Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s new reCAPTCHA has a dark side

fastcompany.com

Post reply on HN
Print view View original

291–300 of 566 posts

Re: Google’s new reCAPTCHA has a dark side

#291

Post by benreesman »

ehsankia wrote: post #275
gfosco wrote: post #228

Earlier quoted context omitted.

I think it's worth pointing out that the comment you replied to didn't mention money, advertising, or CTR. People are concerned about data collection for more reasons than that. You've seen these attempts and entire careers about it without "juicing" CTR, so perhaps that isn't the true intent.

What other reasons do you think the original post was implying for Google to collect all this data?

I think the implication was that the leadership is hanging onto all that data because of an immediate fiduciary obligation. I suspect that it’s more in the nature of when you’re running a business in which a few hundred million QPS is slow that you archive in case it ever becomes useful.

Re: Google’s new reCAPTCHA has a dark side

#292

Post by benreesman »

smsm42 wrote: post #260
benreesman wrote: post #223

Earlier quoted context omitted.

Your comment adds a lot to the conversation, so I don’t want to be more contrary than necessary. It’s nonetheless a shame that it’s so universally misunderstood how ad-supported megacorps make their money that even highly sophisticated users of the web still talk about the value of personal data (source: I ran Facebook’s ads backend for years). Much like the highest information-gain feature for the future price of a…

That's the annoying part of it. They try to collect everything about me, down to my favorite color and the brand of tea I am drinking, and they can't even deliver a semi-relevant ad. Best they can do is to bombard me with shoe and riding classes ads for 6 month after I search for "weight of a horseshoe" and stuff like that. They kill the privacy, they make 99% of the sites unusable without an ad blocker, and at the e…

If I were you I’d be more worried that Google de facto controls whatever we’re calling HTTP these days than that they have a BigTable entry that ties a browser you once used to a preference for Earl Grey.

Re: Google’s new reCAPTCHA has a dark side

#293

Post by benreesman »

EpicEng wrote: post #266
benreesman wrote: post #239

Earlier quoted context omitted.

I admit that I inferred the proposed intent for grabbing maximum personal data, but if you’re interested in anecdotes from the trenches: no one below senior director level gets a couple million in stock for any other reason than they pushed CTR by a few basis points. What I was trying to say is that seen through the lens of mechanism design no one is incentivized to query the like button table because there’s no upsi…

The fact that so much potentially sensitive data exists in a few repositories is in itself a bit foreboding. Who knows what companies will be able to glean from it one, five, or twenty years down the road? My behavior on the web being tracked by corporations with little incentive to do right by me is worrisome.

I’m more concerned that they’re designing the next version of the Web right under our noses than that they know what kind of sneakers I’m 8% more likely to buy.

Re: Google’s new reCAPTCHA has a dark side

#294

Post by remus »

cm2187 wrote: post #259

Stupid question: why do companies care so much about bots to the point of degrading the customer experience significantly? I can understand for things like public forums. But like why would an ecommerce website ever put a captcha between you and your order (or a news website)?

An example from another comment: bots checking stolen cc numbers which then results in high numbers of charge backs and the potential for getting blocked by visa/mastercard.

Re: Google’s new reCAPTCHA has a dark side

#295

Post by saltminer »

>For instance, if a user with a high risk score attempts to log in, the website can set rules to ask them to enter additional verification information through two-factor authentication.

This defeats the purpose of using 2FA: to require a second factor every time you login. This completely negates the benefits of 2FA if a hacker has gotten my username/password through a keylogger. It's easy enough to get a good score if you just disable tracking protections and login to a Google account, then a hacker can easily break into your account. I was thinking it had to be the author not understanding how 2FA worked, but Google is actually advocating this ([0]):

> login With low scores, require 2-factor-authentication or email verification to prevent credential stuffing attacks.

You would think the people behind recaptcha would understand how 2FA is supposed to work.

[0]: https://developers.google.com/recaptcha/docs/v3#score

Re: Google’s new reCAPTCHA has a dark side

#296

Post by Ftuuky »

Drdrdrq wrote: post #154
Fogest wrote: post #146

Earlier quoted context omitted.

Really? I don't think so. I get a 0.9 on Google Chrome, and a 0.7 on Firefox. I heavily use Chrome and I have not used Firefox apart from maybe testing some local websites. Despite this I still got 0.7 on there. I expected lower since I don't use the browser.

On a flip side: you really should check privacy settings in your Firefox, it seems Google can track you easily there. ;)

I use Firefox with Google container and uBlock Origin and Privacy Badger and also get a score of 0.7

How can I get better privacy settings?

Re: Google’s new reCAPTCHA has a dark side

#297

Post by dmoy »

benologist wrote: post #274
mrguyorama wrote: post #263

Earlier quoted context omitted.

Honestly, statistics from about 2010 (ie before the age of neural network hype) and limited human observation.

Human moderation and ad-hoc heuristics seems to make the difference at Reddit too, rather than the CAPTCHA at registration.

In practice it is a major pain to keep up to date, and bots slip through all the time, at least on the subreddit I help moderate. It's a lot of manual volunteer work.

Re: Google’s new reCAPTCHA has a dark side

#298

Post by judge2020 »

luckylion wrote: post #264
thekyle wrote: post #251

Earlier quoted context omitted.

> Since reCAPTCHA v3 scripts must be loaded on every page of a site, you must send Google your browsing history and detailed data about how you interact with sites in order to access basic services on the internet, such as paying your bills, or accessing healthcare services. I don't believe this is true. You only need to include the JavaScript on pages which actively use the reCAPTCHA score. For example, you might on…

Isn't the idea that they can decide whether it's a user or a bot based on what the user does in general, not just whether their browser executes JS on this page that you want to protect? Running headless chrome is trivial, so just having it sit on the one page where you need to check it won't help much. Collecting more data on the user's action on your site will provide a much clearer picture, much like a video from…

The big "if" here is whether or not Google is actually factoring the user's activity into the score. For all we know, there could be a 80/20 split between "Google account activity" and "human-like behavior on website" when Google outputs a trust score.

Re: Google’s new reCAPTCHA has a dark side

#299

Post by __jal »

benreesman wrote: post #223
dessant wrote: post #126

Google has been doing the same with reCAPTCHA v2 [1]. They are aware of the legal risk of outright blocking users from accessing services, so reCAPTCHA v3 contains no user facing UI, Google merely makes a suggestion in the form of a user score, so the responsibility to delay or block access and the legal liability that comes with it falls on websites. reCAPTCHA v2 is superseded by v3 because it presents a broader opp…

Your comment adds a lot to the conversation, so I don’t want to be more contrary than necessary. It’s nonetheless a shame that it’s so universally misunderstood how ad-supported megacorps make their money that even highly sophisticated users of the web still talk about the value of personal data (source: I ran Facebook’s ads backend for years). Much like the highest information-gain feature for the future price of a…

> It’s nonetheless a shame that it’s so universally misunderstood how ad-supported megacorps make their money that even highly sophisticated users of the web still talk about the value of personal data (source: I ran Facebook’s ads backend for years).

That may be the case for some people, but that is not my complaint, nor that of many folks I know.

I simply don't care how FB, Google and other surveillance outfits make money. I don't care about marketers' careers or their CTRs. I don't even care about putting a dollar value on my LTV to them.

I care about denying them visibility into my datastream. It is zero-sum. They have no right to it, and I have every right to try to limit their visibility.

Why? None of your business. Seriously - nobody is owed an explanation for not wanting robots watching.

But I will answer anyway. It is because of future risks. These professional panty sniffers already have the raw material for many thousands of lawsuits, divorces and less legal outcomes in their databases. Who knows what particular bits of information will leak in 10 years, or when FB goes bankrupt? I have no desire to be part of what I suspect will become a massive clusterfuck within our lifetimes.

If you're correct that this data has so little value, then it is more likely it will leak. FB and Google are the equivalent of Superfund sites waiting to happen, and storing that data should be considered criminal.

Re: Google’s new reCAPTCHA has a dark side

#300

Post by eikenberry »

nprateem wrote: post #208
eikenberry wrote: post #192

Earlier quoted context omitted.

Ublock Origin + NoScript on FF 60.7.2esr and got 0.9 as well. [edit] tried in a private window and got the same score.

Does it change if you set privacy.resistFingerprinting=true in about:config?

Do you need to restart FF with that? After setting it to true and using a private window, FF still registers a score of 0.9.
Post reply on HN