4 ms·

The Dark Side of ReCAPTCHA3

phendrenad2 4y ago
Pure fearmongering. Apparently if a buyshoesxyz.com shares with Google the fact that you bought shoes, and Google later uses that information to let you through ReCAPTCHA v3, that's "not safe". Not safe from what, exactly, is not explained. You're just supposed to take the author's word for it that something, anything, bad could come of it. Also, the author gets something else that's very important, very wrong: ReCAPTCHA does not silently block people because they're afraid of "legal risk", but because studies show that silently blocking people after they sign up is much more effective at stopping bots. Seriously, authors should do some research before making a blog post based on their first impressions and assumptions.
- nonrandomstring 4y ago
  > Pure fearmongering It frightened you?
  - phendrenad2 4y ago
    No, but I guess it is you?
    - nonrandomstring 4y ago
      Not me, no. Only a tenuous connection to the writer. Genuinely surprised by your use of the word "fear" and how that fits into our little battle pro, and anti Big Tech. You see, if you're not frightened yourself, then isn't it a vicarious comment on what you project onto other people (those helpless little people who aren't intelligent enough to make up their own minds or reason about complicated things like the internet)? On the other hand if you found it genuinely unsettling then I couldn't understand your apparent support of it. That's all.
      - phendrenad2 4y ago
        Wow, so NO one can ever use the word "fearmongering" because they couldn't possibly guess what effect a headline will have on people? Is that the argument you're making?
        nonrandomstring 4y ago
        Yes. It's generally not okay to speculate about other people's states of mind to make your arguments. One ought to let them speak for themselves. Indeed you agree with me, that you "couldn't possibly guess what effect a headline will have on people?" "Whereof one cannot speak thereof one must remain silent" -- Wittgenstein: Tractatus Logico-Philosophicus
        phendrenad2 4y ago
        Well, please continue taking that line of logic to it's obvious conclusion, that we're all just souls living in Plato's cave, and we cannot know anything about other people, they may mot even exist. So why do anything at all? I'm sorry, I need to step outside of your philosophical bubble, and go do things in the real world. Rest assured that I will continue to make assumptions about the mental state of other beings, for it is the way that modern civilization operates.
- Nextgrid 4y ago
  > Apparently if a buyshoesxyz.com shares with Google the fact that you bought shoes, and Google later uses that information to let you through ReCAPTCHA v3, that's "not safe" It's not safe when the third-party the data is shared with has a global view of the internet, spyware in the vast majority of websites and even some mobile apps, and has a business incentive to use this data to stalk you for ad-targeting purposes. The author seems to be quite clear as to what kinds of data are sent to Google: > Since reCAPTCHA v3 scripts must be loaded on every page of a site, you must send Google your browsing history and detailed data about how you interact with sites in order to access basic services on the internet, such as paying your bills, or accessing healthcare services. > It's needless to say that the kind of data that is collected by reCAPTCHA v3 is extremely sensitive. Those requests contain data about your motor skills, health issues, and your interests and desires based on how you interact with content. Everything about you that can be inferred or extracted from a website visit is collected and sent to Google. Maybe that's a thing some users like you would be fine with, but in this case it should be laid out explicitly and (at least as per the EU GDPR) it should be opt-in. Buying shoes on a shoe retailer's website shouldn't require being stalked by a multinational spyware operator, and especially not without disclosure.
  - phendrenad2 4y ago
    > It's not safe when the third-party the data is shared with has a global view of the internet, spyware in the vast majority of websites and even some mobile apps, and has a business incentive to use this data to stalk you for ad-targeting purposes So the danger I face by using these services is... targeted ads. > Maybe that's a thing some users like you would be fine with So the "danger" is actually a good thing, maybe, for some people? I'm just as confused as before, please clarify.
    - Nextgrid 4y ago
      It's less the targeted ads and more the collection & concentration of all this personal data in a single place. There are lots of ways it can be misused if a malicious actor (or the government) gets their hands on it. So it's not that "targeted ads" are bad by themselves, it's that they justify an industrial-scale spyware operation, which other malicious attackers could potentially co-opt to do their bidding.

Pure fearmongering. Apparently if a buyshoesxyz.com shares with Google the fact that you bought shoes, and Google later uses that information to let you through ReCAPTCHA v3, that's "not safe". Not safe from what, exactly, is not explained. You're just supposed to take the author's word for it that something, anything, bad could come of it. Also, the author gets something else that's very important, very wrong: ReCAPTCHA does not silently block people because they're afraid of "legal risk", but because studies show that silently blocking people after they sign up is much more effective at stopping bots. Seriously, authors should do some research before making a blog post based on their first impressions and assumptions.

nonrandomstring 4y ago
> Pure fearmongering It frightened you?
- phendrenad2 4y ago
  No, but I guess it is you?
  - nonrandomstring 4y ago
    Not me, no. Only a tenuous connection to the writer. Genuinely surprised by your use of the word "fear" and how that fits into our little battle pro, and anti Big Tech. You see, if you're not frightened yourself, then isn't it a vicarious comment on what you project onto other people (those helpless little people who aren't intelligent enough to make up their own minds or reason about complicated things like the internet)? On the other hand if you found it genuinely unsettling then I couldn't understand your apparent support of it. That's all.
    - phendrenad2 4y ago
      Wow, so NO one can ever use the word "fearmongering" because they couldn't possibly guess what effect a headline will have on people? Is that the argument you're making?
      - nonrandomstring 4y ago
        Yes. It's generally not okay to speculate about other people's states of mind to make your arguments. One ought to let them speak for themselves. Indeed you agree with me, that you "couldn't possibly guess what effect a headline will have on people?" "Whereof one cannot speak thereof one must remain silent" -- Wittgenstein: Tractatus Logico-Philosophicus
        phendrenad2 4y ago
        Well, please continue taking that line of logic to it's obvious conclusion, that we're all just souls living in Plato's cave, and we cannot know anything about other people, they may mot even exist. So why do anything at all? I'm sorry, I need to step outside of your philosophical bubble, and go do things in the real world. Rest assured that I will continue to make assumptions about the mental state of other beings, for it is the way that modern civilization operates.
Nextgrid 4y ago
> Apparently if a buyshoesxyz.com shares with Google the fact that you bought shoes, and Google later uses that information to let you through ReCAPTCHA v3, that's "not safe" It's not safe when the third-party the data is shared with has a global view of the internet, spyware in the vast majority of websites and even some mobile apps, and has a business incentive to use this data to stalk you for ad-targeting purposes. The author seems to be quite clear as to what kinds of data are sent to Google: > Since reCAPTCHA v3 scripts must be loaded on every page of a site, you must send Google your browsing history and detailed data about how you interact with sites in order to access basic services on the internet, such as paying your bills, or accessing healthcare services. > It's needless to say that the kind of data that is collected by reCAPTCHA v3 is extremely sensitive. Those requests contain data about your motor skills, health issues, and your interests and desires based on how you interact with content. Everything about you that can be inferred or extracted from a website visit is collected and sent to Google. Maybe that's a thing some users like you would be fine with, but in this case it should be laid out explicitly and (at least as per the EU GDPR) it should be opt-in. Buying shoes on a shoe retailer's website shouldn't require being stalked by a multinational spyware operator, and especially not without disclosure.
- phendrenad2 4y ago
  > It's not safe when the third-party the data is shared with has a global view of the internet, spyware in the vast majority of websites and even some mobile apps, and has a business incentive to use this data to stalk you for ad-targeting purposes So the danger I face by using these services is... targeted ads. > Maybe that's a thing some users like you would be fine with So the "danger" is actually a good thing, maybe, for some people? I'm just as confused as before, please clarify.
  - Nextgrid 4y ago
    It's less the targeted ads and more the collection & concentration of all this personal data in a single place. There are lots of ways it can be misused if a malicious actor (or the government) gets their hands on it. So it's not that "targeted ads" are bad by themselves, it's that they justify an industrial-scale spyware operation, which other malicious attackers could potentially co-opt to do their bidding.