5 ms·

A separate concern I have is that Web sites running ReCaptcha often require leaking privacy-invasive information to Google, in the course of using the site. No

• lelandfe 2y ago
  Users are punished if Google is unaware of them. I built an iOS app for a major brand but the web view would load with no cookies in a sandbox, and we realized after roll out that all users were needing to solve 10+ hard CAPTCHA challenges to be let through, as Google was unfamiliar with the users. You’ll get a similar experience loading over a VPN. We removed it. It’s easy to why device attestation is so alluring to these companies. Anonymity and bots look alike.
  • pennybanks 2y ago
    i didnt even think of that but makes sense. valuable pov. either way im sure most people are just annoyed with the gate code then they are with the tracking and would take the cookie everytime. and i feel like this is similar to many things especially with google. but people just would rather just believe these companies are against them haha. kinda silly imo
    • yreg 2y ago
      Unfortunately it's not just getting the difficult captchas. If you try enough to maintain privacy and become invisible to the likes of Google/Meta, you have trouble creating accounts. Like you might create an Instagram account and be automatically banned in an hour for no apparent reason. But as you say, it totally makes sense.
  • rustcleaner 2y ago
    It's time to build for the bots instead of fighting them.
    • viraptor 2y ago
      If only people built reasonable bots. The issue is mostly not with the bots existing, but with them flooding services with traffic without any backoff/throttling. And that's not even just the rando ones - Bing is often just as bad here.
  • chii 2y ago
    as the author of the app, why is captcha enabled for the website? Of course, if you're merely embedding someone else's site then it makes a lot of sense to get captcha'ed to death.
    • lelandfe 2y ago
      Same company. It's a shopping app, with one of its tabs instead embedding the more sensitive pharmacy ecom side. This skipped $millions in build out, but we were perplexed when no one used it. CAPTCHA was on for this large company because they see a lot of fraud and it removed the simplest cases of it. We turned it off when within the app, but it was a stop gap. Not sure what came after.
• anonzzzies 2y ago
  I encounter recaptcha a lot and often it violates the gdpr. I believe this to be one of the positives of the gdpr. Things usually go as follows: - something gets abused - a solution is needed to stop the abuse - the 'techies' implement recaptcha and they are not aware of the regulatory implications - it's such a small thing that it often get's overlooked in internal audits Google fonts from their cdn is another. Landing page Youtube videos is another but a little bit more well known. The user should be warned so they can decide if they want to give Google everything; how else would they know?
  • sentientslug 2y ago
    Can you elaborate on why these are violations of GDPR? I presume Google handles the data for EU customers in a manner compliant with GDPR (one would think).
    • cess11 2y ago
      No, they can't, because they're covered by the CLOUD Act.
    • aziaziazi 2y ago
      Wouldn’t GDPR compliance require to let user refuse third party cookies? If a user don’t accept cookies I guess reCaptcha won’t work. Do you either - block them access to your site - ask for recaptcha (use cookies so you just don’t give a poo of their choice - illegal) - open the doors without captcha resolution (don’t need captcha as it can be bypassed)
      • anonzzzies 2y ago
        Yes, but because recaptcha is often such a simple integration on 'some page somewhere' it is overlooked. Or people just think 'it is Google, they must have got it covered'.
      • stavros 2y ago
        Using reCaptcha to stop attacks might fall under legitimate concerns, as the site isn't using it to track visitors. If reCaptcha does track, that's Google breaking the law, not the website.
• miki123211 2y ago
  This is what I call the "captcha triangle". You can have a very hard captcha that bots cannot solve, but that discriminates against the disabled. This gives you privacy and abuse-prevention, but not accessibility. You can have a very easy captcha (or possibly multiple alternative challenges), but bots can solve those easily. This gives you accessibility and privacy, but not abuse prevention. You can mostly have easy, accessible captchas, but rely on invasive tracking and fingerprinting, this gives you accessibility and abuse-prevention, but not privacy. There's no way to have all three. As AI gets better, traditional captchas get more and more useless, and you need more and more tracking. We'll probably reach a point where there's no task that computers can easily verify but AIs can't easily perform, except being "vouched for" by a company that the website owner trusts.
  • Dylan16807 2y ago
    Vouching is onerous in some ways, but on the plus side it can be done anonymously so the vouching company doesn't know which sites you're visiting. Examples being privacy pass and private access tokens, though I haven't seen much mention of them recently.
  • mindslight 2y ago
    Most captchas don't even come off as actual abuse protection, but rather seem to exist because someone wanted to check some box for more cargo cult "security". I can understand captchas being on login pages, ideally only after a few failed logins. But most usage seems to involve gating simple pages, often on sites that should want to be publishing their data far and wide (like ecommerce). And if your site implementation is that bloated that serving what should be static pages creates significant load, you should work on fixing that rather than adding band-aids that make your site even less usable.
    • jart 2y ago
      Have you ever run a website or online service? Whenever I've put something online, there's inevitably at least one person out there who's bored and unemployed with technical chops, who makes it their full time mission to abuse it for months until I figure out how to outsmart them. The Internet is full of these micro-tyrants and I never see anyone complaining about them. Most operators just throw their hands up in the air and depend on protection services like reCAPTCHA to make the pain go away, which always want something in return. Google is like what Paul Erdos called the "Supreme Fascist" (SF) for that reason. Every time you do something bad on the web, Google gains a little more power.
• rustcleaner 2y ago
  I hate the webassembly ones which force you out of "Safer" mode to pass on TBB. I get the bad feeling they fingerprint hardware which is why they're in webassembly.
• internet101010 2y ago
  Yeah if there is recaptcha there is also something blocking known vpn ip blocks.
• FriedrichN 2y ago
  Recently I attempted to buy concert tickets from a well known ticket seller. It insisted I was a bot, even after disabling my uMatrix and uBlock Origin. There was no way to prove that I was not, not even a CAPTCHA. So I decided to simply not buy any tickets. This is just one example. I get increasingly frustrated by how shit everything is and my way of dealing with it is to disengage. It is rather sad, but I was not put on this earth to wrangle apps, QR codes, verification codes, passwords, usernames, e-mails, TOTP codes, updates, activation codes, etc.
  • crngefest 2y ago
    I recommend buying tickets directly at the venue instead of ticket resellers. In most cases they will presell tickets at the door and you can almost always buy some at the door on the night of the show - unless it some superstar probably ymmv
    • FriedrichN 2y ago
      I would have done that if the venue were closer to me, but it's just a little too far away for that. There might be tickets available just before the show, but I'm not willing to risk driving all the way there just to be disappointed and drive all the way back.
      • cynicalsecurity 2y ago
        You can always get to any concert if you have money. Find a person with some sort of authority, give them money.
      • crngefest 2y ago
        That is understandable! I am blessed that I have a number of excellent music venues in public transport distance and a very good ticketing agency about 30 min walking from my home. So I often go there and by them in person - still I also use the online services when in a hurry, lazy etc…
• LargoLasskhyfv 2y ago
  In my experience with ubo on desktop FF, whith settings which block all that crap by default it suffices to allow the domain EnCraptcha, loudblare, and others are coming from only temporarily, meaning only for the timeframe to have that captcha functioning. Not even reloading the site, and after completing it, unchecking that (single) domain entry. Falling back to forbidden, again without reloading the site. This is usually enough for the site to work, be it in reader mode, or 'native' without JS. If not, I usually don't care, and go elsewhere on my list of distractions :) It's not even complicated, just one click in ubo, after looking at the usual suspects, making the stupid machines feel happy, next click to deny that happiness, making ME happy, moving on. Just out of the corner of my eyes, muscle memory, whatever...
• ABDULOHPUTRA 2y ago
  [flagged]