etc purging configured.
- chessmango 6y ago
  Pretty sure this is at least somewhat related to Carrier-Grade NAT[1]. Influx of connections from a single public IP shared by multiple public users = 'security concern'. Not to forgive the big tech giant of its inflexibility :P [1] https://en.wikipedia.org/wiki/Carrier-grade_NAT https://en.wikipedia.org/wiki/Carrier-grade_NAT
- mattlondon 6y ago
  Never happened to me in the UK with either Three or Vodafone with firefox with various privacy extensions (privacy badger, decentraleyes, unlock etc) Maybe something else you are doing?
holstvoogd 6y ago
That is because >50% of internet traffic is bots. Mostly BS marketing tools, ad conversion scams and quack-security 'scans' from my experience. Pretty sure the entire captcha proliferation is to reduce fake clicks in google ads. I've been working on ways to block bots from some websites I manage the hosting for. It is nearly impossible. I rate limit the hell out of most of the world and block a long list of fake user agents. Still like 40% of out traffic is bots. >'legally challenge CAPTCHAs' Probably not, depending on where you live etc. Here, in the netherlands only gov. websites are required to be accessible.
deleted 6y ago
[deleted]
smnrchrds 6y ago
> “suspicious activity on your network” - I’m using a reputable, top-tier UK mobile provider Same in Canada. WiFi is fine. Using the web when connected to cell data (from the second biggest mobile operator in the country) brings up CAPTCHA almost 100% of the time.
heavyset_go 6y ago
These companies are so determined to keep people from legally scraping their sites that they don't care that they're walking all over the ADA in doing so.

cesarb 6y ago

> Even Google has taken to occasionally popping up CAPTCHAs just so I can see search results! The most annoying one for me recently has been stackoverflow. The most basic use of stackoverflow (other than arriving through a web search) is to use its own search bar to search for something. Every time I do so, it asks for a captcha. It would make some sense to ask for a captcha when asking or answering a question, but why ask for a captcha when searching? And it's always the first search after opening the browser (the browser is set up to clear cookies on close), so it's not some sort of rate limiting.

smichel17 6y ago
Yep, and this resulted in me just searching duckduckgo for the stackoverflow page I wanted to find, instead.
paulryanrogers 6y ago
Probably too stop automated abuse and reduce unnecessary searches. Search can be expensive.
segfaultbuserr 6y ago
Search is restricted because it's an expensive operation and prone to abuse. This practice is not just found at Stack Exchange, now GitHub doesn't even display the full code search result to visitors. The only option is to log in (if you are already an established SE/GitHub user and doesn't mind the web tracking)...
- ric2b 6y ago
  Even if search is expensive you can just rate limit it, a captcha is a dumb solution.

Jestar342 6y ago

> (“suspicious activity on your network” - I’m using a reputable, top-tier UK mobile provider) So are a _lot_ of other people, for all kinds of purposes, including nefarious purposes.

Reason077 6y ago
Well, exactly. And of course the IP addresses are dynamic. So it seems a bit silly to treat a whole network as suspicious because someone on it (amongst thousands or millions) is doing something suspicious... I get the same thing on Wikipedia sometimes because someone, who at some point in the past had my randomly assigned IP address, once made some dodgy edits. (Solution: reboot router to get new IP address!) I suppose if we had static IPv6 addresses (each account always gets assigned the same IP) then this would be less of an issue.
- Jestar342 6y ago
  That's the point though, it's not just someone doing it that has triggered their defences, it's many - most probably unwittlingly because of malware or even some of those cheap shitty games that mysteriously steal your battery and/or data allocation with unknown background processes. The point is thus: they are receiving enough bad traffic from that range to have determined they need to filter it somehow.
- dosethree 6y ago
  Companies need to stop treating IPs or groups of IPs like identifiers. When I'm in my office, I can't access yelp. They blocked that ip range for some reason, maybe because of something we did. We block entire countries at work because we were getting a lot of DDOS from those countries and we don't do business their but it ends up blocking a lot of legit use cases and wasting a lot of time.
  - dvtrn 6y ago
    I worked at a company once that decided to add an entire range of IP addresses to their firewall’s deny list. Seems an executive had their personal home network pwned, and an unknown figure told him it was from a certain part of the world. Said executive made enough noise and put enough pressure on the network engineers to get it done without question or delay or...most critically..a reviewed and authorized change control ticket that would have caught what was about to happen Following Monday help desk was underwater triaging tickets from the entire office full of team members we had just denied from the corporate network, and customers who now couldn’t use our product at all.

flurdy 6y ago

I see a lot of captchas that I was missing now that I am using the temporary container plugin [1] Also for sites that I don't know why they need captchas... [1] https://addons.mozilla.org/en-US/firefox/addon/temporary-containers/ https://addons.mozilla.org/en-US/firefox/addon/temporary-con...

salawat 6y ago
That would be because they're trying to leverage browser fingerprinting, and you're screwing with the fingerprint. The sad thing is, if you're privacy conscious and don't play ball with the rest of the world, and actively mitigate these surveillance/data leaking mechanisms, you're assumed to be a malicious actor by corporate risk departments the world over. Welcome to the web. Give us your data, and enjoy being tracked.
- Kalium 6y ago
  In a world where bot herders try to blend in with the crowd, and historically lots of them aren't great at it, you have to be careful about your choices. It's very easy to look like a bot by accident, and odds are pretty good that anyone who sticks out is likely to be a bot. Just like odds are quite good that any HTTP request coming through Tor is quite likely to be malicious. This is a pretty shitty scenario all around. It shouldn't have happened. It should never have come to this! That said, I've yet to see a better solution on offer for general-purpose low-effort anti-abuse purposes. People here on HN generally seem to either hate CAPTCHAs with the passion of a million blazing suns (but have nothing better to offer) or want everyone to use something strictly worse (like argon2 hashing).

tomxor 6y ago

> I’m using a reputable, top-tier UK mobile provider I'm in the UK too and have found that If you use any mobile internet provider, and have a browser configuration that dumps cookies etc on close, you will get a google captcha every - single - fucking - time... I just end up tunneling everything through sshuttle to one of my servers to save time, but these days you also get a bunch of websites blocking IP address blocks assigned to datacenters, so you can't win :( As far as I can tell all mobile internet IP addresses are black listed for google captcha - I assume because they are frequently rotated between users. I've found this to be the case for Three, EE, and O2 so far (been testing them all out to find the fastest because fixed line internet always sucks around here). I presume it's not the same on a smart phone mostly because people don't have such aggressive browser cache/cookie etc purging configured.

chessmango 6y ago
Pretty sure this is at least somewhat related to Carrier-Grade NAT[1]. Influx of connections from a single public IP shared by multiple public users = 'security concern'. Not to forgive the big tech giant of its inflexibility :P [1] https://en.wikipedia.org/wiki/Carrier-grade_NAT https://en.wikipedia.org/wiki/Carrier-grade_NAT
mattlondon 6y ago
Never happened to me in the UK with either Three or Vodafone with firefox with various privacy extensions (privacy badger, decentraleyes, unlock etc) Maybe something else you are doing?

holstvoogd 6y ago

That is because >50% of internet traffic is bots. Mostly BS marketing tools, ad conversion scams and quack-security 'scans' from my experience. Pretty sure the entire captcha proliferation is to reduce fake clicks in google ads. I've been working on ways to block bots from some websites I manage the hosting for. It is nearly impossible. I rate limit the hell out of most of the world and block a long list of fake user agents. Still like 40% of out traffic is bots. >'legally challenge CAPTCHAs' Probably not, depending on where you live etc. Here, in the netherlands only gov. websites are required to be accessible.

deleted 6y ago

[deleted]

smnrchrds 6y ago

> “suspicious activity on your network” - I’m using a reputable, top-tier UK mobile provider Same in Canada. WiFi is fine. Using the web when connected to cell data (from the second biggest mobile operator in the country) brings up CAPTCHA almost 100% of the time.

heavyset_go 6y ago

These companies are so determined to keep people from legally scraping their sites that they don't care that they're walking all over the ADA in doing so.