Google’s new reCAPTCHA has a dark side • Hacker News Board

Re: Google’s new reCAPTCHA has a dark side

#111

Post by dangrossman » Thu, Jun 27, 2019, 4:14 PM UTC

dheera wrote: post #69

I guess another question is why we really need captchas. What are we trying to protect against that can't be accomplished with rate limits, voting systems, or other ways to regulate meaningful use of a website? Ultimately why does it matter if the user is a human or bot, as long as they are being a valuable user? What's wrong if a bot buys some of your inventory, pays for it and everything? What's wrong if an NLP bot…

> What's wrong if a bot buys some of your inventory, pays for it and everything?

100% of the time, a bot buying things from a store is doing so to test a database of stolen credit cards the bot's owner has purchased/stolen. Accepting those sales means you'll get hit with chargebacks a few weeks later as the real owners of those cards see their statements. Then your store gets shut down for exceeding the maximum 1% chargeback ratio mandated by Visa and MasterCard. So preventing this scenario matters a lot, and when someone targets one of my stores for testing like this, enabling a CAPTCHA on the payment page is one of several, often-essential mitigations. Blocking IPs, blocking whole countries, including a nonce in the form, etc are on their own insufficient most of the time: the readily-available tools for this kind of attack already handle rotating IPs, retrieving a new form nonce on each try, spoofing the proper referrer, etc.

Re: Google’s new reCAPTCHA has a dark side

#112

Post by quickthrower2 » Thu, Jun 27, 2019, 4:14 PM UTC

writeslowly wrote: post #35

Wouldn't reCaptcha V3 also make things much more difficult for Google competitors, assuming that site owners place it on every page? I'm guessing it will block any sort of scraper (since scraper access patterns don't look human) with some sort of whitelist for Google's scrapers.

Yes it means Google has p0wnd the web.

Re: Google’s new reCAPTCHA has a dark side

#113

Post by jk2faster » Thu, Jun 27, 2019, 4:15 PM UTC

https://hcaptcha.com/ seems to be a viable alternative. If you are a developer, please consider using something other than reCaptcha. Not only is it annoying, but a privacy nightmare as well.

Re: Google’s new reCAPTCHA has a dark side

#114

Post by KumarAseem » Thu, Jun 27, 2019, 4:15 PM UTC

cbsks wrote: post #5

You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor... I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does. Edit: I also got 0.7 on Firefox with st…

I got 0.7 on FF, 0.3 on Opera and Chrome, all in incognito mode. Maybe they have just a few values and return it based on AND OR logic of 2-4 variable. Or maybe they are just playing around trying to gather some stats, for some "Don't be Evil" purpose!

Re: Google’s new reCAPTCHA has a dark side

#115

Post by qwsxyh » Thu, Jun 27, 2019, 4:15 PM UTC

cbsks wrote: post #5

You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor... I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does. Edit: I also got 0.7 on Firefox with st…

Firefox with uBlock O I get 0.9. Don't know what everyone else here is talking about.

Re: Google’s new reCAPTCHA has a dark side

#116

Post by dvaun » Thu, Jun 27, 2019, 4:16 PM UTC

rbobrowicz wrote: post #98

ronjouch wrote: post #46

Earlier quoted context omitted.

Using Firefox with uBlock and Cookie-Autodelete I get 0.1 Using Chrome, even incognito and with uBlock I get 0.7 (╯°□°）╯︵ ┻━┻. F you, Google, this is blatant bullying, technically unjustifyable abuse of your stranglehold over the whole web platform.

To offer a different datapoint: On FireFox with uBlock on and logged into my corporate gmail I get 0.9, switching to a private tab I get 0.7. This is with every privacy setting turned on in the FF options.

I also have a similar result (0.7) using my browser at work. I am using containers, uBlock, privacy badger and auto-delete cookies.

Re: Google’s new reCAPTCHA has a dark side

#117

Post by founderling » Thu, Jun 27, 2019, 4:16 PM UTC

dheera wrote: post #69

I guess another question is why we really need captchas. What are we trying to protect against that can't be accomplished with rate limits, voting systems, or other ways to regulate meaningful use of a website? Ultimately why does it matter if the user is a human or bot, as long as they are being a valuable user? What's wrong if a bot buys some of your inventory, pays for it and everything? What's wrong if an NLP bot…

Here is an answer from the hncynic bot:

I had problems with my spinner at first. However, this is one of the things that is really annoying about using captchas instead of passwords.

It is possible to create a secure account for something useless without using the system and you probably won't get spammers anymore.

What a dumb idea, you would want to implement it yourself, because the people working and maintaining the system(s) will all have some way of doing that already.

I don't know how much the government can take away from a site like this as well. But it's a bit like trying to ban a kid because the kid got an old friend on their facebook because his parents were "bad".

So, even though you have a big idea about voting systems, it would be a better option to require a system that only exists to be able to be used for good reasons.

Re: Google’s new reCAPTCHA has a dark side

#118

Post by hiccuphippo » Thu, Jun 27, 2019, 4:16 PM UTC

SlowRobotAhead wrote: post #63

jcomis wrote: post #47

I hate the v3 reCAPTCHA. On FF, I usually KNOW I am answering correctly and it says I failed. I always have to go through it multiple times. It's maddening. It often leaves me second guessing myself... is that sliver of car counted? is a crossing signal a street light? What about those streetlights way off in the distance, do I select those two in addition to the ones front and center? That RV looks sort of like a bu…

They want all tiles with bicycles... but are showing me a road painted bicycle crossing pictogram...

At that moment I don't care if their AI gets the wrong feedback on what a bicycle is as long as I get pass the captcha.

Re: Google’s new reCAPTCHA has a dark side

#119

Post by shawnz » Thu, Jun 27, 2019, 4:16 PM UTC

cbsks wrote: post #5

You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor... I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does. Edit: I also got 0.7 on Firefox with st…

Contrary to the results here, using Firefox + uBlock with DNT and tracking protection enabled, I get a score of 0.9. In private browsing mode it's 0.7.

I wonder how many people here are using a VPN or accessing from a non-western country -- I'd bet those are much bigger factors

Re: Google’s new reCAPTCHA has a dark side

#120

Post by SamuelAdams » Thu, Jun 27, 2019, 4:17 PM UTC

dheera wrote: post #69

I guess another question is why we really need captchas. What are we trying to protect against that can't be accomplished with rate limits, voting systems, or other ways to regulate meaningful use of a website? Ultimately why does it matter if the user is a human or bot, as long as they are being a valuable user? What's wrong if a bot buys some of your inventory, pays for it and everything? What's wrong if an NLP bot…

> What's wrong if a bot buys some of your inventory, pays for it and everything?

In the book "Spam Nation" (Brian Krebs), a group of students try to fight fake online pharmacies. To do this, they created an army of bots and placed thousands of fake orders every day. The goal was to create so many fake orders that the human processors (many fake pharma stores were not fully automated) had to spend a significant amount of time clearing out the fake orders before getting to the real orders.

Now imagine this on a legitimate website. Not every website is automated, not every organization has the same resources that Amazon does. CAPTCHA's are a great way to ensure orders are coming from real people. They could still be faked, but the bar is a bit higher.