Live data from Hacker News

Google’s new reCAPTCHA has a dark side

fastcompany.com

261–270 of 566 posts

Re: Google’s new reCAPTCHA has a dark side

#261
post #145

Earlier quoted context omitted.

Not sure how much Ublock Origin makes a difference. I have a score of 0.9 with it turned on.

I think this score is fishy. Ran the test three times and got three different scores.

I get the exact same score no matter what browser I use, despite uBlock Origin & Privacy Badger & Decentraleyes, even in private mode and with a VPN connection from a country I normally don't use. Hmmmmm...

Re: Google’s new reCAPTCHA has a dark side

#262
post #211
post #74

There are government services, such as the USPTO, that rely on Google reCAPTCHA. The new reCAPTCHA has made it difficult for me to access documents, and sometimes they think that I'm a bot and thus deny me access entirely. Does the government realize the consequences of this? Both that it pushes users to use Chromium-based browsers, and that they're helping to solidify a company that already has a near monopoly in th…

I was amused that Elizabeth Warren's campaign site wouldn't display the content for me unless I permitted scripts from google.com (w/ umatrix) since she is promoting breaking up google.

Although you can be pro break-up-Google while using one, or even many, of their services.

So I don't really see the amusement.

Re: Google’s new reCAPTCHA has a dark side

#263

Earlier quoted context omitted.

Our company has industry leading fraud rejection rates and we don't use captcha at all

Would you be able to say how your company accomplishes that?

Honestly, statistics from about 2010 (ie before the age of neural network hype) and limited human observation.

Re: Google’s new reCAPTCHA has a dark side

#264

Google has been doing the same with reCAPTCHA v2 [1]. They are aware of the legal risk of outright blocking users from accessing services, so reCAPTCHA v3 contains no user facing UI, Google merely makes a suggestion in the form of a user score, so the responsibility to delay or block access and the legal liability that comes with it falls on websites. reCAPTCHA v2 is superseded by v3 because it presents a broader opp…

> Since reCAPTCHA v3 scripts must be loaded on every page of a site, you must send Google your browsing history and detailed data about how you interact with sites in order to access basic services on the internet, such as paying your bills, or accessing healthcare services. I don't believe this is true. You only need to include the JavaScript on pages which actively use the reCAPTCHA score. For example, you might on…

Isn't the idea that they can decide whether it's a user or a bot based on what the user does in general, not just whether their browser executes JS on this page that you want to protect?

Running headless chrome is trivial, so just having it sit on the one page where you need to check it won't help much. Collecting more data on the user's action on your site will provide a much clearer picture, much like a video from somebody walking through a store will help you make a decision about whether he's trying to steal something than a single picture of him standing at the check out.

Re: Google’s new reCAPTCHA has a dark side

#265

So you are so afraid of being tracked? you don't wanna give any ounce of your data? but you still want to have full access to the web, and for free?!! The world doesn't work this way. Either pay for what you get, or be prepared to accept ads/tracking. It is that simple.

I pay money to plenty of businesses and most of them still embed loads of advertising/analysis/tracking scripts. Seems less simple than you make out.

Re: Google’s new reCAPTCHA has a dark side

#266
post #228

Earlier quoted context omitted.

I think it's worth pointing out that the comment you replied to didn't mention money, advertising, or CTR. People are concerned about data collection for more reasons than that. You've seen these attempts and entire careers about it without "juicing" CTR, so perhaps that isn't the true intent.

I admit that I inferred the proposed intent for grabbing maximum personal data, but if you’re interested in anecdotes from the trenches: no one below senior director level gets a couple million in stock for any other reason than they pushed CTR by a few basis points. What I was trying to say is that seen through the lens of mechanism design no one is incentivized to query the like button table because there’s no upsi…

The fact that so much potentially sensitive data exists in a few repositories is in itself a bit foreboding. Who knows what companies will be able to glean from it one, five, or twenty years down the road?

My behavior on the web being tracked by corporations with little incentive to do right by me is worrisome.

Re: Google’s new reCAPTCHA has a dark side

#267

Earlier quoted context omitted.

Worst part is my chrome installation is 100% fresh with no browsing history and FF has cookies and history older than an year ago.. still google trusts Chrome more than FF?

reCaptcha isn't able to read your non-Google cookies or history, so most of that isn't being considered.

https://codelabs.developers.google.com/codelabs/reCAPTCHA/in...

Yeah, no. It certainly can read non-google cookies on the page (not httpOnly cookies, though).

Re: Google’s new reCAPTCHA has a dark side

#268

Earlier quoted context omitted.

And it is this very convenience that has countless sites using it. As I said, there are other systems which are just as easy to implement as Google's and which are not overkill and also more privacy friendly (Google's CAPTCHA is known to fingerprint the user using heuristics like mouse movements, screen resolution, etc).

> there are other systems Like what?

There are many easy to use libraries specific to different languages(like https://www.phpcaptcha.org/ for php) and frameworks. These are not as secure as recaptcha, but in most cases does the trick. There are also services similar to recaptcha like solve media and hcaptcha. I believe hcaptcha is a drop-in replacement(https://hcaptcha.com/docs).

Re: Google’s new reCAPTCHA has a dark side

#269
post #228

Earlier quoted context omitted.

I think it's worth pointing out that the comment you replied to didn't mention money, advertising, or CTR. People are concerned about data collection for more reasons than that. You've seen these attempts and entire careers about it without "juicing" CTR, so perhaps that isn't the true intent.

I admit that I inferred the proposed intent for grabbing maximum personal data, but if you’re interested in anecdotes from the trenches: no one below senior director level gets a couple million in stock for any other reason than they pushed CTR by a few basis points. What I was trying to say is that seen through the lens of mechanism design no one is incentivized to query the like button table because there’s no upsi…

I'm not sure I understand correctly. Are you saying that all the personal user data is in reality not as valuable as everyone says it is? That is, all those megacorps are collecting terabytes of mostly useless data?

Then why is this data collected and archived in the first place?

Re: Google’s new reCAPTCHA has a dark side

#270
post #226

Earlier quoted context omitted.

Do you have any stats on cart abandonment rate, and/or how that changed after you enabled recaptcha?

"Cart abandonment" Why is this a bot-specific thing? I abandon shopping carts as a human all the time, including especially: * If you require a registration and login to checkout * If your UI is too hard or clunky to use * If shipping fees are higher than what I think is fair * If there are additional non-upfront fees

I think that was the parent's point: humans will likely abandon carts more often if they need to solve a captcha to advance to the check out.
Post reply on HN