Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s new reCAPTCHA has a dark side

fastcompany.com

Post reply on HN
Print view View original

11–20 of 566 posts

Re: Google’s new reCAPTCHA has a dark side

#11

Post by octosphere »

Google's captcha system is overkill for most websites. If I want to filter out bad actors (on a simple straight-forward site), there are other more simpler and easier to solve captcha systems out there. They might not have the rigour of Google's system, but they do the job, and well.

I would however use Google's system if the site is massive and there is the possibility that someone is using a script or some program to algorithmically bypass the (simple) captcha, and register accounts en-masse and trying to create a psyop[0], or disinformation campaign, or even a sockpuppet army.

[0] https://en.wikipedia.org/wiki/Psychological_Operations_(Unit...

Re: Google’s new reCAPTCHA has a dark side

#12

Post by sleavey »

cbsks wrote: post #5

You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor... I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does. Edit: I also got 0.7 on Firefox with st…

I get 0.1 continuously, possibly because I have resist fingerprinting enabled in Firefox. I'm not changing anything to compensate that score; it shows I must be doing something right. If I encounter a reCAPTCHA I will continue to (usually) just leave the site it's on.

Re: Google’s new reCAPTCHA has a dark side

#13

Post by del82 »

cbsks wrote: post #5

You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor... I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does. Edit: I also got 0.7 on Firefox with st…

Oscillates between 0.1 and 0.7 for me, and I'm changing nothing on my end (just hitting "Try again"). Does it have to do with refresh speed, I wonder?

Privacy Badger and ABP on my work (less-locked-down) Mac.

Re: Google’s new reCAPTCHA has a dark side

#14

Post by kop316 »

octosphere wrote: post #11

Google's captcha system is overkill for most websites. If I want to filter out bad actors (on a simple straight-forward site), there are other more simpler and easier to solve captcha systems out there. They might not have the rigour of Google's system, but they do the job, and well. I would however use Google's system if the site is massive and there is the possibility that someone is using a script or some program…

Which Captcha systems would you recommend?

Re: Google’s new reCAPTCHA has a dark side

#15

Post by eli »

octosphere wrote: post #11

Google's captcha system is overkill for most websites. If I want to filter out bad actors (on a simple straight-forward site), there are other more simpler and easier to solve captcha systems out there. They might not have the rigour of Google's system, but they do the job, and well. I would however use Google's system if the site is massive and there is the possibility that someone is using a script or some program…

There are diminishing returns once a CAPTCHA gets past a certain point. Bad actors can (and do) just humans to fill out captchas all day. We get some spam submissions on our sites that I'm 99.9% certain are people in developing countries copy/pasting spam templates and filling out captchas by hand.

Re: Google’s new reCAPTCHA has a dark side

#18

Post by danShumway »

cbsks wrote: post #5

You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor... I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does. Edit: I also got 0.7 on Firefox with st…

With Firefox fingerprint resisting turned on and with Ublock Origin/UMatrix, I get a score of 0.1. And I'm not even on a VPN; I'm sure on my home network I'd have an even lower score.

To me, it feels like Google's entire strategy behind reCaptcha is to make it harder to protect your privacy. We've basically given up on the idea that there are tasks only humans can do, and to me V3 feels like Google openly saying, "You know how we can prove you're not a robot? Because we literally know exactly who you are." I don't even know if it should be called a captcha -- it feels like it's just identity verification.

I don't think this is an acceptable tradeoff. I know that when reCaptcha shows up on HN there's often a crowd that says, "but how else can we block bots?" I'm gonna draw a personal line in the sand and say that I think protecting privacy is more important than stopping bots. If your website can't stop bots without violating my privacy, then I'm starting to feel like I might be on the bots' side.

Re: Google’s new reCAPTCHA has a dark side

#19

Post by mrosett »

The subheadline gets it right:

> It’s great for security—but not so great for your privacy.

For individual users, security and privacy frequently go hand-in-hand. But for site operators, user privacy makes security a lot harder. The more you know about a user, the easier it is to figure out if they're an adversary.

Post reply on HN