Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Recaptcha v3: new way to stop bots

webmasters.googleblog.com

Post reply on HN
Print view View original

91–100 of 147 posts

Re: Recaptcha v3: new way to stop bots

#91

Post by pdkl95 »

jontro wrote: post #87
pdkl95 wrote: post #81

Recaptcha v3 explicitly bans any browser that isn't one of "the two most recent major versions"[1] of Chrome, Firefox, Safari, or Edge. I don't mean it falls back to showing you an annoying select-the-picture quiz; if Google doesn't like your browser, the recaptcha widget replaces itself with: > Please upgrade to a supported browser to get a reCAPTCHA challenge. There are many reasons this is bad, but for now I'll po…

Are you sure you're talking about v3? I don't think v3 will display anything no matter what browser you're running, instead it's up to you to do that.

Regardless of version number, it's new behavior that seems to roughly align with the arrival of v3. I used to be able to pass most recaptcha, but now I get that message on some sites (which are now completely inaccessible).

Re: Recaptcha v3: new way to stop bots

#92

Post by pwnna »

avip wrote: post #83
pwnna wrote: post #50

Earlier quoted context omitted.

To put it bluntly.. I think this "just don't use it" meme needs to die. At this point in time, accessing certain websites is effectively a requirement of modern life: want to see your bills without paying for paper bills? want to apply for jobs? want to sign up for courses? submit your taxes? or even vote under some jurisdictions? Then you have to access a website. Sure, for a lot of these, there are alternatives. Ho…

I tend to agree that public services (in the sense of .gov) should avoid using this. But they do need protective measures. Would logging in with a futuristic Aadhaar equivalent be considered less intrusive?

If the only websites that we essentially have to utilize as competent citizens are public ones then it would be easy. We regulate the public ones and we let the private ones do whatever they want. At that point I think a bunch of people on this site will probably be content quitting the internet heh :).

The problem is that it's not that simple. As I said, for things like banks/job search, these are private entities and not public ones. Going down that line, we can find some private services that a majority of the population around you uses that you also have to use in order to keep up with everyone else because there are little alternatives (google maps comes to mind). Granted, the latter is a weaker example, but it's meant to explore how practical it is to completely ditch services that are anti-user.

Also don't get me wrong.. I'll probably be one to turn off my blocker to access some service that will provide me value even if I'm already paying for it. However, it's just a terrible state to be in.

Re: Recaptcha v3: new way to stop bots

#93

Post by esotericn »

Can someone explain to me why CAPTCHAs are used all over the place for sites that don't have user interactions?

I understand it for account creation. I understand it a bit less for login (seems like a lazy way of preventing automated attempts).

But for simply accessing a site? What gives?

I'm increasingly starting to find that only tech blogs, the odd big site I'm logged in on like Amazon, and sites like HN are usable lately, because anything else seems to require a 1 minute + gateway of CAPTCHA + GDPR + whatever else before I can actually get to the site.

Is it some way of filtering out users the sites don't want without expressly having a "403 Forbidden" or whatever?

Re: Recaptcha v3: new way to stop bots

#94

Post by esotericn »

wild_preference wrote: post #49
robin_reala wrote: post #45

Earlier quoted context omitted.

No. They say they do, but neither me not any of the team that tried it was able to complete a single test of the ReCAPTCHA accessible fallbacks. 0%. This was a couple of years ago, but at that point at least putting ReCAPTCHA into a site was putting a fixed roadblock in for people with visual impairments strong enough to force them down their audio route.

You're going to lose users or time/money with any abuse prevention. But you lose even more by letting things like spammers run rampant on your platform. You're stuck analyzing trade-offs, not ignoring reality. Once again, all trails lead back to you providing some alternative solutions instead of the empty catharsis of coming up with downsides to something in an internet comment. Here's one of my own: Isn't it annoyi…

I don't see reCAPTCHA use being limited to this sort of case at all.

On the contrary, many websites use it as an initial gate before I get to see anything.

Re: Recaptcha v3: new way to stop bots

#95

Post by KenanSulayman »

esotericn wrote: post #93

Can someone explain to me why CAPTCHAs are used all over the place for sites that don't have user interactions? I understand it for account creation. I understand it a bit less for login (seems like a lazy way of preventing automated attempts). But for simply accessing a site? What gives? I'm increasingly starting to find that only tech blogs, the odd big site I'm logged in on like Amazon, and sites like HN are usabl…

It's people afraid of others crawling their content.

Re: Recaptcha v3: new way to stop bots

#96

Post by chickenfries »

spookthesunset wrote: post #80
chickenfries wrote: post #62

Earlier quoted context omitted.

If a CAPTCHA is the only thing keeping your site secure from abuse then I think you have larger problems.

> If a CAPTCHA is the only thing keeping your site secure from abuse then I think you have larger problems. This is one of those pithy remarks that add zero value to a discussion. I'm curious how you would approach blocking automated access to various parts of your site?

Well usually ReCAPCHA is usually used on sign in pages. You can rate limit login attempts, exponentially increasing rate limit (or just locking out) IPs that exceed allowed login attempts and analyze your logs to ban abusive IPs.

Yeah, that's harder than ReCAPTCHA, but I think a lot of these big companies can afford to do these pretty basic steps.

If you just want to throw some comments on your free blog and not have to moderate the comments (and honestly, how many comments does your blog get that you can't read them?) then sure, throw ReCAPTCHA on there. But there are plenty of big companies that use ReCAPTCHA.

Re: Recaptcha v3: new way to stop bots

#97

Post by RandomInteger4 »

robin_reala wrote: post #34
wild_preference wrote: post #13

Earlier quoted context omitted.

On the flip side, abuse exists, and wishing that anti-abuse measures went away does not acknowledge reality. Just like how I'm annoyed when I have to pay for a cup of coffee, but my annoyance doesn't really inform how things should be. Besides, if a relatively simple puzzle is too much to ask, then maybe you didn't care all that much to begin with. I can think of various platforms where this would be a good filter ev…

The puzzles aren’t simple if you’re blind or hard of vision. Or don’t have a US cultural background (I personally know a sidewalk is US English for a pavement, but I definitely don’t recognise all US street signs or shop hoardings, and have been caught out by that before).

You realize that when you're doing these CAPTCHAs, you're on the internet right? You could ask Google or DDG, "What is an XYZ?" and they would happily provide examples.

Honestly, you're kind of insulting the intelligence of most people without a US cultural background.

Re: Recaptcha v3: new way to stop bots

#99

Post by keehun »

candiodari wrote: post #66
keehun wrote: post #19

> Since reCAPTCHA v3 doesn't interrupt users, we recommend adding reCAPTCHA v3 to multiple pages. Frictionless user interfaces arr great, but could this be a ploy to get websites to add Google-property tracking JS on more pages?

... in trade for a valuable service. I mean, you must hate cloud software if you've got problems with this. Surprise ! Almost all software, from steam to windows, to fusion360, to fastmail, to github, office, ... is cloud software. Just naming some random examples. All have the same problem, most without providing any service (hat off to fastmail and github though, who provide service, like Google, in trade for cloud…

I was just pointing out the fact that reCaptcha v2 was only on a few pages by design, and now Google wants us to put it on many pages. It's fundamentally changed its purpose from being a gatekeeper of spam/abuse on forms to a "Citizen Score" reporting "agency". I won't even engage with your troll-like point that I must hate cloud software.

Re: Recaptcha v3: new way to stop bots

#100

Post by spookthesunset »

chickenfries wrote: post #96
spookthesunset wrote: post #80

Earlier quoted context omitted.

> If a CAPTCHA is the only thing keeping your site secure from abuse then I think you have larger problems. This is one of those pithy remarks that add zero value to a discussion. I'm curious how you would approach blocking automated access to various parts of your site?

Well usually ReCAPCHA is usually used on sign in pages. You can rate limit login attempts, exponentially increasing rate limit (or just locking out) IPs that exceed allowed login attempts and analyze your logs to ban abusive IPs. Yeah, that's harder than ReCAPTCHA, but I think a lot of these big companies can afford to do these pretty basic steps. If you just want to throw some comments on your free blog and not have…

> You can rate limit login attempts, exponentially increasing rate limit (or just locking out) IPs that exceed allowed login attempts and analyze your logs to ban abusive IPs.

Rate limiting and bot blocking are two totally different things. Rate limiting only increases the cost of a bot attack. Either they need more IP's (which are dirt cheap in the black market) or they need more time--either way it is increased cost. But it won't stop a bot. Just slow it.

Banning IP's might have worked back in 2000, but these days it is useless. Bypassing an IP block is trivially easy for even a low-sophistication attacker.

Post reply on HN