Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s new reCAPTCHA has a dark side

fastcompany.com

Post reply on HN
Print view View original

201–210 of 566 posts

Re: Google’s new reCAPTCHA has a dark side

#201

Post by mmanfrin »

superasn wrote: post #24

There are a lot of sites that are totally unusable on Firefox regardless how much you use ff. I do all my mobile browsing on FF yet when I try to use some websites I always get this Recaptcha failed error(1) while it works flawlessly on chrome though I never use it often. Try it, maybe it will happen for you too. Same happens on most sites which show you that "checking your browser" page via cloudflare too. The web i…

Kickstarter's login has not worked for me with firefox for over a year. People just don't test with anything but chrome and it shows.

Re: Google’s new reCAPTCHA has a dark side

#202

Post by fibers »

cbsks wrote: post #5

You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor... I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does. Edit: I also got 0.7 on Firefox with st…

Interestingly enough I got .9 on Edge with Ublock origin installed. Perhaps this has something to do with how Edge is using webkit now?

Re: Google’s new reCAPTCHA has a dark side

#203

Post by nprateem »

peterlk wrote: post #159
superasn wrote: post #24

There are a lot of sites that are totally unusable on Firefox regardless how much you use ff. I do all my mobile browsing on FF yet when I try to use some websites I always get this Recaptcha failed error(1) while it works flawlessly on chrome though I never use it often. Try it, maybe it will happen for you too. Same happens on most sites which show you that "checking your browser" page via cloudflare too. The web i…

I prefer to see the silver lining in this. If Google wants to break the web for Firefox, fine. I'll keep using (and evangelising) FF, and the sites that are broken won't get FF traffic. I believe that FF is doing the right thing far users, and Google, while in a powerful position is currently on the losing side of history with respect to privacy. Apple is taking that fight to them, and putting budget behind inte conv…

Only the majority of the Internet isn't a walled garden is it? It's more like a minefield because you don't know whether a site is going to use recaptcha and block/hinder your access.

You can't just opt out of using half the Internet because you value privacy, and nor should you have to. This requires legislation to stop.

Re: Google’s new reCAPTCHA has a dark side

#204

Post by hombre_fatal »

luckylion wrote: post #123
flixic wrote: post #78

Earlier quoted context omitted.

Most sites use reCAPTCHA to protect against bot registrations, sometimes targeted to their specific registration system. Any simple solution would defeat the purpose of a CAPTCHA.

idk, recaptcha solvers are about $3/1000 or something. That sounds like a very low hurdle to mess with most websites if that's their line of defense.

We still lock our car doors even though you can jimmy them open in a few seconds.

Re: Google’s new reCAPTCHA has a dark side

#205

Post by gcbw2 »

Remember every time you complained about China's citizen score system?

Now remember that every interaction with the government must happen online (from requesting a US visa to going to the DMV), and all those forms are behind a Google(R) Captcha(TM) censorship system, which ranks users based on how well Google(R) can monetize the current user browser session. Let that sink in.

Re: Google’s new reCAPTCHA has a dark side

#206

Post by innot »

ramraj07 wrote: post #148
oil25 wrote: post #81

Earlier quoted context omitted.

reCAPTCHA on VPN is difficult, but on the Tor network, they are downright impossible. I've never been able to get past it, even after a few dozen painful attempts. That means Google services are entirely off-limits over Tor, even Search, which is a disgrace.

I'm assuming you are not logged into a Google account during this? What happens if you create a throwaway Google account while on Tor? Or is that also impossible?

I remember that these days google requires a phone number. Finding a throwaway number is hard, especially in some countries.

Re: Google’s new reCAPTCHA has a dark side

#207

Post by LinuxBender »

hombre_fatal wrote: post #197
mxcrossb wrote: post #80

Earlier quoted context omitted.

I think this would fail under any directed attack. It’s too hard to generate a database that’s large enough.

XRumer (forum spamming) software had a feature over a decade ago that would reload a /register page on different proxies to generate a list of these sorts of questions. You'd run it for a moment, feed an answer for each question into XRumer, and then continue on your merry spammy way. These ReCaptcha topics on HN really illuminate how few people have dealt with any real spam, much less targeted human or botnet attack…

Can you teach it to play hangman? I'm thinking about digging out and dusting off my old perl cgi games. It might even keep humans out that don't have my sense of humor.

Re: Google’s new reCAPTCHA has a dark side

#208

Post by nprateem »

eikenberry wrote: post #192
fasicle wrote: post #109

Earlier quoted context omitted.

Not sure how much Ublock Origin makes a difference. I have a score of 0.9 with it turned on.

Ublock Origin + NoScript on FF 60.7.2esr and got 0.9 as well. [edit] tried in a private window and got the same score.

Does it change if you set privacy.resistFingerprinting=true in about:config?

Re: Google’s new reCAPTCHA has a dark side

#209

Post by gcbw2 »

rbritton wrote: post #99

I'm torn on this. reCAPTCHA v2 (mostly useless[0]) and v3 function largely on browser fingerprinting plus a few other heuristics (e.g., whether or not you have a Google cookie). Any meaningful privacy measures to resist fingerprinting end up with a low reCAPTCHA score. I personally run into a wall on most sites using it. That said, it's one of the most effective means of combatting automated spam and credential stuff…

It is used irresponsibly.

A responsible spam protection system should allow every spam (and consequentially responsible user) from an ISP.

If a ISP shows sign of abuse, then show Captcha or other system that will block some spam while also blocking some valid users. This is a evil-for-the-greater-good solution. Do not fool yourself into thinking this is a solution (i.e. without caveats)

Impacted users can complain to both the service provider (you) and their ISP. And that failing, switching their ISP (i.e. voting with their wallet --how that happens in a monopoly is another discussion)

Bottom line, if you show captcha for all users (even for ISPs that are now showing signs of spam) you are intentionally blocking some users for no good reason. And you are part of the problem. Sadly, this includes the US government as they blanket censor all their forms (from visa request to DMV visits) behind Google(R) captcha(tm) at all times.

Re: Google’s new reCAPTCHA has a dark side

#210

Post by hombre_fatal »

kwhitefoot wrote: post #160

Luckily Idon't need any of the sites that ues this obnoxious tool. Just vote with your feet and tell the site to drop it or lose you.

Yet you're on a website that uses ReCaptcha.

Just tried to register via Tor and got this: https://i.imgur.com/svjfLqo.png

Kind of toothless to say "I'll NEVER use ReCaptcha (except for websites I want to use)!" In fact, I'd go a step further and assert that, while you complain about ReCaptcha, you're actively benefiting from HN using ReCaptcha since you see less spam day-to-day because of it. ;)

Post reply on HN