Why can’t a bot tick the 'I'm not a robot' box? • Hacker News Board

Re: Why can’t a bot tick the 'I'm not a robot' box?

#151

Post by Mirioron » Wed, Feb 13, 2019, 9:53 PM UTC

imtringued wrote: post #143

Kalium wrote: post #7

Earlier quoted context omitted.

This might surprise you, but it actually has to do with what traffic coming out of TOR looks like. Well in excess of 90% of traffic coming out of TOR is spam, bots, malicious, or some combination! Google isn't going out of their way to punish you for trying to protect your privacy. They're trying to stop unwanted traffic. By unfortunate happenstance, you appear to be disguising yourself in the exact same way a shocki…

>This might surprise you, but it actually has to do with what traffic coming out of TOR looks like. That's a massive load of bullshit. Google has a captcha challenge that only humans can solve. That alone is already sufficient to prevent unwanted traffic. That is how every captcha system works. However google is an exception. If you're logged in to a google account or are using chrome then google can use that informa…

This sounds like it should be illegal.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#152

Post by taftster » Wed, Feb 13, 2019, 9:53 PM UTC

I'm not convinced that picking the pictures has anything to do with actually convincing google if you're a bot or not. I mean sure, it's an indicator. But I _know_ that I can pick the right pictures of school buses and store fronts every freaking time, so that's only a very small indicator.

More likely, the majority of the algorithm is devoted to the "fingerprint" of your browser. If you have adblock running, you may not have a google ad cookie. If you have a randomizing user-agent addon, you're going to get blocked.

What we need, for captcha, is an addon that makes you look as human as possible. Mouse click timings become random. Javascript fingerprint becomes John Smith common. Third party cookies, temporarily enabled (and then pruned). VPN traffic routed through a common looking gateway that few bots use. etc. etc.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#153

Post by mike_hearn » Wed, Feb 13, 2019, 9:55 PM UTC

cr0sh wrote: post #121

joshuamorton wrote: post #58

Earlier quoted context omitted.

You've now forced spammers to purchase webcams. And write code or whatever to make realistic mouse movements. This is expensive. Whatever they're doing likely isn't worth it anymore.

fake-users-as-a-service business op? I can see it being possible - racks of "robot arms" that move mice based on whatever criteria is needed (in this case, reCaptcha). It works for 3D printing, as well as device testing - so in theory, this could be done too...

https://buyaccs.com/

It exists for a long time already.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#154

Post by justusthane » Wed, Feb 13, 2019, 9:55 PM UTC

warent wrote: post #149

xirdstl wrote: post #80

I feel a sense of dread whenever I see this box. Is it going to let me through, or am I going to spend the next few minutes futilely clicking signs and lights, only to give up and leave the site?

I'm willing to bet if you record how long you spend clicking signs and lights on average, it's going to be more like several seconds than a few minutes. This must be hyperbole. There are the outlier cases where it gets fairly annoying but otherwise, I'm not sure I understand the hostility toward such a benign system that actually does thwart bots very effectively.

Effective or not, I wouldn't exactly call it benign when it's aggressively fingerprinting you based on every bit of data it can access.

I disable most scripts using uBlock, but I have to make an exception for reCaptcha if I want to interact with half the web. I'm pretty sure due to that alone Google is able to track where I go.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#155

Post by russh » Wed, Feb 13, 2019, 9:56 PM UTC

afandian wrote: post #127

xirdstl wrote: post #120

Earlier quoted context omitted.

I'm getting closer to doing that. Lately, I check the box, and if I'm presented with images, I leave. I have also trained myself to wait a few seconds before clicking the box, which seems to help assert my humanity.

Wait til it's standing between you and your bank account.

You mean my Ex-bank account.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#156

Post by miguelmota » Wed, Feb 13, 2019, 9:56 PM UTC

As a user who's constantly clicking on the crosswalk or storefront images you can't help but to think that you're essentially working for free training Google's machine learning models by providing them with supervised data points.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#157

Post by derefr » Wed, Feb 13, 2019, 9:56 PM UTC

taftster wrote: post #152

I'm not convinced that picking the pictures has anything to do with actually convincing google if you're a bot or not. I mean sure, it's an indicator. But I _know_ that I can pick the right pictures of school buses and store fronts every freaking time, so that's only a very small indicator. More likely, the majority of the algorithm is devoted to the "fingerprint" of your browser. If you have adblock running, you may…

You're assuming that the picking-of-pictures validation logic cares solely about what pictures you pick. What if it cares about your "mouse click timings" not being random, but rather looking like the mouse movements of a human who is using eye saccades to examine and classify images, and then moves their mouse only when they see and find one, and sloppily at that?

Re: Why can’t a bot tick the 'I'm not a robot' box?

#158

Post by Mirioron » Wed, Feb 13, 2019, 9:57 PM UTC

rtkwe wrote: post #125

kevin_thibedeau wrote: post #45

Earlier quoted context omitted.

Randomized user agent also seems to trigger reCAPTCHA without real cause. Should be an ADA violation for doing that.

ADA? Americans with Disabilities Act? Why would that have any bearing on user agent randomization?

I think he means that having people fill out recaptcha all the time because they don't allow Google to track them should be an ADA violation.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#159

Post by tracker1 » Wed, Feb 13, 2019, 10:00 PM UTC

benologist wrote: post #85

xirdstl wrote: post #80

I feel a sense of dread whenever I see this box. Is it going to let me through, or am I going to spend the next few minutes futilely clicking signs and lights, only to give up and leave the site?

Someone is suing Apple for making 2FA too annoying, I only hope Google can be next for the significantly greater time being wasted on their stupid CAPTCHA. Why should any of us even care if someone accesses a website programmatically? It's almost definitely not my problem, and it's not even necessarily a problem it's just a way to access pages, made easier by Google in fact because it's a perfectly legitimate way to…

Apple's 2FA cannot be disabled, beyond that if you ever had two devices connected to your account, good luck getting them to use your verified phone instead... I was trying to get rid of a "your apple account... please sign in" via the app store, and the advice was to sign out then back in again... my only other apple device was in another city...

Phone calls to GF, to get her to login, similar issue, it was now signed out, and after another attempt, one of them showed the 2FA window, which got me in. At no point was I able to use the phone number also associated with my account, and it was a huge, long, pain in the ass. It's actually a huge part of why I won't buy an iPhone.

Re: Why can’t a bot tick the 'I'm not a robot' box?

#160

Post by learc83 » Wed, Feb 13, 2019, 10:01 PM UTC

seotut2 wrote: post #104

I think recaptcha and captcha in general are very overused today, as they cause way too much inconvenience for the user. Why discriminate against robots so much? What's so wrong about crawling or using automated tools? With today's networks and hardware performance most websites shouldn't concern themselves with denial-of-service type of attacks, unless they're past a certain threshold of popularity.

At work we have a scraper that likes to use a particularly expensive search query using hundreds of different ips dozens of times per second, all so that they can scrape data that is freely available from us as an XML feed at a different url.

Every time I found a way to fingerprint and block them, they'd change their bot to avoid detection. Captcha for rate limiting seemed like the least bad option.

However, eventually I decided that instead of blocking them, I'd return random results from the db. They weren't checking the data too thoroughly because to this day they haven't changed the bot to avoid my most recent pattern detection. They're still merrily scraping useless data.