Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Recaptcha v3: new way to stop bots

webmasters.googleblog.com

Post reply on HN
Print view View original

81–90 of 147 posts

Re: Recaptcha v3: new way to stop bots

#81

Post by pdkl95 »

Recaptcha v3 explicitly bans any browser that isn't one of "the two most recent major versions"[1] of Chrome, Firefox, Safari, or Edge. I don't mean it falls back to showing you an annoying select-the-picture quiz; if Google doesn't like your browser, the recaptcha widget replaces itself with:

> Please upgrade to a supported browser to get a reCAPTCHA challenge.

There are many reasons this is bad, but for now I'll point out that creating barriers that prevent new competitors from entering an established market is the behavior of a monopolist abusing their power over a market.

[1] https://support.google.com/recaptcha/?hl=en#6223828

Re: Recaptcha v3: new way to stop bots

#82

Post by [deleted] »

avip wrote: post #39
_pghu wrote: post #22

No, no, no, no. I do not want Google to have any more fucking data about me than it already does! "Put this blob of JavaScript on every page of your site so that we can see how users are clicking, scrolling, and browsing around. Think of the children^W spam and abuse!" I just cannot believe that Google somehow gets away with spinning this as some sort of "guardian of the Internet" thing when it is a transparent attem…

You seem to subtly express the notion that we are somehow "entitled" to access a website, just because it has a public IP address and we happen to have an http client. Well - we're not.

[deleted]

Re: Recaptcha v3: new way to stop bots

#83

Post by avip »

pwnna wrote: post #50
avip wrote: post #39

Earlier quoted context omitted.

You seem to subtly express the notion that we are somehow "entitled" to access a website, just because it has a public IP address and we happen to have an http client. Well - we're not.

To put it bluntly.. I think this "just don't use it" meme needs to die. At this point in time, accessing certain websites is effectively a requirement of modern life: want to see your bills without paying for paper bills? want to apply for jobs? want to sign up for courses? submit your taxes? or even vote under some jurisdictions? Then you have to access a website. Sure, for a lot of these, there are alternatives. Ho…

I tend to agree that public services (in the sense of .gov) should avoid using this. But they do need protective measures. Would logging in with a futuristic Aadhaar equivalent be considered less intrusive?

Re: Recaptcha v3: new way to stop bots

#84

Post by avip »

jocoda wrote: post #64
avip wrote: post #39

Earlier quoted context omitted.

You seem to subtly express the notion that we are somehow "entitled" to access a website, just because it has a public IP address and we happen to have an http client. Well - we're not.

Had to do a double take here. Not sure that this, as a blanket statement can be correct. How can anyone not be entitled to connect to any public IP address? And how, and who, would be able to enforce that? A server can put various measures in place to limit general access, but then by those measures the IP is no longer public. T&Cs that a site may wish to enforce can only be made available after the connection has al…

The IP is public in the sense that a pub's door is public. You're welcome to open it. The bouncer may throw you out without explanations (maybe you wore a hoodie, idk). You walk in under terms. You don't have some birthright to lurk there and harass the customers.

Re: Recaptcha v3: new way to stop bots

#85

Post by avip »

wild_preference wrote: post #75
chickenfries wrote: post #62

Earlier quoted context omitted.

If a CAPTCHA is the only thing keeping your site secure from abuse then I think you have larger problems.

It probably eliminates 90% of it for 90% of websites, like off-the-shelf spamware hitting your blog's comments. The prevention measure you create for the remaining 10% (like a moderation queue + human review if you can afford it) is likely to only work because its workload is diminished 90% by a crude measure like ReCaptcha. Your dismissal doesn't illuminate anything. It turns out that abuse prevention is hard and co…

> It turns out that abuse prevention is hard and costly

This should come as Tshirt or coffee mug.

Re: Recaptcha v3: new way to stop bots

#86

Post by bassman9000 »

canadapups wrote: post #77

While we hate Google for the privacy invasion in advertising, reCAPTCHA is one the areas that is a definite positive. Google has the data and the unique position to make the web safer. I wish they did more. Need to give them credit for fighting: hurting malicious websites by not sending them traffic, keeping search results relevant against SEO abuses, cutting down email spam effectiveness, ... and reCaptcha. All of t…

Poe's law?

https://siftery.com/recaptcha/alternatives

Re: Recaptcha v3: new way to stop bots

#87

Post by jontro »

pdkl95 wrote: post #81

Recaptcha v3 explicitly bans any browser that isn't one of "the two most recent major versions"[1] of Chrome, Firefox, Safari, or Edge. I don't mean it falls back to showing you an annoying select-the-picture quiz; if Google doesn't like your browser, the recaptcha widget replaces itself with: > Please upgrade to a supported browser to get a reCAPTCHA challenge. There are many reasons this is bad, but for now I'll po…

Are you sure you're talking about v3? I don't think v3 will display anything no matter what browser you're running, instead it's up to you to do that.

Re: Recaptcha v3: new way to stop bots

#89

Post by zawerf »

I got hit by "Distributed Spam Distraction" recently.

It works by having a bot signup on thousands of websites at once with your email. The purpose is to flood your email with hundreds of welcome message emails every minute so you will miss the real security message emails (such as someone resetting your password).

What makes this attack so evil is that these are real sites you have to individually unsubscribe after the attack is over. This includes many sites from countries without email unsubscribing laws. So to this day, I still get hundreds of emails everyday from these sites who think I have signed up for their newsletter/product/etc.

I would not be against enforcing a captcha on every site out there just to prevent these kinds of attacks.

Re: Recaptcha v3: new way to stop bots

#90

Post by Yetanfou »

Another thing which can be gleaned from the progression of ReCAPTCHA from v1 - enter street names and house numbers into this box please - through v2 - identify images with street signs, shop fronts, buses, cars - to v3 - only Chrome/Firefox/Edge/Safari users welcome is that Google Maps (and related units) no longer needs ReCAPTCHA users to read those street names and house numbers as that task is now reliably performed by software, nor does it need help to separate shop fronts from normal facades or traffic signs from billboards. Now that these tasks can be handed over from mechanical Turks to the server farm ReCAPTCHA can be turned to other purposes like giving Chrome an extra boost.
Post reply on HN