Google’s new reCAPTCHA has a dark side

Post by vmurthy » Thu, Jun 27, 2019, 3:59 PM UTC

LinuxBender wrote: post #58

So this is probably a bit off topic, but why don't more site owners just create their own unique anti-spam system? In my opinion, if they were simpler, yet all unique, there would be less bots that could mass spam and privacy would be improved. Even something as simple as a question: "How many legs does a spider have?" ____ And then cycle through different types of free form questions of things that most people shoul…

Post by crankylinuxuser » Thu, Jun 27, 2019, 3:59 PM UTC

cyphar wrote: post #44

cracker_jacks wrote: post #17

The other tradeoff is you're giving Google an extraordinary amount of power to decide who is allowed and not allowed on your website with no transparency on how this decision was made. Not sure what company is willing to blindly trust Google with that power.

Unfortunately, the answer is (basically) all of them. Combined with CloudFlare, even websites that aren't explicitly making that decision are still opting their users into both CloudFlare and Google's tracking. I use Tor fairly regularly and it's a complete nightmare. I sometimes spend 5-15 minutes solving reCAPTCHA (since your Tor circuit changes every 10 minutes this can result in having to solve the reCAPTCHA seve…

Post by [deleted] » Thu, Jun 27, 2019, 4:01 PM UTC

gok wrote: post #64

jcomis wrote: post #47

I hate the v3 reCAPTCHA. On FF, I usually KNOW I am answering correctly and it says I failed. I always have to go through it multiple times. It's maddening. It often leaves me second guessing myself... is that sliver of car counted? is a crossing signal a street light? What about those streetlights way off in the distance, do I select those two in addition to the ones front and center? That RV looks sort of like a bu…

It's not really about getting the questions right. The challenges they present aren't that hard for modern computer vision systems. It's more about verifying that you consider the question for a "human" amount of time, make your mouse move like a human might, etc.

Post by nothis » Thu, Jun 27, 2019, 4:01 PM UTC

pergadad wrote: post #31

cracker_jacks wrote: post #17

The other tradeoff is you're giving Google an extraordinary amount of power to decide who is allowed and not allowed on your website with no transparency on how this decision was made. Not sure what company is willing to blindly trust Google with that power.

Plenty of small companies/private website owners might make a simple cost/benefit calculation - 15% less users but in return X reduced false accounts/traffic/...

Post by wolco » Thu, Jun 27, 2019, 4:01 PM UTC

eli wrote: post #15

octosphere wrote: post #11

Google's captcha system is overkill for most websites. If I want to filter out bad actors (on a simple straight-forward site), there are other more simpler and easier to solve captcha systems out there. They might not have the rigour of Google's system, but they do the job, and well. I would however use Google's system if the site is massive and there is the possibility that someone is using a script or some program…

There are diminishing returns once a CAPTCHA gets past a certain point. Bad actors can (and do) just humans to fill out captchas all day. We get some spam submissions on our sites that I'm 99.9% certain are people in developing countries copy/pasting spam templates and filling out captchas by hand.