Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Recaptcha v3: new way to stop bots

webmasters.googleblog.com

Post reply on HN
Print view View original

101–110 of 147 posts

Re: Recaptcha v3: new way to stop bots

#101

Post by tinus_hn »

spookthesunset wrote: post #100
chickenfries wrote: post #96

Earlier quoted context omitted.

Well usually ReCAPCHA is usually used on sign in pages. You can rate limit login attempts, exponentially increasing rate limit (or just locking out) IPs that exceed allowed login attempts and analyze your logs to ban abusive IPs. Yeah, that's harder than ReCAPTCHA, but I think a lot of these big companies can afford to do these pretty basic steps. If you just want to throw some comments on your free blog and not have…

> You can rate limit login attempts, exponentially increasing rate limit (or just locking out) IPs that exceed allowed login attempts and analyze your logs to ban abusive IPs. Rate limiting and bot blocking are two totally different things. Rate limiting only increases the cost of a bot attack. Either they need more IP's (which are dirt cheap in the black market) or they need more time--either way it is increased cos…

> Bypassing an IP block is trivially easy for even a low-sophistication attacker.

Not easy for an average user though.

Re: Recaptcha v3: new way to stop bots

#102

Post by tinus_hn »

hnaccy wrote: post #10

I hate Recaptcha. In my experience using Firefox and not being logged into a google account results in a very long if not impossible chain of captcha challenges.

Using TOR not logged into anything does not. Perhaps you’re not following the instructions correctly.

Re: Recaptcha v3: new way to stop bots

#103

Post by tinus_hn »

jannes wrote: post #12
hnaccy wrote: post #10

I hate Recaptcha. In my experience using Firefox and not being logged into a google account results in a very long if not impossible chain of captcha challenges.

Yes, same here. - Using Firefox with uBlock Origin - Not logged in to Google (at least outside of Firefox's containers) - Third-party cookies disabled + Cookie AutoDelete addon They present me with 3-5 captchas every time

Hardly surprising considering you are removing the cookies they use to remember you already passed the test.

Re: Recaptcha v3: new way to stop bots

#104

Post by jraph »

I block Google domains on my main browser profile, and JavaScript by default.

I noticed if I encounter a recaptcha on a website, I just tend to abandon and seek information elsewhere. Last time I was presented with a recaptcha when setting a search filter on a website. No, thanks. This is too much of a pain to unblock everything and answer a recaptcha. I'll pass.

When I do answer a recaptcha in despair, this is a pain to do.

Re: Recaptcha v3: new way to stop bots

#105

Post by tinus_hn »

superasn wrote: post #41

Their recaptcha is broken and causes a lot of pain especially when you're on an ISP that may have had some bad apples (pretty common in India where ISPs don't care about spam or piracy). It's like the whole neighborhood is paying the price of someone else's crime and it feels like the digital version of being racially profiled. Worst part is even after solving dozens of images (which keep refreshing by the way to no…

> especially when you're on an ISP that may have had some bad apples

This is like the old ‘unblock my spammy provider’ tune. Don’t expect the world to pay the price for your providers laziness.

Re: Recaptcha v3: new way to stop bots

#106

Post by tinus_hn »

zawerf wrote: post #89

I got hit by "Distributed Spam Distraction" recently. It works by having a bot signup on thousands of websites at once with your email. The purpose is to flood your email with hundreds of welcome message emails every minute so you will miss the real security message emails (such as someone resetting your password). What makes this attack so evil is that these are real sites you have to individually unsubscribe after…

How would that be enforced if you can’t even enforce confirmed opt-in?

Re: Recaptcha v3: new way to stop bots

#107

Post by majewsky »

tinus_hn wrote: post #103
jannes wrote: post #12

Earlier quoted context omitted.

Yes, same here. - Using Firefox with uBlock Origin - Not logged in to Google (at least outside of Firefox's containers) - Third-party cookies disabled + Cookie AutoDelete addon They present me with 3-5 captchas every time

Hardly surprising considering you are removing the cookies they use to remember you already passed the test.

I highly doubt that Google relies solely on cookies to identify someone.

Re: Recaptcha v3: new way to stop bots

#108

Post by majewsky »

candiodari wrote: post #66
keehun wrote: post #19

> Since reCAPTCHA v3 doesn't interrupt users, we recommend adding reCAPTCHA v3 to multiple pages. Frictionless user interfaces arr great, but could this be a ploy to get websites to add Google-property tracking JS on more pages?

... in trade for a valuable service. I mean, you must hate cloud software if you've got problems with this. Surprise ! Almost all software, from steam to windows, to fusion360, to fastmail, to github, office, ... is cloud software. Just naming some random examples. All have the same problem, most without providing any service (hat off to fastmail and github though, who provide service, like Google, in trade for cloud…

It's still deceptive.

German contract law has the notion of "unexpected clauses", especially for terms of services. Certain ToS clauses have been invalidated by courts even if the customer agrees to the contract that includes those ToS, because the clauses have been deemed "too unexpected". The basic idea is that people should not be expected to read the entire ToS before agreeing to them.

To me, this is sort of the same: When I visit github.com, my mental model says that GitHub will know about this and be able to run scripts in my browser. However, it would be "unexpected" in this sense, and therefore IMO deceptive, that visiting github.com causes my browser to run code from google.com.

Re: Recaptcha v3: new way to stop bots

#110

Post by rcMgD2BwE72F »

wild_preference wrote: post #29
rcMgD2BwE72F wrote: post #23

Earlier quoted context omitted.

Gotta feed the machine right? Just so you know, the more you protect your privacy, the more websites, everywhere, will have Recaptcha requires that you work for Waymo even though you do not want to work for them (you know, describing road signs, identifying potholes, finding traffic lights, etc). Want some privacy? OK, waste 2-3 minutes every 10 articles and work for Google. Don't want to work for Google? OK, disable…

I can enumerate why anything in the world is suboptimal. It's not a very strong point on its own. But notice that you haven't suggested an alternative. You're just lamenting one of the few, generalizable, cheap resources a website operator has to avoid abuse in a world where it's only getting easier and easier for bad actors. Your analysis is just as thorough as "but somehow it's OK to put locks on every door because…

The alternative is simple: decentralize the Internet, regulate Google for abuse of dominant position. Its size and power makes it completely unavoidable now and force users to work for them. One cannot have basic access to Internet websites and services without providing Google with personal data or work for them. If Google wasn't so big and did not collect/treat such a huge amount of personal data, we would a choice between multiple providers.

To read some articles, I am required to help Google improve its self driving company (Waymo "identify cars in the picturs", its OCR algo (Google Books, "write the two words"), its Maps service ("find house numbers" on Street View), etc. This free work makes Google increasingly competitive vs the alternatives, so Google can continue offering "free" services (like Recaptcha) and further compel users to work for them. You simply don't have a choice.

Post reply on HN