12 ms·

Google's new CAPTCHA security login raises 'legitimate privacy concerns'

109 points by r0h1n 12y ago

DanBC 12y ago
This sounds pike Google could be violating EU laws about data protection. We've seen that the EU is happy to enforce stupid laws (cookie notification; right to be forgotten) so they need to be a bit careful. They at least need a robust rebuttal to researched concerns.
LeoPanthera 12y ago
I've been presented with this new captcha about a dozen times, and "failed" it every single time, whereupon it falls back to the traditional squiggly text. I run Ghostery, so perhaps passing it relies on possessing some tracking cookies? If so, I'm happy to continue failing it.
- bgvrofg 12y ago
  I'm blocking re-captchas completely and one at least one occasion the site just let me in. Must be poor integration on those sites.
- homakov 12y ago
  There is no AI and other stuff this article talks about. It's just google cookies and nothing interesting about it http://homakov.blogspot.com/2014/12/the-no-captcha-problem.html http://homakov.blogspot.com/2014/12/the-no-captcha-problem.h...
whizzkid 12y ago
Little bit off topic but, if you use only <tab> to go to checkbox and press space to select it, it brings up the good old "type the text in the image" verification (distorted text). So it thought I was a robot and fallback is to use the old captcha. Well, not sure if this new captcha solves the problem it was intended to do so. Am i missing something? This is quoted from their blog post about recaptcha --> "However, our research recently showed that today’s Artificial Intelligence technology can solve even the most difficult variant of distorted text at 99.8% accuracy." Here you can test it by yourself --> https://www.google.com/recaptcha/api2/demo https://www.google.com/recaptcha/api2/demo
- dingaling 12y ago
  Oooops... It presents me with the Recaptcha image challenge but the top half of the challenge image isn't visible on the pop-up. 1800x1280 phone screen isn't sufficient it appears.
pilif 12y ago
So if google is grabbing all your profile data via the traditional reCAPTCHA but also makes you fill out a form, then it's all ok. But once it becomes obvious that they are collecting the data and they are using (the already collected) data to make it so you don't have to type in the text on the picture, then it's a privacy concern. Or do you honestly believe they bought and continued to operate the old reCAPTCHA out of the goodness of their hearts, never collecting all that data that everybody is upset about now?
- wodenokoto 12y ago
  While the old recaptcha could run javascript to collect all sorts of data about typing and mousemovement, we expect it not to. This new one tries to make a behavioural profile of you and use that to determine you humanness. Maybe the old one did that too. Maybe every Google service does that. I dont know. The outrage is that now we know one is doing that. And on a personal note, yes. I do believe that Google ran recaptcha just for the free annotations of data.
  - tedunangst 12y ago
    How does one run a reputation system without knowing whose reputation one is calculating?
- rfw 12y ago
  Google did use reCAPTCHA to recognize Street View house numbers and street names, so I think there are (somewhat) more innocuous reasons than just wholesale data collection.
- voidz 12y ago
  "Or do you honestly believe"? Really? Your choice of wording is a tactic that spins the discussion in a way that people should recognise as a derailing tactic by now. It attempts to make people who do indeed view things this way feel embarassed, and it's not even about beliefs to begin with. Please stop.
  - pilif 12y ago
rdl 12y ago
Does anyone have good alternatives to old/new ReCAPTCHA? I've been scratching the surface of academic research in the area, and it's all kind of messy. (It's no great secret that CloudFlare would love to switch away from ReCAPTCHA, for a whole variety of reasons. It's one of the things Tor users complain about the most, but it's an issue for a lot more users than that. We're doing a lot of stuff to reduce reliance on CAPTCHAs overall throughout 2015, but we still need a good one for some checks.) I wonder if some kind of prize (anti-Turing prize?) would help. There's the core algorithm/approach question, as well as the infrastructure and deployment model question. I'm a lot more comfortable answering the latter; the former is a black art mixture of science and art.
- logn 12y ago
  Why not just rate limit responses? That ends up costing bot makers about the same amount of money as captchas (which are often solved by workers earning slave wages). This arms race will never end and if the insistence is always to prove you're human, then humans will always be exploited for this proof. Imagine one day when we've automated the world and the only reason humans have to do any work is so that robots can prove they're human. This whole thing is ridiculous. Specifically one way to rate limit would be a cookie value that changes on each request, the previous cookie value expires, and only the site knows what the next valid cookie value is. Bots will pay for the cost of waiting in terms of computing time, and in terms of memory if they get around this by parallelization. As these costs go down due to cheaper computers, then so too will the costs of serving the site.
  - TeMPOraL 12y ago
    > Imagine one day when we've automated the world and the only reason humans have to do any work is so that robots can prove they're human. This whole thing is ridiculous. ... did you just solve the whole problem of on-going automation? Capitalism is saved! We will all work as CAPTCHA breakers. ;).
  - Benferhat 12y ago
    I might even incorporate the request rate into a bot detection algo, maybe have it trigger temporary hellbans.
andridk 12y ago
I can't understand why anyone is surprised. Anything you load from Google's servers is used to gain more insight into your online habits. It's their core business. To learn as much as possible about people online to be able to show them the most relevant ads.
homakov 12y ago
So what? Kind of useless article, nothing new.
mavhc 12y ago
I'm confused as to why people would care. It's easy to block, and if so you have to do a harder test. No one said wanting more privacy wasn't hard work. For the 99% of people who don't care, it's a great improvement. And if someone wants to write a better system, who's stopping them?
- joosters 12y ago
  Great. How do I 'easily' block this on my iphone, please?
  - whyever 12y ago
    Well, I guess jailbreaking does not qualify as easy, does it?
- icebraining 12y ago
  Easy, as in 1) take a few months to study about web technologies to develop an intuition about why and how these technologies are tracking you 2) click a button to block their cookies You and I already did (1), but most people haven't.
blueskin_ 12y ago
It's google. By this point, if anyone is really surprised they hate privacy, they have clearly been living without any internet or newspaper access for the last 10 years.
vlunkr 12y ago
I assumed this was how it worked. Tracking mouse/keyboard seemed a little phony, and google is hardly a stranger to tracking personal information. It really is a bummer that there aren't many great alternatives.
pearjuice 12y ago
Friendly reminder that every request to any Google associated server comes at the price of having your privacy invaded. Yes, this means Google Search but also GMail, Android, reCAPTCHA, Maps (any website displaying a Google Map), Google fonts (any website using Google fonts), Google CDN (any website using Google CDN), G+ (any website using an integration) et cetera. In fact, completing this list with ALL Google its tentacles will probably break the character limit on HN. On a very few exceptions, Google its scooping eye is there to learn more about you.
- lern_too_spel 12y ago
  This isn't Reddit, and substance-free paranoia isn't welcome here. In particular, some of the properties you listed are hosted on cookie-less domains and have privacy policies that severely limit data collection.
hellbanner 12y ago
Forgive my ignorance, is there a way I can use cookies for authentication tracking only on websites while blocking access to screen-size, CSS etc?
joshfraser 12y ago
I can't imagine there are many sites using this that aren't already using Google Analytics, which is already deeply integrated with their ad platform and knows exactly who you are using cookies.

109 points by r0h1n 12y ago

DanBC 12y ago

This sounds pike Google could be violating EU laws about data protection. We've seen that the EU is happy to enforce stupid laws (cookie notification; right to be forgotten) so they need to be a bit careful. They at least need a robust rebuttal to researched concerns.

LeoPanthera 12y ago

I've been presented with this new captcha about a dozen times, and "failed" it every single time, whereupon it falls back to the traditional squiggly text. I run Ghostery, so perhaps passing it relies on possessing some tracking cookies? If so, I'm happy to continue failing it.

bgvrofg 12y ago
I'm blocking re-captchas completely and one at least one occasion the site just let me in. Must be poor integration on those sites.
homakov 12y ago
There is no AI and other stuff this article talks about. It's just google cookies and nothing interesting about it http://homakov.blogspot.com/2014/12/the-no-captcha-problem.html http://homakov.blogspot.com/2014/12/the-no-captcha-problem.h...

whizzkid 12y ago

Little bit off topic but, if you use only <tab> to go to checkbox and press space to select it, it brings up the good old "type the text in the image" verification (distorted text). So it thought I was a robot and fallback is to use the old captcha. Well, not sure if this new captcha solves the problem it was intended to do so. Am i missing something? This is quoted from their blog post about recaptcha --> "However, our research recently showed that today’s Artificial Intelligence technology can solve even the most difficult variant of distorted text at 99.8% accuracy." Here you can test it by yourself --> https://www.google.com/recaptcha/api2/demo https://www.google.com/recaptcha/api2/demo

dingaling 12y ago
Oooops... It presents me with the Recaptcha image challenge but the top half of the challenge image isn't visible on the pop-up. 1800x1280 phone screen isn't sufficient it appears.

pilif 12y ago

So if google is grabbing all your profile data via the traditional reCAPTCHA but also makes you fill out a form, then it's all ok. But once it becomes obvious that they are collecting the data and they are using (the already collected) data to make it so you don't have to type in the text on the picture, then it's a privacy concern. Or do you honestly believe they bought and continued to operate the old reCAPTCHA out of the goodness of their hearts, never collecting all that data that everybody is upset about now?

wodenokoto 12y ago
While the old recaptcha could run javascript to collect all sorts of data about typing and mousemovement, we expect it not to. This new one tries to make a behavioural profile of you and use that to determine you humanness. Maybe the old one did that too. Maybe every Google service does that. I dont know. The outrage is that now we know one is doing that. And on a personal note, yes. I do believe that Google ran recaptcha just for the free annotations of data.
- tedunangst 12y ago
  How does one run a reputation system without knowing whose reputation one is calculating?
rfw 12y ago
Google did use reCAPTCHA to recognize Street View house numbers and street names, so I think there are (somewhat) more innocuous reasons than just wholesale data collection.
voidz 12y ago
"Or do you honestly believe"? Really? Your choice of wording is a tactic that spins the discussion in a way that people should recognise as a derailing tactic by now. It attempts to make people who do indeed view things this way feel embarassed, and it's not even about beliefs to begin with. Please stop.
- pilif 12y ago

rdl 12y ago

Does anyone have good alternatives to old/new ReCAPTCHA? I've been scratching the surface of academic research in the area, and it's all kind of messy. (It's no great secret that CloudFlare would love to switch away from ReCAPTCHA, for a whole variety of reasons. It's one of the things Tor users complain about the most, but it's an issue for a lot more users than that. We're doing a lot of stuff to reduce reliance on CAPTCHAs overall throughout 2015, but we still need a good one for some checks.) I wonder if some kind of prize (anti-Turing prize?) would help. There's the core algorithm/approach question, as well as the infrastructure and deployment model question. I'm a lot more comfortable answering the latter; the former is a black art mixture of science and art.

logn 12y ago
Why not just rate limit responses? That ends up costing bot makers about the same amount of money as captchas (which are often solved by workers earning slave wages). This arms race will never end and if the insistence is always to prove you're human, then humans will always be exploited for this proof. Imagine one day when we've automated the world and the only reason humans have to do any work is so that robots can prove they're human. This whole thing is ridiculous. Specifically one way to rate limit would be a cookie value that changes on each request, the previous cookie value expires, and only the site knows what the next valid cookie value is. Bots will pay for the cost of waiting in terms of computing time, and in terms of memory if they get around this by parallelization. As these costs go down due to cheaper computers, then so too will the costs of serving the site.
- TeMPOraL 12y ago
  > Imagine one day when we've automated the world and the only reason humans have to do any work is so that robots can prove they're human. This whole thing is ridiculous. ... did you just solve the whole problem of on-going automation? Capitalism is saved! We will all work as CAPTCHA breakers. ;).
- Benferhat 12y ago
  I might even incorporate the request rate into a bot detection algo, maybe have it trigger temporary hellbans.

andridk 12y ago

I can't understand why anyone is surprised. Anything you load from Google's servers is used to gain more insight into your online habits. It's their core business. To learn as much as possible about people online to be able to show them the most relevant ads.

homakov 12y ago

So what? Kind of useless article, nothing new.

mavhc 12y ago

I'm confused as to why people would care. It's easy to block, and if so you have to do a harder test. No one said wanting more privacy wasn't hard work. For the 99% of people who don't care, it's a great improvement. And if someone wants to write a better system, who's stopping them?

joosters 12y ago
Great. How do I 'easily' block this on my iphone, please?
- whyever 12y ago
  Well, I guess jailbreaking does not qualify as easy, does it?
icebraining 12y ago
Easy, as in 1) take a few months to study about web technologies to develop an intuition about why and how these technologies are tracking you 2) click a button to block their cookies You and I already did (1), but most people haven't.

blueskin_ 12y ago

It's google. By this point, if anyone is really surprised they hate privacy, they have clearly been living without any internet or newspaper access for the last 10 years.

vlunkr 12y ago

I assumed this was how it worked. Tracking mouse/keyboard seemed a little phony, and google is hardly a stranger to tracking personal information. It really is a bummer that there aren't many great alternatives.

pearjuice 12y ago

Friendly reminder that every request to any Google associated server comes at the price of having your privacy invaded. Yes, this means Google Search but also GMail, Android, reCAPTCHA, Maps (any website displaying a Google Map), Google fonts (any website using Google fonts), Google CDN (any website using Google CDN), G+ (any website using an integration) et cetera. In fact, completing this list with ALL Google its tentacles will probably break the character limit on HN. On a very few exceptions, Google its scooping eye is there to learn more about you.

lern_too_spel 12y ago
This isn't Reddit, and substance-free paranoia isn't welcome here. In particular, some of the properties you listed are hosted on cookie-less domains and have privacy policies that severely limit data collection.

hellbanner 12y ago

Forgive my ignorance, is there a way I can use cookies for authentication tracking only on websites while blocking access to screen-size, CSS etc?

joshfraser 12y ago

I can't imagine there are many sites using this that aren't already using Google Analytics, which is already deeply integrated with their ad platform and knows exactly who you are using cookies.