Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why can’t a bot tick the 'I'm not a robot' box?

quora.com

Post reply on HN
Print view View original

51–60 of 647 posts

Re: Why can’t a bot tick the 'I'm not a robot' box?

#51

Post by jcoffland »

Kalium wrote: post #18
malvosenior wrote: post #15

Earlier quoted context omitted.

> Well in excess of 90% of traffic coming out of TOR is spam, bots, malicious, or some combination! Do you have any data on this?

An excellent, wise, and cogent question! In fact I do have data. You can find it here: https://blog.cloudflare.com/the-trouble-with-tor/ > On the other hand, anonymity is also something that provides value to online attackers. Based on data across the CloudFlare network, 94% of requests that we see across the Tor network are per se malicious. That doesn’t mean they are visiting controversial content, but instead that…

A small percentage of bad actors using automaton can produce a lot of traffic. So although it may be true that a large portion of the requests coming from TOR exit nodes is malicious, it would be unwise to conclude that most users of TOR have bad intentions.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#52

Post by mehrdadn »

jononor wrote: post #46
mehrdadn wrote: post #41

Earlier quoted context omitted.

I'm convinced the ambiguity is intentional. What I don't get is what answer they expect in those scenarios.

It is just a consequence of other humans also having problems with these cases. They do not mind that you have to make multiple attempts, it is just more yummy data for their bots (their machine learning algorithms are trained on this stuff).

I'm pretty convinced they're not really using these for ML, but that their ML algorithms have already run on these and they already know these difficult (read: ambiguous) enough to make you give up. These cases specifically only come up when they seem to think you're probably a bot (based on cookies or IP or whatever). They seem to deliberately put the photo boundaries such that they slice through whatever object they want you to look for. And they intentionally make the delays extremely long. These don't happen when they think you're probably a human and just want to throw an extra hurdle (like if you're Googling a little too frequently from your usual browser/location).

Re: Why can’t a bot tick the 'I'm not a robot' box?

#53

Post by scarejunba »

_the_inflator wrote: post #27

Put another way: basically this is another Google tool to track user behaviour that validates the fingerprint Google already has. Sneaky!

Honestly, if there were a web standard where I could opt-in to all of this tracking and it meant I would be ‘trusted’ I’d happily have my user agent send them almost anything they want. I trust Google not to fuck me.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#54

Post by kevingrahl »

scrooched_moose wrote: post #47
pixl97 wrote: post #26

Earlier quoted context omitted.

Turn off javascript, mostly. To hide your ip you need to use a VPN.

Is noscript still the best for that? I haven't looked at other options in a long time.

If you want more granularity I’d suggest giving uMatrix a try. You’ll basically break every site at first and have to make adjustments for every site you visit (whitelist certain Ressourcen on a per domain basis) but I think it’s well worth it.

NoScript (which is totally fine) just blocks all JS, uMatrix can block much more.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#55

Post by woogley »

scrooched_moose wrote: post #47
pixl97 wrote: post #26

Earlier quoted context omitted.

Turn off javascript, mostly. To hide your ip you need to use a VPN.

Is noscript still the best for that? I haven't looked at other options in a long time.

Personally I prefer uMatrix. It has a nice CSS-ish quality to it, e.g. you can whitelist random subdomains like *.cloudfront.net _if_ the root page is a domain you trust already.

It's still a pain to get rolling at first but it feels more friendly to me than noscript

Re: Why can’t a bot tick the 'I'm not a robot' box?

#57

Post by eseehausen »

noir_lord wrote: post #44
wmf wrote: post #38

Earlier quoted context omitted.

The script can detect the difference between real Chrome and headless Chrome.

Point a webcam at the screen and wire a mouse to the computer controlling the webcam, you'd have to simulate the computer moving the mouse like a human would but I don't see why it wouldn't work.

Because humans still get the picture selection prompts, so you'd have to write code good enough to read the prompt and then select the appropriate images.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#58

Post by joshuamorton »

noir_lord wrote: post #44
wmf wrote: post #38

Earlier quoted context omitted.

The script can detect the difference between real Chrome and headless Chrome.

Point a webcam at the screen and wire a mouse to the computer controlling the webcam, you'd have to simulate the computer moving the mouse like a human would but I don't see why it wouldn't work.

You've now forced spammers to purchase webcams. And write code or whatever to make realistic mouse movements. This is expensive. Whatever they're doing likely isn't worth it anymore.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#59

Post by bluedino »

michaelmrose wrote: post #36
djflutt3rshy wrote: post #2

The box has made browsing using TOR insufferable! It fusses and makes me click storefronts and traffic lights until I run out of patience and close out of whatever webpage I was trying to visit. I assume it has to do with a lack of Google cookies on the browser, essentially punishing me for trying to protect my privacy.

Have you considered an out of country vpn? The privacy protection may be similar for most common browsing.

Too bad more and more services block VPN’s.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#60

Post by packetslave »

Kalium wrote: post #7
djflutt3rshy wrote: post #2

The box has made browsing using TOR insufferable! It fusses and makes me click storefronts and traffic lights until I run out of patience and close out of whatever webpage I was trying to visit. I assume it has to do with a lack of Google cookies on the browser, essentially punishing me for trying to protect my privacy.

This might surprise you, but it actually has to do with what traffic coming out of TOR looks like. Well in excess of 90% of traffic coming out of TOR is spam, bots, malicious, or some combination! Google isn't going out of their way to punish you for trying to protect your privacy. They're trying to stop unwanted traffic. By unfortunate happenstance, you appear to be disguising yourself in the exact same way a shocki…

This. The reality is, Google (and Cloudflare, and everyone else trying to block scrapers and malicious traffic) use heuristics that boil down to "99% of our traffic behaves like this". If you go out of your way to fall into the 1%, e.g. using Tor, disabling Javascript, randomizing your user-agent, etc., you're going to get CAPTCHAed.
Post reply on HN