I find it strange how all the comments here are blaming Google. Isn't it obvious that CAPTCHAs have gotten difficult because AI got better at solving them? Soon bots will be better than humans at solving CAPTCHAs, and the system will fail completely. I predict that then Google and Facebook will completely block new user signup from Tor, VPNs or browsers without cookines. Everyone else will require an existing Google, Facebook or similar account to create an account.
Why Captchas have gotten so difficult
81–90 of 218 posts
Re: Why Captchas have gotten so difficult
#82And I SUCK at these to the point where I think I’m not getting the rules of the game. For example, for the one with traffic lights: Am I supposed to just mark the light bulbs or also the poles and beams?
You're doing it right. Google is gaslighting you; lying and telling you you've failed challenges when you actually solved them correctly. They do this to punish users who opt out of the google 'ecosystem' by not having a google account, not using chrome, using adblockers, etc. The proof of this assertion comes when you manage to enable the noscript version of reCAPTCHA (which is only available on sites that have opte…
I actually don't think that they are trying to punish people for not being logged in. If that were the case, they would make it clear that having a Google account and leaving it logged in, and using chrome would make the captchas appear less frequently or not at all.
In reality, I think they are telling people they were wrong in order to extract just a little bit more free machine learning data from them. And really, they don't actually tell you that you are wrong, they just keep feeding you new questions. This is most likely because they don't know whether your answer is correct or not. They are giving this specific question to a bunch of people, then comparing the answers to get a correct response for later.
So you might get a few training questions first, then end with a question that they already know the correct answer to so they can decide if you are trying or not.
It's quite brilliant and is going to really catapult Google ahead of the rest of the world when it comes to self driving cars. The cars will be able to use all the captcha data to not only train their ML models to recognize things like signs and whatever, but the ML won't even be fully necessary since they have the re-captcha volume to basically directly identify every roadside visual on the planet one by one.
Re: Why Captchas have gotten so difficult
#83Earlier quoted context omitted.
This doesn't really hold water. 1. It's not feasible for various website to implement their own custom CAPTCHA formats. Building custom CAPTCHAs is a lot of work. 2. The custom CAPTCHA tasks wouldn't be that different from each other. As the article discusses, image/text/audio recognition are some of the only universal tasks that can work for CAPTCHA. 3. Nothing is stopping a malicious actor from implementing a "chec…
1. As I said, this is a huge reason stuff like Recaptcha exists, and why custom ones can't work here, even if they're probably better if done correctly. 2. You can also use stuff like timing how long it takes someone to fill in the field, hiding form fields with CSS or JavaScript, randomising field input names, checking the referrer, etc. All these come up in tutorials about captchas. 3. You could ask them niche spec…
#3 (a rotation of specific questions) is definitely a measure some sites could use, but as you point out, it's incredibly niche -- I've only even seen it on forums. For example, what questions could Reddit ask you? Wario Forums is pretty much the ideal on the niche spectrum, so it's not a very useful baseline for comparison.
I rotated questions on the /register page for a large forum I run, but as my forum became more popular and more of a spam magnet, my attackers simply built a lookup table of my questions->answers. I regressed back to Recaptcha.
Another problem is that I was surprised how many legit users would be pruned out by a simple question like the equivalent of "what color is Wario's hat?" for, say, a forum that covers games in general. I did basic stat tracking on the pass-rate per question to know which were bad ones, and it seemed pretty random which ones users had trouble with. Or they'd accidentally be riddles like (made-up example) "How many triangles in a triforce?" 3? 4? 5?
And people would finally register and complain on the forum that a seemingly trivial question was too hard. Or they didn't know what "the website footer" was.
At a point, especially if you're not so extreme on the niche/theme spectrum, Recaptcha was the better trade-off.
I've said this in another comment, but I'd love to see an HN submission where we discuss anti-spam/anti-abuse strategies instead of just doing the easy thing of bashing Recaptcha.
Re: Why Captchas have gotten so difficult
#84Earlier quoted context omitted.
The worst part is that quite a huge percentage of the Internet relies on it! Soon we won't be able to use any sites whatsoever because of it. I don't like where this is going. :/
Indeed, I definitely am not happy with how much control Google has over the Internet in general. Everything from how they present and rank search results, Google Analytics scripts everywhere, the sometimes vaguely-political messages on their homepage, the ostensibly-anti-bot checks including CAPTCHAs and just plain banning you if you want to do more "advanced" searches (like the ones Fravia would've taught...), etc.
There's other (mysterious to me) stuff that sites call to Google for, apart from captchas and analytics.
As a uMatrix (and former NoScript) user, I've long noticed that many sites make calls to ajax.googleapis.com for I have no idea what. Quite often the site will refuse to work without that.
To be fair, a lot of sites make use of javascript from a lot of other sites as well: cloudfront and amazon are common.
Re: Why Captchas have gotten so difficult
#85I find it strange how all the comments here are blaming Google. Isn't it obvious that CAPTCHAs have gotten difficult because AI got better at solving them? Soon bots will be better than humans at solving CAPTCHAs, and the system will fail completely. I predict that then Google and Facebook will completely block new user signup from Tor, VPNs or browsers without cookines. Everyone else will require an existing Google,…
I think the main thrust is that the tool is not fit for purpose, but Google benefits from it anyways. They get the AI training data, but the website owners still get hammered by bots, and privacy conscious users and users who have the audacity to be from a country flagged by RECAPTCHA get to struggle. Living in Russia at the moment, I almost prefer the sites that just outright block me to the stupid RECAPTCHA that cycles me through 3-4 iterations of images only to ask me to try again.
RECAPTCHA is no longer doing what it promised, and that's the general thrust of the article; the bots are just getting too good for it.
Re: Why Captchas have gotten so difficult
#86These really make my blood boil. I continually trip whatever it is that makes Google think I'm a bot (probably a VPN + ublock). Sometimes it takes upwards of 5 tries (each with 3 or 4 tests) to pass. After the first failure the audio one stops working, and sometimes that's unintelligible. I honestly wonder how anyone who's even slightly visually impaired is supposed to pass them. I wouldn't be surprised if in the not…
If you're using an adblocker, you probably also don't have any positively identifying google cookies, which has become more and more synonymous with "bot" to them. They could defend it from the opposite direction: when you're logged in to google they trust they know you, so when you're not, there's a lack of trust. Not suspicion, no, but a factual lack of trust. There's plausible deniability if anyone ever claimed it…
I use ublock. It doesn't block Google login cookies by default. I haven't noticed many issues with captchas lately, likely due to the fact that I stay logged in to my Gmail account in Firefox most of the time.
Re: Why Captchas have gotten so difficult
#87Google reCAPTCHA is the absolute worst. It makes me solve several puzzles very often, usually when I use a mobile network and I’m not logged in with any Google account. It’s so frustrating that most of the times I find a reCAPTCHA I give up before trying and just go elsewhere e.g. when a site uses reCAPTCHA for sign up or after the first failed login, I’ll most likely skip if I don’t absolutely need to access such we…
Bad guys also are getting tired and they start to hack more accounts of normal users because now those normal user accounts are worth more.
Re: Why Captchas have gotten so difficult
#88Google reCAPTCHA is the absolute worst. It makes me solve several puzzles very often, usually when I use a mobile network and I’m not logged in with any Google account. It’s so frustrating that most of the times I find a reCAPTCHA I give up before trying and just go elsewhere e.g. when a site uses reCAPTCHA for sign up or after the first failed login, I’ll most likely skip if I don’t absolutely need to access such we…
I can't use Google search directly any more without being presented with a never-ending series of these things. Thus I use DuckDuckGo, and if it returns inadequate results I rerun it with "!g" at the end which sends it to Google. That seems to work without CAPTCHAs.
Re: Why Captchas have gotten so difficult
#89Earlier quoted context omitted.
My first reaction to your comment was that I would be pretty shocked if anyone here didn’t realize that, and wouldn’t you know I have now read more of the comments and here I am shocked. The idea that this problem results from heightened security measures is wrong, but it’s not laughable; it’s just sad.
Whenever I browse with the TOR browser, it's been 100% impossible for me to verify myself as a human even if all my answers are correct. I think they need to fix this bug, or at least give a message that the CAPTCHA won't be solved so we no longer waste our time. Their No CAPTCHA's are very rare for me when I'm browsing logged in to my personal google account under the same session, on a normal browser. They can be c…
Oh wow, yeah I use FF with uBlock Origin and they are not short by any means.
An aside from the corporate dystopia at hand: I do not know as much as I wish about how this works, but am intrigued at how the objects so often bleed into other “boxes” at just the right amount to demand multitudes more cognitive energy to negotiate with myself over what side of this false binary to place my bets on.
Back to corporate dystopia, my awareness of the procedure and intent is so blackboxed that I feel like a mule. Since I started approaching them with sloppy selection and minimal to no discern, I’m doubtful that the length of the challenge has any correlation with a measurement of suspicion at all. Rather, those liable to be this considerate will similarly recognize identify the wrath the cookie monster.
Re: Why Captchas have gotten so difficult
#90I've long suspected that Google quickly realizes when the user is human, but then serves up some more images for them to "solve" to get some extra training data for its pattern recognition AIs.