Live data from Hacker News

Google’s new reCAPTCHA has a dark side

fastcompany.com

161–170 of 566 posts

Re: Google’s new reCAPTCHA has a dark side

#161
post #67
post #5

You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor... I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does. Edit: I also got 0.7 on Firefox with st…

> NOTE:This is a sample implementation, the score returned here is not a reflection on your Google account or type of traffic.

This comment should probably be higher up in the thread.

Re: Google’s new reCAPTCHA has a dark side

#162
post #81

Earlier quoted context omitted.

reCAPTCHA on VPN is difficult, but on the Tor network, they are downright impossible. I've never been able to get past it, even after a few dozen painful attempts. That means Google services are entirely off-limits over Tor, even Search, which is a disgrace.

> That means Google services are entirely off-limits over Tor If only it was Google services alone. CloudFlare loves serving up a ReCAPTCHA for Tor users before they can even passively read site contents. That hugely expands the damage done.

Install the PrivacyPass Firefox or Chrome extension. It was developed by Cloudflare, Firefox, and Tor in partnership. It has you answer a ReCAPTCHA and using some crypto magic, generate a bunch of CAPTCHA bypass tokens that can't be traced to your specific computer.

https://support.cloudflare.com/hc/en-us/articles/11500199265...

https://blog.cloudflare.com/cloudflare-supports-privacy-pass...

https://blog.cloudflare.com/privacy-pass-the-math/

https://github.com/privacypass/challenge-bypass-extension

Re: Google’s new reCAPTCHA has a dark side

#163
post #74

There are government services, such as the USPTO, that rely on Google reCAPTCHA. The new reCAPTCHA has made it difficult for me to access documents, and sometimes they think that I'm a bot and thus deny me access entirely. Does the government realize the consequences of this? Both that it pushes users to use Chromium-based browsers, and that they're helping to solidify a company that already has a near monopoly in th…

You are required to use reCAPTCHA on the California DMV website when making appointments and other functions.

https://www.dmv.ca.gov

It will also log you in to google on the first page.

Additionally, the stations at the DMV all have tablets on stands, showing Google logins for some operations.

Re: Google’s new reCAPTCHA has a dark side

#164

Google has been doing the same with reCAPTCHA v2 [1]. They are aware of the legal risk of outright blocking users from accessing services, so reCAPTCHA v3 contains no user facing UI, Google merely makes a suggestion in the form of a user score, so the responsibility to delay or block access and the legal liability that comes with it falls on websites. reCAPTCHA v2 is superseded by v3 because it presents a broader opp…

Is it that different from the way Google Analytics works?

Re: Google’s new reCAPTCHA has a dark side

#165
post #156
post #81

Earlier quoted context omitted.

reCAPTCHA on VPN is difficult, but on the Tor network, they are downright impossible. I've never been able to get past it, even after a few dozen painful attempts. That means Google services are entirely off-limits over Tor, even Search, which is a disgrace.

they have a patent on giving out unbeatable challenges when the computer thinks it's dealing with a 'malicious agent'. https://patents.google.com/patent/US9407661B2/en

So if you're running the wrong combination of addons/VPNs/browser you're denied access to half the web because Big G says so? And now they're aggressively pushing sysadmins to install silent data harvesting scripts on every page of their sites? WTF more will it take to get people interested in breaking up these monopolies?

Re: Google’s new reCAPTCHA has a dark side

#167
post #163
post #74

There are government services, such as the USPTO, that rely on Google reCAPTCHA. The new reCAPTCHA has made it difficult for me to access documents, and sometimes they think that I'm a bot and thus deny me access entirely. Does the government realize the consequences of this? Both that it pushes users to use Chromium-based browsers, and that they're helping to solidify a company that already has a near monopoly in th…

You are required to use reCAPTCHA on the California DMV website when making appointments and other functions. https://www.dmv.ca.gov It will also log you in to google on the first page. Additionally, the stations at the DMV all have tablets on stands, showing Google logins for some operations.

When did this start? I used the DMV page without a google account in February with no issues, and the local DMV has no tablets as of May.

Re: Google’s new reCAPTCHA has a dark side

#168
I know people are (rightfully) worried about centralisation on the Internet, but I still wonder how come there's virtually no "competition" to reCaptcha. Even from one of the "centralised" players.

For example, even Cloudflare, which has its own "checking your browser" protection, still uses reCaptcha in some other cases... Why doesn't Cloudflare offer a reCaptcha alternative to their customers? (a transparent one, more like reCaptcha v3 rather than the intrusive 5-second one...).

Re: Google’s new reCAPTCHA has a dark side

#169

Google's captcha system is overkill for most websites. If I want to filter out bad actors (on a simple straight-forward site), there are other more simpler and easier to solve captcha systems out there. They might not have the rigour of Google's system, but they do the job, and well. I would however use Google's system if the site is massive and there is the possibility that someone is using a script or some program…

> trying to create a psyop[0], or disinformation campaign, or even a sockpuppet army

That's not a viable reason. Anyone doing so is going to have a budget and human reCAPTCHA solving is less than $0.01 per CAPTCHA. It costs very little for mass account creation, reCAPTCHA or not.

Re: Google’s new reCAPTCHA has a dark side

#170
post #53

Earlier quoted context omitted.

If they looked for identifying information in cookies or browsing history people would be even more upset and spammers would just simulate it with browser bots... which is why I believe it takes a black box approach to each detection regardless of external state. Besides obviously the cookies set within the iframe of the recatcha. This of course doesn’t help explain why Firefox is so heavily targeted by what’s suppos…

I've heard that being signed into your Google account can make the challenges simpler, presumably reducing things like the noise and the slow-fade load animations.

That too could be isolated to a single reCAPTCHA session, keeping within the scope of a single iframe or page load.

The idea of tracking your history across multiple reCAPTCHA loads across multiple domains to build a user profile is what sounds like a giant privacy red flag, even though it's entirely possible given the current implementation.

Additionally asking hosts to include JS directly onto their domain which sets 3rd party cookies/data across every page in addition to tracking referring domains is equally a bad idea. reCAPTCHA 2/3 does require loading 3rd party JS directly on page, which I'd imagine is necessary to create callbacks in the frontend upon verification (as iframe content messaging is very awkward):

https://developers.google.com/recaptcha/docs/v3

Ideally the JS simply loads an iframe of the captcha HTML and handles the callbacks from events in the iframe. That's it. It shouldn't be touching anything else on your website. I'd be curious to see a reverse engineering to see how much the JS really does...

Post reply on HN