10 ms·

Ask HN: Did HN just start using Google recaptcha for logins?

104 points by neltnerb 4y ago

In ten years I've never been asked to solve a captcha to login in. Is this new? What happened? I know that my input into conversations is not some critical feature of HN or anything, but this is enough of a barrier to keep me from bothering to login on most occasions. Seems odd to enable google to track users logging into HN, but maybe it's always been this way and for some reason recaptcha is just flagging accounts from my network today.

LinuxBender 4y ago
It appears so. I have this [1] in my cache and had to click on objects which is odd as there would never be robot behavior from my IP. Perhaps the bot submissions were becoming too much. I've not used a VPN in ages. [1] - https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/recaptcha__en.js https://www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc...
robgibbons 4y ago
Upon upvoting this submission, I was prompted to login which included a captcha. Possibly due to use of a VPN. Are you using a VPN?
user764743 4y ago
Are there no viable alternatives more respectful of privacy than Google's recaptcha? Seems like an anti-user choice to me.
- traceroute66 4y ago
  > Are there no viable alternatives more respectful of privacy than Google's recaptcha? Two milliseconds on Google will lead you to hCaptcha[1] [1]https://www.hcaptcha.com https://www.hcaptcha.com
  - mdaniel 4y ago
    > more respectful of privacy than Google > > Two milliseconds on Google can't tell if is satire or not
- britneybitch 4y ago
  There are alternatives: https://www.hcaptcha.com/ https://www.hcaptcha.com/ https://blog.cloudflare.com/turnstile-private-captcha-alternative/ https://blog.cloudflare.com/turnstile-private-captcha-altern... Unfortunately if you're a user (as opposed to a website author) you don't get a choice.
  - Semaphor 4y ago
    hcaptcha started out nice, but it quickly got way worse. Maybe more privacy, but it wants me to solve so many dumb puzzles, while Google is usually happy with only one. If captchas weren’t a rare-ish occurrence for me, I’d buy a nopeCha subscription to solve that shit for me.
    - eatbots 4y ago
      This is entirely configurable by the site owner. hCaptcha has entirely passive score-based detection, 99.9% passive mode, and more aggressive options as needed. (disclosure: work there)
RjQoLCOSwiIKfpm 4y ago
What boggles me about this is: I do NOT consent to working for free for Google to train their AI. I'd be willing to solve any CAPTCHA the product of which would be open source, or even useless. But Google is a for-profit company which uses the solutions to create proprietary software and profit off of it, they won't pay me, and I have no way to opt-out of working for them because the most useful places of the Internet use their CAPTCHAs. (Yes, I can intentionally put wrong solutions into their CAPTCHAs to poison their data, but I'm afraid they get so many valid solutions that they can just calculate the wrong ones out.)
- bun_at_work 4y ago
  If your goal is to avoid Google using your data, putting in bad data that is filtered out accomplishes that, right? I don't personally have an opinion on HN using the captcha, but their reasoning is pretty obvious, and almost certainly comes from a good place (reducing any spam on the site). That said, you're welcome to your opinions, it just seems like you have an option, based on your stated goal.
  - RjQoLCOSwiIKfpm 4y ago
    Even if it does accomplish that they will still have coaxed me into doing work for them even though I'm not consenting to working for Google. Consider it like this: If someone forced you to do physical work against your will, you wouldn't like it any more just because they throw away the product of your labor in the end. It would just make it more obscene.
    - deleted 4y ago
      [deleted]
- loufe 4y ago
  That's an interesting take. Everything costs money. You know the reason why the CAPTCHA service is free is because they have value in the results of the CAPTCHA, right? You're not viewing ads or paying for this service. I'd prefer not to help Google either, but nothing is truly free.
factsarelolz 4y ago
[dead]
IYasha 4y ago
If true, that's really, really sad.
Filligree 4y ago
I use Safari almost universally, and therefore can't pass a recaptcha challenge. For the moment I remain logged in, but I suppose once the cookie dies, I won't be able to get back here.
- intelVISA 4y ago
  Finally, we are released brother.
- happyopossum 4y ago
  > I use Safari almost universally, and therefore can't pass a recaptcha challenge That doesn't grok - Millions of people use safari daily and pass recaptcha challenges. You probably have a content blocker set too aggressively or something like that preventing you from it - it's not safari.
  - Filligree 4y ago
    I don't use a content blocker. The only extension in my browser is Bitwarden.
bobobob420 4y ago
Can confirm incognito login had to match images of cars. Dang please do not make me match images of cars, busses, and traffic lights. Please!
FeistySkink 4y ago
Just tried re-signing in and got reCAPTCHA without any VPNs on Firefox/Linux.
binarymax 4y ago
Doesn’t HN use cloudflare? I’d guess that’s the source of the captcha and not something that was implemented by HN on purpose.
- dang 4y ago
  https://news.ycombinator.com/item?id=21799061 https://news.ycombinator.com/item?id=21799061
  - britneybitch 4y ago
    When it comes down to it, between Cloudflare and Recaptcha, I think Cloudflare is the lesser of two evils.
    - xur17 4y ago
      Not if recaptcha is temporary and only on the login / signup pages.
justinator 4y ago
I logged out, and upon login recaptcha made me solve FIVE puzzles. JFC.
dang 4y ago
No recent changes, but we do sometimes turn captchas on for logins when HN is under some kind of (possible) attack or other. That's been happening for a few hours. Hopefully it goes away soon. Btw I also fume when I have to work as an unpaid manual image recognizer, so I'm open to alternatives.
- jgrahamc 4y ago
  https://blog.cloudflare.com/turnstile-private-captcha-alternative/ https://blog.cloudflare.com/turnstile-private-captcha-altern...
  - Terretta 4y ago
    "Today we’re giving everyone a better option." Followed by a modern reimagining of the classic 88x31 animated gif mini-banner button as a not so subtle pixel.gif tracker. https://www.yewknee.com/_img/blog/blog_webbuttons020.png https://www.yewknee.com/_img/blog/blog_webbuttons020.png "Once you’ve deployed Turnstile, you can go back to the dashboard and see analytics on where you have widgets deployed..." So less a gift, more another sensor.
- traceroute66 4y ago
  > we do sometimes turn captchas on for logins when HN is under some kind of (possible) attack I don't think people are disputing the necessity, just the mechanism used. The other services (hCaptcha) are effectively drop-in replacement with minimal code changes.
  - nokya 4y ago
    +1 nothing against some anti bot feature, just hopefully not Google.
- vdfs 4y ago
  You can actually solve those captcha using Speech to text, there many tools that do that, ex: https://github.com/xHossein/PyPasser https://github.com/xHossein/PyPasser
chaps 4y ago
Gross, yep. And since I'm using a VPN I'm thrown into the "give them the most painful captchas just to be sure" bucket.
gjsman-1000 4y ago
Considering the articles and general sentiment we have towards Google and AI training, if this is true HN failed to read the room. Edit: Yep, it's real. Seriously? Edit 2: Understandable, see https://news.ycombinator.com/item?id=34313452 https://news.ycombinator.com/item?id=34313452.
- greggarious 4y ago
  They don't support TOTP, but they'll run you through a Google owned CAPTCHA. (I've noticed most people use the Google Authenticator, which I hope doesn't ping the mothership, but I haven't verified that's not the case.) Then again, venture capitalists have always been overly focused on confidentiality, integrity, and availability[1], while floundering when the subject of non-repudiation[2] comes up. (It seems based on my lived experience, the rule is "if the lie is to my benefit, it's ok"? Not cool fellas.) [1] https://informationsecurity.wustl.edu/items/confidentiality-integrity-and-availability-the-cia-triad/ https://informationsecurity.wustl.edu/items/confidentiality-... [2] https://www.cse.msu.edu/~cse870/Public/Lectures/Security/NonRepudiation.html https://www.cse.msu.edu/~cse870/Public/Lectures/Security/Non...
freitasm 4y ago
Do what you have to do. Keeping the platform safe is your job. Others might put different values above yours. If you want drop in replacement, Cloudflare a turnstile as mentioned. Otherwise fully behind Cloudflare. CDN won't help much due to nature of content but WAF rules can be used to easily turn on invisible captcha based on rules.
greggarious 4y ago
Hi Folks! I was not prompted to do a CAPTCHA logging in on the clearnet, but this may be my last batch of posts I do if that ever changes... for I will never consent to asking GOOG if I can post here. Let us set aside the myriad of issues with visual CAPTCHAs and how they exclude folks with disabilities such as blindness. There are other solutions like Hcaptcha[1] that do not use GOOG, a company which has strayed so far from it's "Don't be evil" mission that they went from supporting Mozilla via the search deal to moving the Chrome team into the same building, poaching key employees, and aggressively pushing folks so young they can't ask for help without violating COPPA to switch to a browser that would allow them to monitor them from cradle to the grave. I greatly sympathize with the goal of an authentic dialog... trust me. But using GOOG to accomplish it is not going to do that. (The true threats to HN, like any democratic space, come not from automatons, but human beings. Only when you stop giving undue attention to the wrong... metrics... will you find the ecstatic truths you claim to seek.) - "Greg"
telis 4y ago
At least use Funcaptcha by Arkose HN gods.

jsnell 4y ago

There is basically no chance the captchas are actually being used for generating training data at this point. The puzzles have not changed for ages. Like, five years? How many billions (trillions?) of labels do you think they have for buses and traffic lights at this point? If there was an economic value to using captcha solutions for labeling, somebody would be rotating novel tasks into the mix. But they don't seem to be. (And if the goal of running the service was to generate labels, they would not have built solutions to make it possible to pass the captchas without a puzzle, like recaptcha v3.) So rest assured, your work in solving the captchas is totally b useless, just like you wanted!

RjQoLCOSwiIKfpm 4y ago
I would rather guess that the emperor has no clothes, i.e. AI is still so bad that it needs insane amounts of training data and hasn't got enough yet.
- ShamelessC 4y ago
  That's a fun guess? Do you flip a coin every time you make a decision or... I can assure you that if CLIP and ALIGN exist, there is objectively no reason for them to collect what would amount to a dataset for...solving Google CAPTCHA's? Which I'm pretty sure is a solved problem even without the data.
gghffguhvc 4y ago
It is just continuous QA for Waymo. Measures how well existing ML is working in the real world.
- jsnell 4y ago
  That's a great example of something that would require them mixing in novel tasks, rather than recycle the stale traffic light detection puzzles. Because let's be honest, detecting traffic lights is not anywhere closest to the hard part about self-driving cars. Knowing how well you can do it tells you nothing about how well you can solve the actual difficult things. What would a task that uses humans to solve that problem actually look like? I'm guessing it would need to be short videos, not images. And look for things with some ambiguity. "Select any videos where a pedestrian looks like they intend to cross the street".
  - gghffguhvc 4y ago
    I’m guessing Waymo has very little influence over Google. Waymo: “I see you have that hammer, we have a usecase for it” Google: “Ok, but we aren’t changing the hammer or how hard it is to use it”
neltnerb 4y ago
Lately I've seen captchas that ask me to identify things in images that are clearly generated with AI. Like frogs without backs. I think at this point it is clear we are not training image recognition so much as providing them with free scoring for their image generation algorithms.
- jsnell 4y ago
  Just to be clear, are you saying that you saw the "frogs without backs" puzzle on Recaptcha? Because I definitely have not seen anything but the streetview images there for ages. Now, if it is a captcha provider whose advertised business model is to sell access to the users for labeling and split the profits with the website that integrates their captcha (e.g. hCaptcha), then I can believe somebody would submit a image generation eval dataset. But it seems irrelevant to discussion of whether solving a Recaptcha is free work.
  - neltnerb 4y ago
    I mostly see streetview stuff, but twice I've seen one that had stuff like "which one is a ladybug" or even "which one looks like a blah without a blah". This prompt of course could still be for classification of images. But then the "ladybugs" often were heavily distorted to the point where they did things like morph into other animals or the background. They did not seem possible to be photos, but I could be wrong. The prompts were very odd.

LinuxBender 4y ago

Aside from 3rd party code perhaps one middle-of-the-road idea would be a table of a few hundred factoids and then code that makes multiple choice checkbox factoids like - Select everything that is a color im sure there are more clever open-ended questions and maybe sometimes switch up "is" with "is not". - Red - Blue - Monkey - Violet - Armchair People say that bots can learn such things but if every site had their own in-house tool then bots would have to keep track of thousands of site specific puzzles. Each site could even rotate through a dozen sets of different puzzle types and pause the ones that get learned. This would avoid sending cookies to a third party or depending on 3rd party code thus mitigating some corporate capture. Bonus complexity: Don't use Alpha-Numeric characters. Use something like "figlet" [1] and cycle through a few of its ASCII art fonts. [1] - https://github.com/xero/figlet-fonts https://github.com/xero/figlet-fonts

amf12 4y ago
> but if every site had their own in-house tool Costs money to maintain and build correctly, which naturally leads to buying existing solutions.
- LinuxBender 4y ago
  I've heard that too, but I think it would take a decent developer 1 hour to make a first pass at such a thing. It doesn't have to be complicated nor perfect. I think it should not require images nor javascript. It should probably be a server-side LUA script that caches the puzzle and answer. I found a few starter ideas [1][2] and concepts [3] but I would prefer to use something like figlet vs gd generated images. Figlet or something like it should be much lighter weight. I just have to find one that is readable on cell phones. [1] - https://github.com/lua-programming/lua-captcha https://github.com/lua-programming/lua-captcha [2] - https://github.com/mrDoctorWho/lua-captcha https://github.com/mrDoctorWho/lua-captcha [3] - https://nedbatchelder.com/text/stopbots.html https://nedbatchelder.com/text/stopbots.html
  - waspight 4y ago
    Said every customer
    - Filligree 4y ago
      I've seen a couple sites that do this. One of them just asks for the square root of -1! And sure, qntm.org isn't nearly as big a website as HN, but I concur that this isn't likely to be super-difficult. The wide use of recaptcha seems like mostly laziness; most websites aren't big enough to get targeted attacks.
realworldperson 4y ago
[dead]
ghghgfdfgh 4y ago
I think your idea is exactly what I would want in a captcha, but an issue with your example is that it would only pertain to English speakers, and it would be difficult to translate it into a variety of different languages to accommodate everyone.
- LinuxBender 4y ago
  I assume the existing captcha services look at the Accept-Language header. That header could be read by the Lua script. Each puzzle set could be translated one time through google translate or perhaps a better translation site. It should probably be proof read by someone from each language used to ensure nothing translates out of context into something offensive. I think I've seen people do this on Github, having people proof read translations. In this case it probably should be a smaller group to reduce risk of leaking the puzzle mapping to the bot code authors.
chrismcb 4y ago
I think chatgpt is way ahead of you.