Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s new reCAPTCHA has a dark side

fastcompany.com

Post reply on HN
Print view View original

131–140 of 566 posts

Re: Google’s new reCAPTCHA has a dark side

#131

Post by lucb1e »

mxcrossb wrote: post #80
LinuxBender wrote: post #58

So this is probably a bit off topic, but why don't more site owners just create their own unique anti-spam system? In my opinion, if they were simpler, yet all unique, there would be less bots that could mass spam and privacy would be improved. Even something as simple as a question: "How many legs does a spider have?" ____ And then cycle through different types of free form questions of things that most people shoul…

I think this would fail under any directed attack. It’s too hard to generate a database that’s large enough.

This is the answer. It seems that most website owners are somehow super scared of a targeted attack, since it is indeed trivial to bypass (and they realize that), even if nobody will take the time.

I've heard stories from people that own small sites and still have someone targeting the site with custom scripts, but never anyone I know (not even a friend of a friend, only ever random people on the internet). But there is also the (much larger, from what I can tell) group of people that never had these issues. But people don't like risks, and installing a tracking captcha from google is made very easy. "Everyone does it, that ought to work!" (Meanwhile I hear of a 90% success rate from a recaptcha browser plugin, but who cares about that right?)

Re: Google’s new reCAPTCHA has a dark side

#132

Post by atomicUpdate »

lucb1e wrote: post #102
dheera wrote: post #69

I guess another question is why we really need captchas. What are we trying to protect against that can't be accomplished with rate limits, voting systems, or other ways to regulate meaningful use of a website? Ultimately why does it matter if the user is a human or bot, as long as they are being a valuable user? What's wrong if a bot buys some of your inventory, pays for it and everything? What's wrong if an NLP bot…

Indeed, if they need to pay, there is no need for a CAPTCHA. As for responding to discussions, sure, you'd ban any human that posts spam the same as any bot. However, bots can spam your site faster than your human moderators can keep up with, so by using a CAPTCHA, only humans can post (ideally, of course), and thus moderators can keep up. As a security consultant, it is not uncommon to recommend a CAPTCHA for things…

> if they need to pay, there is no need for a CAPTCHA

> As a security consultant

Hm? How does a security consultant not know that credit card numbers can be stolen and used by bots?

Re: Google’s new reCAPTCHA has a dark side

#133

Post by paulcarroty »

superasn wrote: post #24

There are a lot of sites that are totally unusable on Firefox regardless how much you use ff. I do all my mobile browsing on FF yet when I try to use some websites I always get this Recaptcha failed error(1) while it works flawlessly on chrome though I never use it often. Try it, maybe it will happen for you too. Same happens on most sites which show you that "checking your browser" page via cloudflare too. The web i…

Also Google punishes Firefox users by forcing them to click on pictures 2-3 times more than Chrome.

Re: Google’s new reCAPTCHA has a dark side

#134

Post by eswat »

cbsks wrote: post #5

You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor... I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does. Edit: I also got 0.7 on Firefox with st…

FF logged into Google account: 0.9

FF incognito window not logged into Google account: 0.7

FF incognito window not logged into Google account through VPN: 0.3

FYI I have uBlock, pi-hole and a bunch of privacy widgets enabled

Re: Google’s new reCAPTCHA has a dark side

#136

Post by oarsinsync »

dangrossman wrote: post #111
dheera wrote: post #69

I guess another question is why we really need captchas. What are we trying to protect against that can't be accomplished with rate limits, voting systems, or other ways to regulate meaningful use of a website? Ultimately why does it matter if the user is a human or bot, as long as they are being a valuable user? What's wrong if a bot buys some of your inventory, pays for it and everything? What's wrong if an NLP bot…

> What's wrong if a bot buys some of your inventory, pays for it and everything? 100% of the time, a bot buying things from a store is doing so to test a database of stolen credit cards the bot's owner has purchased/stolen. Accepting those sales means you'll get hit with chargebacks a few weeks later as the real owners of those cards see their statements. Then your store gets shut down for exceeding the maximum 1% ch…

Do you have any stats on cart abandonment rate, and/or how that changed after you enabled recaptcha?

Re: Google’s new reCAPTCHA has a dark side

#137

Post by 1_player »

paulcarroty wrote: post #133
superasn wrote: post #24

There are a lot of sites that are totally unusable on Firefox regardless how much you use ff. I do all my mobile browsing on FF yet when I try to use some websites I always get this Recaptcha failed error(1) while it works flawlessly on chrome though I never use it often. Try it, maybe it will happen for you too. Same happens on most sites which show you that "checking your browser" page via cloudflare too. The web i…

Also Google punishes Firefox users by forcing them to click on pictures 2-3 times more than Chrome.

Same with Brave: I'm logged in into a gmail account and a custom domain hosted on gmail, yet every time there's a reCAPTCHA widget on the site, I have to do it 2 or 3 times before I'm let in.

One trick that seems to help fool that awful piece of tech: click slowly on the images, as if you were thinking a second or two before each click. Maybe click a wrong image and deselect it again. In other words, behave like a slow human, and it seems to work better than if I solve it as quickly as possible.

Re: Google’s new reCAPTCHA has a dark side

#138

Post by helper »

cbsks wrote: post #5

You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor... I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does. Edit: I also got 0.7 on Firefox with st…

I get 0.7 in both desktop (linux) chrome and firefox. I get 0.3 from android chrome.

Re: Google’s new reCAPTCHA has a dark side

#139

Post by jk2faster »

oil25 wrote: post #86
quickthrower2 wrote: post #83

Earlier quoted context omitted.

That image link is protected by cloudflare too! Irony intended?

The sad and depressing state of the Web in 2019: proprietary third-party JavaScript and cookies are required to view a simple, innocent JPG.

And it'll only get worse. From the article:

> "If you have a Google account it’s more likely you are human"

So, in the future if we don't keep signed into our google account(and let google know every article we read and every website we browse), we'll be cut off from the half of the internet or even more. The amount of control a handful of companies have over the internet is suffocating to know!

Re: Google’s new reCAPTCHA has a dark side

#140

Post by bluetidepro »

cbsks wrote: post #5

You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor... I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does. Edit: I also got 0.7 on Firefox with st…

I got a 0.9. What's it out of? 1? Sorry if I completely missed that somewhere already.
Post reply on HN