Live data from Hacker News

Recaptcha v3: new way to stop bots

webmasters.googleblog.com

21–30 of 147 posts

Re: Recaptcha v3: new way to stop bots

#21
post #11

Earlier quoted context omitted.

Hold on. Who says the sites using CAPTCHA are also the sites that have an ad based monetization model? The other day I was logging into newegg to order something and I was presented with reCAPTCHA, for which I had to solve 4-5 challenges before letting through. Looking through the documentations for reCAPTCHA v3, it wants to load a script from Google's servers. As an end user I do not want Google to track me across t…

> Who says the sites using CAPTCHA are also the sites that have an ad based monetization model? > The other day I was logging into newegg to order something Newegg uses ads. > As an end user I do not want Google to track me across the web Sure, and as a content provider, you might not want users who refuse to go through CAPTCHA. Nobody is forcing you to access the content. > the side effect seems to be conveniently i…

>> The other day I was logging into newegg to order something

> Newegg uses ads.

That's not my point. We generally understand that newegg is there to sell you something. I was using it as a convenient example and perhaps a better one could be found. Just because they use ads does not invalidate my point there.

From the HN guidelines: "Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize."

> as a content provider, you might not want users who refuse to go through CAPTCHA. Nobody is forcing you to access the content.

Theoretically speaking, this is true. I can opt to simply close the page, turn off my computer, etc. However, it may not be practical to do this all the time. Some example maybe school/government institutions that you have to use deploys reCAPTCHA, or something like the CloudFlare pages that makes you fill out a reCAPTCHA for each website (which amounts to a large part of the internet).

> It only hurts users that the content provider doesn't care about, because they don't generate any revenue.

Disagreed. Perhaps in cases with ad based sites that is the case. If you're selling something and preventing me to buy from you, you're hurting users that may generate revenue. You could say that perhaps the benefit is outweighed by the cost, which maybe true from an abuse perspective. However, if everyone starts doing this, then my cynical view of Google will play out, which is the original point of my argument.

It's clear there's an economic incentive at play, otherwise Google won't develop this and people wouldn't deploy this. I just think that it's overly favored towards Google (and other ad based entities), as opposed to sites that do not rely on ads and the users.

Re: Recaptcha v3: new way to stop bots

#22
No, no, no, no.

I do not want Google to have any more fucking data about me than it already does! "Put this blob of JavaScript on every page of your site so that we can see how users are clicking, scrolling, and browsing around. Think of the children^W spam and abuse!"

I just cannot believe that Google somehow gets away with spinning this as some sort of "guardian of the Internet" thing when it is a transparent attempt to a) make adblocking more difficult and b) force people to accept being tracked by Google or get blacklisted from the web.

Getting banned from sites or treated as a subhuman because you don't want Big Brother to follow your actions around should not be something that we're okay with. It just shouldn't be.

Re: Recaptcha v3: new way to stop bots

#23
post #8

Earlier quoted context omitted.

Great. That means that if you're after a specific piece of information, and you don't waste time clicking on "ooh shiney" stuff on your way to find that piece of information, you get flagged as a bot and treated as hostile. Why do we want this version of the web again?

Abuse exists, so there is then demand to prevent it. Your anger would be better directed at the bad actors who ruin things for you, like how you need to buy a lock for your door. How much time in your life has been wasted by slotting a key into a hole? Ugh, doesn't anyone know this isn't the world I asked for?

Gotta feed the machine right?

Just so you know, the more you protect your privacy, the more websites, everywhere, will have Recaptcha requires that you work for Waymo even though you do not want to work for them (you know, describing road signs, identifying potholes, finding traffic lights, etc).

Want some privacy? OK, waste 2-3 minutes every 10 articles and work for Google. Don't want to work for Google? OK, disable all privacy protection and you're good to go.

Paying a subscription to the website will, often, not even prevent Recaptcha from popping up.

That's dystopia, both feet in, but somehow it's OK because some "guys" are abusing the system o_0

Re: Recaptcha v3: new way to stop bots

#24
I really thought they would realise how fucking stupid this was and roll it back, but I guess they really don't care at all. I feel sorry for anyone who has opted out of the Google ecosystem so far and is now going to be penalised by not being able to access many websites

Re: Recaptcha v3: new way to stop bots

#25
post #22

No, no, no, no. I do not want Google to have any more fucking data about me than it already does! "Put this blob of JavaScript on every page of your site so that we can see how users are clicking, scrolling, and browsing around. Think of the children^W spam and abuse!" I just cannot believe that Google somehow gets away with spinning this as some sort of "guardian of the Internet" thing when it is a transparent attem…

> I do not want Google to have any more fucking data about me than it already does! "Put this blob of JavaScript on every page of your site so that we can see how users are clicking, scrolling, and browsing around. Think of the children^W spam and abuse!"

They already do with google analytics.

Re: Recaptcha v3: new way to stop bots

#26
post #22

No, no, no, no. I do not want Google to have any more fucking data about me than it already does! "Put this blob of JavaScript on every page of your site so that we can see how users are clicking, scrolling, and browsing around. Think of the children^W spam and abuse!" I just cannot believe that Google somehow gets away with spinning this as some sort of "guardian of the Internet" thing when it is a transparent attem…

> I do not want Google to have any more fucking data about me than it already does! "Put this blob of JavaScript on every page of your site so that we can see how users are clicking, scrolling, and browsing around. Think of the children^W spam and abuse!" They already do with google analytics.

This is a version of Google Analytics you can't adblock without breaking the site

Re: Recaptcha v3: new way to stop bots

#27
I use Firefox with maximum tracking protections and a VPN, so I'm first in line to claim frustration about being forced to solve reCAPTCHAs.

But on the other side, it needs to be understood just how important having a CAPTCHA is. The amount of destruction to user experience that bots can cause is sometimes far worse than the pain the CAPTCHA causes.

The long chains of reCAPTCHAs annoy me to no end, and I hope a middle ground can be reached, but bots are a very serious problem.

I do wonder if maybe computational challenges are a feasible alternative in some scenarios, or perhaps as an alternative choice you could give to the users.

Re: Recaptcha v3: new way to stop bots

#28
anyone remember the blog from the late 90s or maybe early 00s who just ripped apart every bespoke captcha that existed on major web sites? It was really entertaining/interesting/informative to me at the time. Can't find it anymore...

Re: Recaptcha v3: new way to stop bots

#29

Earlier quoted context omitted.

Abuse exists, so there is then demand to prevent it. Your anger would be better directed at the bad actors who ruin things for you, like how you need to buy a lock for your door. How much time in your life has been wasted by slotting a key into a hole? Ugh, doesn't anyone know this isn't the world I asked for?

Gotta feed the machine right? Just so you know, the more you protect your privacy, the more websites, everywhere, will have Recaptcha requires that you work for Waymo even though you do not want to work for them (you know, describing road signs, identifying potholes, finding traffic lights, etc). Want some privacy? OK, waste 2-3 minutes every 10 articles and work for Google. Don't want to work for Google? OK, disable…

I can enumerate why anything in the world is suboptimal. It's not a very strong point on its own.

But notice that you haven't suggested an alternative. You're just lamenting one of the few, generalizable, cheap resources a website operator has to avoid abuse in a world where it's only getting easier and easier for bad actors.

Your analysis is just as thorough as "but somehow it's OK to put locks on every door because some guys are abusing the system o_0?!" Food for thought: Is everyone encumbering their life with keychains for the fun of it? How do the trade-offs look? Do locks play any role beyond feeding the locksmith industry? What other options do people have and how do they compare with buying a $17 lock for their front door and installing it with a few screws?

Re: Recaptcha v3: new way to stop bots

#30
I’m quite proud of GOV.UK for banning CAPTCHAs from government services completely.[1] Have you ever tried to use the ‘accessible’ fallback for ReCAPTCHA? It’s literally impossible (my team had 0% passes trying it over and over again) so by implementing ReCAPTCHA you’re completely blocking an entire set of already disadvantaged users. At the same time, even a normal CAPTCHA is already harder for some users to solve than it is for some bots and you’re lining Google’s pockets by training their ML algorithms.

While this new version potentially helps things, it feels like the users with more automated interaction methods or those who want to reduce fingerprinting efforts will still fall foul of over-zealous site owners.

At the end of the day, all a CAPTCHA is is a method to externalise business costs onto your users.

[1] https://www.gov.uk/service-manual/technology/using-captchas

Post reply on HN