I don't like any version of recaptcha either. A server-side text-only CAPTCHA is better.
Recaptcha v3: new way to stop bots
71–80 of 147 posts
Re: Recaptcha v3: new way to stop bots
#72Earlier quoted context omitted.
What exactly do you mean by computational challenges? That seems like the exact kind of thing a bot would be much better at compared to a human.
The idea is that you'd need to make the computational challenge more expensive to solve than any profit that success would have. This is what some DDoS protection services do (e.g. the "checking your browser" messages you might see). In some scenarios such as spam, the profit per bot action isn't high at all, so this might be feasible. If it's a ticket bot, that wouldn't work at all. Of course, you're hurting users w…
HashCash had the same idea and failed for the same reason: bad actors aren't using their own machines. They have access to the cheapest compute in the world: botnets and the compute of honest actors.
Add in the mobile-device issue and you quite literally have a solution that's lose/lose.
Re: Recaptcha v3: new way to stop bots
#73No, no, no, no. I do not want Google to have any more fucking data about me than it already does! "Put this blob of JavaScript on every page of your site so that we can see how users are clicking, scrolling, and browsing around. Think of the children^W spam and abuse!" I just cannot believe that Google somehow gets away with spinning this as some sort of "guardian of the Internet" thing when it is a transparent attem…
You seem to subtly express the notion that we are somehow "entitled" to access a website, just because it has a public IP address and we happen to have an http client. Well - we're not.
Clearly you're satirising. The very basis of the HTTP protocol, and the idea of the World Wide Web, is one of easy access to, and discovery of, information on openly accessible servers. It provides numerous mechanisms for protecting data that is deemed private.
Re: Recaptcha v3: new way to stop bots
#74The language used seems alarmist, particularly given the extent to which Google use bots themselves. For example, "the new way to stop bots", "alert you of suspicious traffic", "identify the pattern of attackers", "pages are being targeted by bots", "stay ahead of attackers and keep the Internet easy and safe to use (except for bots)" Many companies have built valuable services by automating HTTP requests. One might…
> Many companies have built valuable services by automating HTTP requests. One might even think that Google would like them to stop.
Exactly this. Note that reCaptcha v3 is meant to be placed on every page, not just forms, and returns a "bot score" which the site can use for any purpose. I can see any new web search engine being horribly muffled by the (mis)use of reCaptcha v3.
Re: Recaptcha v3: new way to stop bots
#75Earlier quoted context omitted.
I'd suggest CAPTCHA nay-sayers to come up with alternatives. The implied alternative is, by default, constant abuse, phishery, scrapping, automated login attempts, and DDoS. Which sometimes may be fine, and many times is just not acceptable.
If a CAPTCHA is the only thing keeping your site secure from abuse then I think you have larger problems.
It probably eliminates 90% of it for 90% of websites, like off-the-shelf spamware hitting your blog's comments.
The prevention measure you create for the remaining 10% (like a moderation queue + human review if you can afford it) is likely to only work because its workload is diminished 90% by a crude measure like ReCaptcha.
Your dismissal doesn't illuminate anything. It turns out that abuse prevention is hard and costly.
Re: Recaptcha v3: new way to stop bots
#76Sorry your citizen score is not high enough to access this website.
That would be a government doing that (I wish we could say just one, but when it comes to restrictions based on "citizen status", it's really not just China), not Google, a private company. But the big point is Google is not the Chinese state. In fact, one might say, quite accurately, that they're not very friendly.
[deleted]
Re: Recaptcha v3: new way to stop bots
#77While we hate Google for the privacy invasion in advertising, reCAPTCHA is one the areas that is a definite positive. Google has the data and the unique position to make the web safer. I wish they did more.
Need to give them credit for fighting: hurting malicious websites by not sending them traffic, keeping search results relevant against SEO abuses, cutting down email spam effectiveness, ... and reCaptcha.
All of this becomes very relevant when you run our own online business like I do. You can lament that google knows you're shopping for a new car, but my users lose real dollars if a scammer gets on my website - and google provides the tools to combat this.
And, no you can't implement your own captcha. No matter how smart you think you are, you don't have the data that Google does.
Re: Recaptcha v3: new way to stop bots
#78Earlier quoted context omitted.
Probably WAI. What is the incentive for the site owner to provide a streamlined experience to an user that will consume resources but intentionally prevent monetization? Not sure I agree with it, but it is obvious to expect that.
Hold on. Who says the sites using CAPTCHA are also the sites that have an ad based monetization model? The other day I was logging into newegg to order something and I was presented with reCAPTCHA, for which I had to solve 4-5 challenges before letting through. Looking through the documentations for reCAPTCHA v3, it wants to load a script from Google's servers. As an end user I do not want Google to track me across t…
Youtube doesnt seem to save settings like darkmode and languagues (defaulting to my localized option instead of my set language) with ad block from ghostery
Re: Recaptcha v3: new way to stop bots
#79The language used seems alarmist, particularly given the extent to which Google use bots themselves. For example, "the new way to stop bots", "alert you of suspicious traffic", "identify the pattern of attackers", "pages are being targeted by bots", "stay ahead of attackers and keep the Internet easy and safe to use (except for bots)" Many companies have built valuable services by automating HTTP requests. One might…
But you can't seriously expect site owners to just deal with the amount of spam bots can generate because it'd be 1% more equitable to users (that would be driven out by those very bots reCaptcha protects you from btw) And who pays for those costs ? Who eliminates the tons of spam posted ?
You seem to think that I'm against spam protection mechanisms, which I'm not. I am concerned that this will be used to 'protect' GET requests rather than POST requests, so to speak.
Re: Recaptcha v3: new way to stop bots
#80Earlier quoted context omitted.
I'd suggest CAPTCHA nay-sayers to come up with alternatives. The implied alternative is, by default, constant abuse, phishery, scrapping, automated login attempts, and DDoS. Which sometimes may be fine, and many times is just not acceptable.
If a CAPTCHA is the only thing keeping your site secure from abuse then I think you have larger problems.
> If a CAPTCHA is the only thing keeping your site secure from abuse then I think you have larger problems.
This is one of those pithy remarks that add zero value to a discussion.
I'm curious how you would approach blocking automated access to various parts of your site?