Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Recaptcha v3: new way to stop bots

webmasters.googleblog.com

Post reply on HN
Print view View original

61–70 of 147 posts

Re: Recaptcha v3: new way to stop bots

#61

Post by candiodari »

ksangeelee wrote: post #44

The language used seems alarmist, particularly given the extent to which Google use bots themselves. For example, "the new way to stop bots", "alert you of suspicious traffic", "identify the pattern of attackers", "pages are being targeted by bots", "stay ahead of attackers and keep the Internet easy and safe to use (except for bots)" Many companies have built valuable services by automating HTTP requests. One might…

But you can't seriously expect site owners to just deal with the amount of spam bots can generate because it'd be 1% more equitable to users (that would be driven out by those very bots reCaptcha protects you from btw)

And who pays for those costs ? Who eliminates the tons of spam posted ?

Re: Recaptcha v3: new way to stop bots

#62

Post by chickenfries »

avip wrote: post #53
robin_reala wrote: post #30

I’m quite proud of GOV.UK for banning CAPTCHAs from government services completely.[1] Have you ever tried to use the ‘accessible’ fallback for ReCAPTCHA? It’s literally impossible (my team had 0% passes trying it over and over again) so by implementing ReCAPTCHA you’re completely blocking an entire set of already disadvantaged users. At the same time, even a normal CAPTCHA is already harder for some users to solve t…

I'd suggest CAPTCHA nay-sayers to come up with alternatives. The implied alternative is, by default, constant abuse, phishery, scrapping, automated login attempts, and DDoS. Which sometimes may be fine, and many times is just not acceptable.

If a CAPTCHA is the only thing keeping your site secure from abuse then I think you have larger problems.

Re: Recaptcha v3: new way to stop bots

#63

Post by [deleted] »

avip wrote: post #46
superasn wrote: post #41

Their recaptcha is broken and causes a lot of pain especially when you're on an ISP that may have had some bad apples (pretty common in India where ISPs don't care about spam or piracy). It's like the whole neighborhood is paying the price of someone else's crime and it feels like the digital version of being racially profiled. Worst part is even after solving dozens of images (which keep refreshing by the way to no…

I'd be surprised if recaptcha uses IP reputation. That being said, a classifier is not "broken" for introducing false-positives. If you read the post, you see that's one of the issues v3 tries to address.

[deleted]

Re: Recaptcha v3: new way to stop bots

#64

Post by jocoda »

avip wrote: post #39
_pghu wrote: post #22

No, no, no, no. I do not want Google to have any more fucking data about me than it already does! "Put this blob of JavaScript on every page of your site so that we can see how users are clicking, scrolling, and browsing around. Think of the children^W spam and abuse!" I just cannot believe that Google somehow gets away with spinning this as some sort of "guardian of the Internet" thing when it is a transparent attem…

You seem to subtly express the notion that we are somehow "entitled" to access a website, just because it has a public IP address and we happen to have an http client. Well - we're not.

Had to do a double take here. Not sure that this, as a blanket statement can be correct. How can anyone not be entitled to connect to any public IP address? And how, and who, would be able to enforce that?

A server can put various measures in place to limit general access, but then by those measures the IP is no longer public. T&Cs that a site may wish to enforce can only be made available after the connection has already been established.

Also, robots.txt is a standard that we agree to respect but it is not something that legally binding.

So have to disagree.

Re: Recaptcha v3: new way to stop bots

#65

Post by superasn »

avip wrote: post #46
superasn wrote: post #41

Their recaptcha is broken and causes a lot of pain especially when you're on an ISP that may have had some bad apples (pretty common in India where ISPs don't care about spam or piracy). It's like the whole neighborhood is paying the price of someone else's crime and it feels like the digital version of being racially profiled. Worst part is even after solving dozens of images (which keep refreshing by the way to no…

I'd be surprised if recaptcha uses IP reputation. That being said, a classifier is not "broken" for introducing false-positives. If you read the post, you see that's one of the issues v3 tries to address.

It certainly does use IP because switching from broadband to 4G (hotspot) fixed the issue even when I didn't clear the cache/cookies.

The captcha is broken because at least in my case even after solving dozens of images (which keep refreshing now btw) it still can't be convinced I'm human.

Re: Recaptcha v3: new way to stop bots

#66

Post by candiodari »

keehun wrote: post #19

> Since reCAPTCHA v3 doesn't interrupt users, we recommend adding reCAPTCHA v3 to multiple pages. Frictionless user interfaces arr great, but could this be a ploy to get websites to add Google-property tracking JS on more pages?

... in trade for a valuable service.

I mean, you must hate cloud software if you've got problems with this. Surprise ! Almost all software, from steam to windows, to fusion360, to fastmail, to github, office, ... is cloud software. Just naming some random examples. All have the same problem, most without providing any service (hat off to fastmail and github though, who provide service, like Google, in trade for cloud. And poeh ! to MS, for having office be cloud software for no good reason whatsoever)

Re: Recaptcha v3: new way to stop bots

#67

Post by ryanmccullagh »

akerro wrote: post #59

Any time I see their stupid image captcha to find all buses or shop fronts I immediately close the tab. It's never worth the effort of solving 5x image captcha to read see some stupid website.

Is that the case for you, the captcha shows up when you’re browsing a website? For me, it shows up for my more essential services like logging into an e-commerce site, or my Stripe account. If you had no choice, what would you do?

Re: Recaptcha v3: new way to stop bots

#68

Post by candiodari »

3stax wrote: post #24

I really thought they would realise how fucking stupid this was and roll it back, but I guess they really don't care at all. I feel sorry for anyone who has opted out of the Google ecosystem so far and is now going to be penalised by not being able to access many websites

The problem with this reasoning is the alternative. If there was no reCaptcha but a low-quality broken captcha (like almost all of them), you would not be visiting those sites. They'd all be the sort of abomination that ebay is these days.

BUY ! BUY ! BUY ! Penis enlargement pills ... sorry to put it bluntly, but it's either that or reCaptcha.

Re: Recaptcha v3: new way to stop bots

#70

Post by kbenson »

avip wrote: post #39
_pghu wrote: post #22

No, no, no, no. I do not want Google to have any more fucking data about me than it already does! "Put this blob of JavaScript on every page of your site so that we can see how users are clicking, scrolling, and browsing around. Think of the children^W spam and abuse!" I just cannot believe that Google somehow gets away with spinning this as some sort of "guardian of the Internet" thing when it is a transparent attem…

You seem to subtly express the notion that we are somehow "entitled" to access a website, just because it has a public IP address and we happen to have an http client. Well - we're not.

We aren't entitled to access a site or its information, but neither are they to our personal information. This whole system has broken down as the implicit understanding or what is being given and what is being paid has been trampled on by both sides.

The website may deserve to get recompense for their content, but I deserve to know what I'm paying just as much, if not more.

If you're depriving me of something in our transaction that I'm not aware of, then at least part of what happened was theft. If doesn't matter that I didn't know about it until days, weeks, years or even decades later. If you've deprived me of something that we didn't agree upon, you've stolen from me. Even if in this case it's privacy. Especially in this case because it's privacy, because you can never get it back.

Post reply on HN