4 ms·

Several of the non-interactive signals would still pass through in those sorts of situations. I don't know exactly what reCAPTCHA collects, but if you look at

by jefftk 3y ago

Several of the non-interactive signals would still pass through in those sorts of situations. I don't know exactly what reCAPTCHA collects, but if you look at something like https://amiunique.org/fingerprint https://amiunique.org/fingerprint you can get a similar idea of what's possible.

cassianoleal 3y ago
Yeah I get what you're saying. What I'm saying is that it's not required for its core functionality. Without all that, it still works by getting the user to click on images. Sure, maybe it's not just about validating the correct squares were clicked on. Maybe it analyses timing, how much the mouse moves around and whatever else. Nothing there requires collection and storage of user data. All it needs is to process it there and then. It can throw it all away as soon as the user clicks the button.
- jefftk 3y ago
  > Without all that, it still works by getting the user to click on images. I don't see where you've shown that? ReCAPTCHA v3 doesn't include any clicking on images, as far as I can tell because that doesn't actually add that much in terms of identifying bots? > All it needs is to process it there and then. It can throw it all away as soon as the user clicks the button. Even if they limited themselves to tracking how users clicked the button they'd still need to store it, so they could compare this user to other users and build models of what human/bot traffic looked like.
  - cassianoleal 3y ago
    > ReCAPTCHA v3 doesn't include any clicking on images, as far as I can tell because that doesn't actually add that much in terms of identifying bots? Perhaps I'm being considered human and just being generally unaware. It's possible. Do you have an example website where I can try it? I have uBo block recaptcha by default, so whenever a website uses it, it takes me a few clicks and page reloads until I get the prompt. I can't remember of a single instance where I didn't have to go through the challenge but maybe my own biases are in the way of me seeing it. > Even if they limited themselves to tracking how users clicked the button they'd still need to store it, so they could compare this user to other users and build models of what human/bot traffic looked like. This gives me the creeps. In any case, does this need to be accompanied by PII? And how can I validate that it's not?

by jefftk 3y ago

cassianoleal 3y ago

Yeah I get what you're saying. What I'm saying is that it's not required for its core functionality. Without all that, it still works by getting the user to click on images. Sure, maybe it's not just about validating the correct squares were clicked on. Maybe it analyses timing, how much the mouse moves around and whatever else. Nothing there requires collection and storage of user data. All it needs is to process it there and then. It can throw it all away as soon as the user clicks the button.

jefftk 3y ago
> Without all that, it still works by getting the user to click on images. I don't see where you've shown that? ReCAPTCHA v3 doesn't include any clicking on images, as far as I can tell because that doesn't actually add that much in terms of identifying bots? > All it needs is to process it there and then. It can throw it all away as soon as the user clicks the button. Even if they limited themselves to tracking how users clicked the button they'd still need to store it, so they could compare this user to other users and build models of what human/bot traffic looked like.
- cassianoleal 3y ago
  > ReCAPTCHA v3 doesn't include any clicking on images, as far as I can tell because that doesn't actually add that much in terms of identifying bots? Perhaps I'm being considered human and just being generally unaware. It's possible. Do you have an example website where I can try it? I have uBo block recaptcha by default, so whenever a website uses it, it takes me a few clicks and page reloads until I get the prompt. I can't remember of a single instance where I didn't have to go through the challenge but maybe my own biases are in the way of me seeing it. > Even if they limited themselves to tracking how users clicked the button they'd still need to store it, so they could compare this user to other users and build models of what human/bot traffic looked like. This gives me the creeps. In any case, does this need to be accompanied by PII? And how can I validate that it's not?