Google’s new reCAPTCHA has a dark side • Hacker News Board

Re: Google’s new reCAPTCHA has a dark side

#251

Post by thekyle » Thu, Jun 27, 2019, 6:16 PM UTC

dessant wrote: post #126

Google has been doing the same with reCAPTCHA v2 [1]. They are aware of the legal risk of outright blocking users from accessing services, so reCAPTCHA v3 contains no user facing UI, Google merely makes a suggestion in the form of a user score, so the responsibility to delay or block access and the legal liability that comes with it falls on websites. reCAPTCHA v2 is superseded by v3 because it presents a broader opp…

> Since reCAPTCHA v3 scripts must be loaded on every page of a site, you must send Google your browsing history and detailed data about how you interact with sites in order to access basic services on the internet, such as paying your bills, or accessing healthcare services.

I don't believe this is true. You only need to include the JavaScript on pages which actively use the reCAPTCHA score. For example, you might only include it on the login and user registration pages.

Re: Google’s new reCAPTCHA has a dark side

#252

Post by [deleted] » Thu, Jun 27, 2019, 6:18 PM UTC

cbsks wrote: post #5

You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor... I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does. Edit: I also got 0.7 on Firefox with st…

[deleted]

Re: Google’s new reCAPTCHA has a dark side

#253

Post by redwards510 » Thu, Jun 27, 2019, 6:19 PM UTC

deftnerd wrote: post #162

beefhash wrote: post #152

Earlier quoted context omitted.

> That means Google services are entirely off-limits over Tor If only it was Google services alone. CloudFlare loves serving up a ReCAPTCHA for Tor users before they can even passively read site contents. That hugely expands the damage done.

Install the PrivacyPass Firefox or Chrome extension. It was developed by Cloudflare, Firefox, and Tor in partnership. It has you answer a ReCAPTCHA and using some crypto magic, generate a bunch of CAPTCHA bypass tokens that can't be traced to your specific computer. https://support.cloudflare.com/hc/en-us/articles/11500199265... https://blog.cloudflare.com/cloudflare-supports-privacy-pass... https://blog.cloudflare.c…

This sounds pretty good, but you still have to pass a captcha in order to get a pass, and sometimes that is impossible (or at least I just give up because I lost interest after 20 puzzles).

If it was developed in conjunction with Tor, how come it doesn't come bundled with the Tor browser or Tails?

Re: Google’s new reCAPTCHA has a dark side

#254

Post by spicytunacone » Thu, Jun 27, 2019, 6:19 PM UTC

mrguyorama wrote: post #212

dangrossman wrote: post #111

Earlier quoted context omitted.

> What's wrong if a bot buys some of your inventory, pays for it and everything? 100% of the time, a bot buying things from a store is doing so to test a database of stolen credit cards the bot's owner has purchased/stolen. Accepting those sales means you'll get hit with chargebacks a few weeks later as the real owners of those cards see their statements. Then your store gets shut down for exceeding the maximum 1% ch…

Our company has industry leading fraud rejection rates and we don't use captcha at all

Would you be able to say how your company accomplishes that?

Re: Google’s new reCAPTCHA has a dark side

#255

Post by redwards510 » Thu, Jun 27, 2019, 6:21 PM UTC

Liquix wrote: post #165

baq wrote: post #156

Earlier quoted context omitted.

they have a patent on giving out unbeatable challenges when the computer thinks it's dealing with a 'malicious agent'. https://patents.google.com/patent/US9407661B2/en

So if you're running the wrong combination of addons/VPNs/browser you're denied access to half the web because Big G says so? And now they're aggressively pushing sysadmins to install silent data harvesting scripts on every page of their sites? WTF more will it take to get people interested in breaking up these monopolies?

Not denied access, they just keep serving up challenges to you until you give up, WAY worse than saying "You appear to be a bot, sorry".

Re: Google’s new reCAPTCHA has a dark side

#256

Post by tomc1985 » Thu, Jun 27, 2019, 6:22 PM UTC

superasn wrote: post #24

There are a lot of sites that are totally unusable on Firefox regardless how much you use ff. I do all my mobile browsing on FF yet when I try to use some websites I always get this Recaptcha failed error(1) while it works flawlessly on chrome though I never use it often. Try it, maybe it will happen for you too. Same happens on most sites which show you that "checking your browser" page via cloudflare too. The web i…

Other than the occasional reCAPTCHA gaslighting (which does occasionally block some service if it gates logins behind it) that we're all familiar with, I have completely excised Chrome from my life and am able to go to most any website without issue. That's with uBO and Privacy Badger running

Re: Google’s new reCAPTCHA has a dark side

#257

Post by tjpnz » Thu, Jun 27, 2019, 6:23 PM UTC

pnw_hazor wrote: post #182

Liquix wrote: post #165

Earlier quoted context omitted.

So if you're running the wrong combination of addons/VPNs/browser you're denied access to half the web because Big G says so? And now they're aggressively pushing sysadmins to install silent data harvesting scripts on every page of their sites? WTF more will it take to get people interested in breaking up these monopolies?

I hear Google is a fun place to work and that they pay well. Until software developers care -- nothing will happen.

From what I've seen (and most of it's anecdotal) things do appear to be changing. There are already people who won't go anywhere near Facebook now for personal ethical reasons, and even concerns that it might hurt future career prospects.

Re: Google’s new reCAPTCHA has a dark side

#258

Post by Liquix » Thu, Jun 27, 2019, 6:24 PM UTC

pnw_hazor wrote: post #182

Liquix wrote: post #165

Earlier quoted context omitted.

So if you're running the wrong combination of addons/VPNs/browser you're denied access to half the web because Big G says so? And now they're aggressively pushing sysadmins to install silent data harvesting scripts on every page of their sites? WTF more will it take to get people interested in breaking up these monopolies?

I hear Google is a fun place to work and that they pay well. Until software developers care -- nothing will happen.

Were Carnegie Steel or Bell fun places to work? Probably, they had cash spilling out their ears.

Monopolies need to be broken up because they threaten the free market and consequently our way of life - not because employees revolt.

Re: Google’s new reCAPTCHA has a dark side

#259

Post by cm2187 » Thu, Jun 27, 2019, 6:25 PM UTC

Stupid question: why do companies care so much about bots to the point of degrading the customer experience significantly? I can understand for things like public forums. But like why would an ecommerce website ever put a captcha between you and your order (or a news website)?

Re: Google’s new reCAPTCHA has a dark side

#260

Post by smsm42 » Thu, Jun 27, 2019, 6:26 PM UTC

benreesman wrote: post #223

dessant wrote: post #126

Google has been doing the same with reCAPTCHA v2 [1]. They are aware of the legal risk of outright blocking users from accessing services, so reCAPTCHA v3 contains no user facing UI, Google merely makes a suggestion in the form of a user score, so the responsibility to delay or block access and the legal liability that comes with it falls on websites. reCAPTCHA v2 is superseded by v3 because it presents a broader opp…

Your comment adds a lot to the conversation, so I don’t want to be more contrary than necessary. It’s nonetheless a shame that it’s so universally misunderstood how ad-supported megacorps make their money that even highly sophisticated users of the web still talk about the value of personal data (source: I ran Facebook’s ads backend for years). Much like the highest information-gain feature for the future price of a…

That's the annoying part of it. They try to collect everything about me, down to my favorite color and the brand of tea I am drinking, and they can't even deliver a semi-relevant ad. Best they can do is to bombard me with shoe and riding classes ads for 6 month after I search for "weight of a horseshoe" and stuff like that. They kill the privacy, they make 99% of the sites unusable without an ad blocker, and at the end it doesn't even amount to them making relevant ads...