Why can’t a bot tick the 'I'm not a robot' box? • Hacker News Board

Re: Why can’t a bot tick the 'I'm not a robot' box?

#21

Post by menacingly » Wed, Feb 13, 2019, 7:44 PM UTC

teilo wrote: post #6

djflutt3rshy wrote: post #2

The box has made browsing using TOR insufferable! It fusses and makes me click storefronts and traffic lights until I run out of patience and close out of whatever webpage I was trying to visit. I assume it has to do with a lack of Google cookies on the browser, essentially punishing me for trying to protect my privacy.

Those images are infuriating! Click all boxes with traffic lights. Ok, well, this one box just barely contains the bottom right corner of the traffic light. Click. Nope, that little corner didn't count. Try again. Ok, well on this one, the right side of the traffic light is only barely over the line, so I won't click it. Nope, that sliver of the light mattered this time. MF!

I assumed the infuriating ambiguity is intentional, in order to train some algorithm they need to know what the prevailing human correct judgement is in dicey situations

Re: Why can’t a bot tick the 'I'm not a robot' box?

#22

Post by Kalium » Wed, Feb 13, 2019, 7:44 PM UTC

xiphias2 wrote: post #14

Kalium wrote: post #7

Earlier quoted context omitted.

This might surprise you, but it actually has to do with what traffic coming out of TOR looks like. Well in excess of 90% of traffic coming out of TOR is spam, bots, malicious, or some combination! Google isn't going out of their way to punish you for trying to protect your privacy. They're trying to stop unwanted traffic. By unfortunate happenstance, you appear to be disguising yourself in the exact same way a shocki…

They could use a memory-hard hashing function, like ARGON2 for proof of work, it would make spamming much harder.

You're absolutely right! It could even be integrated meaningfully into browsers to make it easier to work with. Something Cloudflare's Privacy Pass (https://support.cloudflare.com/hc/en-us/articles/11500199265...) could work.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#23

Post by xiphias2 » Wed, Feb 13, 2019, 7:47 PM UTC

Kalium wrote: post #22

xiphias2 wrote: post #14

Earlier quoted context omitted.

They could use a memory-hard hashing function, like ARGON2 for proof of work, it would make spamming much harder.

You're absolutely right! It could even be integrated meaningfully into browsers to make it easier to work with. Something Cloudflare's Privacy Pass ( https://support.cloudflare.com/hc/en-us/articles/11500199265... ) could work.

It looks really nice.

It should be default for the TOR browser for sure, if just a few people use it, it decreases the anonimity set.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#24

Post by hombre_fatal » Wed, Feb 13, 2019, 7:48 PM UTC

xiphias2 wrote: post #14

Kalium wrote: post #7

Earlier quoted context omitted.

This might surprise you, but it actually has to do with what traffic coming out of TOR looks like. Well in excess of 90% of traffic coming out of TOR is spam, bots, malicious, or some combination! Google isn't going out of their way to punish you for trying to protect your privacy. They're trying to stop unwanted traffic. By unfortunate happenstance, you appear to be disguising yourself in the exact same way a shocki…

They could use a memory-hard hashing function, like ARGON2 for proof of work, it would make spamming much harder.

Not really, because spam isn't done on the spammer's hardware. Not to mention, an expensive hashing function is precisely something bots can do but humans cannot.

If you're putting constraints on Tor traffic, it's not because of raw throughput. It's because it's extremely poor quality traffic.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#25

Post by Kalium » Wed, Feb 13, 2019, 7:51 PM UTC

xiphias2 wrote: post #23

Kalium wrote: post #22

Earlier quoted context omitted.

You're absolutely right! It could even be integrated meaningfully into browsers to make it easier to work with. Something Cloudflare's Privacy Pass ( https://support.cloudflare.com/hc/en-us/articles/11500199265... ) could work.

It looks really nice. It should be default for the TOR browser for sure, if just a few people use it, it decreases the anonimity set.

Nah, it was released back in 2017. I've seen it discussed periodically ever since.

The issue with just doing memory-consuming work client-side is that it only marginally slows down spamming. Spammers tend to use compromised machines they don't own. Unless you can make it prohibitively expensive to calculate something using machines you don't pay for - perhaps not a trivial ask - you wind up needing a different set of tools. This is why Google tends to look at things that will exhibit human variation rather than pure computation.

It's not that your ideas aren't good. I'm sure ARGON2 has a use here! It's that this might not be a problem easily solved by consuming more resources.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#26

Post by pixl97 » Wed, Feb 13, 2019, 7:52 PM UTC

CodeMage wrote: post #11

Is there any place where I can find a comprehensive list of countermeasures to stop Google from recording and analyzing all the stuff that the article lists? According to the article: It turns out they record and analyse: - Your computer’s timezone and time - Your IP address and rough location - Your screen size and resolution - What browser you’re using - What plugins you’re using - How long the page took to display…

Turn off javascript, mostly. To hide your ip you need to use a VPN.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#27

Post by _the_inflator » Wed, Feb 13, 2019, 7:53 PM UTC

Put another way: basically this is another Google tool to track user behaviour that validates the fingerprint Google already has. Sneaky!

Re: Why can’t a bot tick the 'I'm not a robot' box?

#28

Post by byte1918 » Wed, Feb 13, 2019, 7:54 PM UTC

Kalium wrote: post #7

djflutt3rshy wrote: post #2

The box has made browsing using TOR insufferable! It fusses and makes me click storefronts and traffic lights until I run out of patience and close out of whatever webpage I was trying to visit. I assume it has to do with a lack of Google cookies on the browser, essentially punishing me for trying to protect my privacy.

This might surprise you, but it actually has to do with what traffic coming out of TOR looks like. Well in excess of 90% of traffic coming out of TOR is spam, bots, malicious, or some combination! Google isn't going out of their way to punish you for trying to protect your privacy. They're trying to stop unwanted traffic. By unfortunate happenstance, you appear to be disguising yourself in the exact same way a shocki…

I think you are partially wrong. Maybe Google is not doing this intentionally but it also doesn't happen just because traffic is coming out of a tor node. I am using ff with some of the recommended extensions from https://www.privacytools.io/ and I get to fill in traffic signs all the time. And yes I am logged into Google.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#29

Post by etiam » Wed, Feb 13, 2019, 7:55 PM UTC

kojackst wrote: post #20

djflutt3rshy wrote: post #2

The box has made browsing using TOR insufferable! It fusses and makes me click storefronts and traffic lights until I run out of patience and close out of whatever webpage I was trying to visit. I assume it has to do with a lack of Google cookies on the browser, essentially punishing me for trying to protect my privacy.

It goes like this: "so you want to be anonymous and won't let us track every single thing you do? ok, then you'll help us train our AI so we can improve our self-driving cars and improve how Google Maps extracts information from Street View images"

I always figured the main point was behavioral profiling on mouse and keystroke trajectories.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#30

Post by jiveturkey » Wed, Feb 13, 2019, 7:56 PM UTC

TFA is not very clear about what it's describing.

It is describing how the checkbox is collecting your browser's characteristics (eg they go to great length describing the webGL fingerprint) and your own characteristics (eg mouse behavior), such that when you click the box, you are determined to be a person or a bot. If they think you are a person, you don't have to do the CAPTCHA.

The whole bit about a double encrypted "VM" is overstating the case. The "VM" is "just" a bytecode interpreter, which at the end of the day can't do anything the browser's javascript engine can't do itself. Yes, it's some heavy obfuscation, and what's more interesting than the interpreter itself is the decision to spend what must have been lots of time/resources to develop it. It's security by obscurity, and in this case it is delivered to the client so obviously it's reversible. Maybe there's a deeper purpose.

EDIT: ah. the purpose is not to obfuscate. it is to fingerprint the CPU characteristics. by running their own interpreter, and changing the opcodes on the fly and such things, they can defeat JIT and learn something about the CPU itself. if they have user info (google cookie) they can know what CPU/CPUs that user typically uses and if "the checkbox" records something different it's a signal.