Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s new reCAPTCHA has a dark side

fastcompany.com

Post reply on HN
Print view View original

301–310 of 566 posts

Re: Google’s new reCAPTCHA has a dark side

#301

Post by judge2020 »

saltminer wrote: post #295

>For instance, if a user with a high risk score attempts to log in, the website can set rules to ask them to enter additional verification information through two-factor authentication. This defeats the purpose of using 2FA: to require a second factor every time you login. This completely negates the benefits of 2FA if a hacker has gotten my username/password through a keylogger. It's easy enough to get a good score…

I think "real" 2fa isn't going to care about what ReCaptcha v3's trust score is, the case for this is "this user has a recaptcha score of 0.2, they don't have any cookies for this site, and [other system] also thinks they are suspicious. Let's require extra email verification and/or ask to answer a security question".

Re: Google’s new reCAPTCHA has a dark side

#302

Post by dmoy »

dredmorbius wrote: post #195
aidenn0 wrote: post #173

Earlier quoted context omitted.

Don't think bot; think botnet. Ratelimits do not work against botnets since they appear to be independent actors. e.g. if you think it's fine for everyone to do something 1-3 times, then you are letting a botnet of 10k hosts do something 10k-30k times. [edit] Also, NAT means that there could be hundreds or thousands of individual users on the same IP address (many dorms at smaller colleges are setup this way), so you…

Shouldn't open aggregate listing and blocking of botnets be effective? How many 10k node botnets are there? Also: egress hygiene should be a thing. Block subnets and ASNs if toxic behaviour is detected.

> How many 10k node botnets are there?

About 10 years ago it was somewhere around 10 million bot computers. Obviously the distribution isn't uniform there, but that gives you an idea of the order of magnitude.

Also that was 10 years ago, before smart fridges and tvs. So, possibly more now?

I don't think "just block all the bots" is a feasible solution here.

Re: Google’s new reCAPTCHA has a dark side

#303

Post by zymhan »

thekyle wrote: post #251
dessant wrote: post #126

Google has been doing the same with reCAPTCHA v2 [1]. They are aware of the legal risk of outright blocking users from accessing services, so reCAPTCHA v3 contains no user facing UI, Google merely makes a suggestion in the form of a user score, so the responsibility to delay or block access and the legal liability that comes with it falls on websites. reCAPTCHA v2 is superseded by v3 because it presents a broader opp…

> Since reCAPTCHA v3 scripts must be loaded on every page of a site, you must send Google your browsing history and detailed data about how you interact with sites in order to access basic services on the internet, such as paying your bills, or accessing healthcare services. I don't believe this is true. You only need to include the JavaScript on pages which actively use the reCAPTCHA score. For example, you might on…

Did you read the article?

> To make this risk-score system work accurately, website administrators are supposed to embed reCaptcha v3 code on all of the pages of their website, not just on forms or log-in pages.

Re: Google’s new reCAPTCHA has a dark side

#304

Post by peterangular »

amirhirsch wrote: post #142
jk2faster wrote: post #113

https://hcaptcha.com/ seems to be a viable alternative. If you are a developer, please consider using something other than reCaptcha. Not only is it annoying, but a privacy nightmare as well.

thanks, I work on hCaptcha, we are hoping to provide a unbiased bot-detection system with different incentives from an advertising company. Let me know if you have any questions.

Have any services like AC or 2captcha integrated against you?

Re: Google’s new reCAPTCHA has a dark side

#305

Post by owldimoon »

benreesman wrote: post #293
EpicEng wrote: post #266

Earlier quoted context omitted.

The fact that so much potentially sensitive data exists in a few repositories is in itself a bit foreboding. Who knows what companies will be able to glean from it one, five, or twenty years down the road? My behavior on the web being tracked by corporations with little incentive to do right by me is worrisome.

I’m more concerned that they’re designing the next version of the Web right under our noses than that they know what kind of sneakers I’m 8% more likely to buy.

I'm not sure where to add this comment, but I just wanted to briefly say that I appreciate your contributions to this topic. Both in terms of content and tone/delivery. These seem like constructive and valuable comments to me, so thanks!

Re: Google’s new reCAPTCHA has a dark side

#306

Post by verisimilitudes »

Entirely disregarding how it is browsing with Tor and finding ReCAPTCHA so often due to Cloudflare, it's a bother even on a website I regularly use over my normal connection.

Bandcamp is an online music store and I'm prompted for a Google ReCAPTCHA every time I try to log in, which really causes me to do it less often than I normally would, as I must permit Google JavaScript for it to succeed.

I've wanted to send a complaint about this to Bandcamp, but their email is hosted by gmail and none of my messages get to them because I host my own email. Adding reverse DNS and SPF is enough for many email servers, but not Google.

I find it a bad situation that my experience with a business is worse, due to Google, and I can't even contact them to let them know, due to Google.

Re: Google’s new reCAPTCHA has a dark side

#307

Post by judge2020 »

benologist wrote: post #274
mrguyorama wrote: post #263

Earlier quoted context omitted.

Honestly, statistics from about 2010 (ie before the age of neural network hype) and limited human observation.

Human moderation and ad-hoc heuristics seems to make the difference at Reddit too, rather than the CAPTCHA at registration.

I get a recaptcha when trying to sign up for a new account:

https://i.judge.sh/Flutter/45DyMRuL.png

maybe this is related to some other heuristic they're using for determining whether or not to show recaptcha (although this is in a no-extension Chrome on a residential IP address).

Re: Google’s new reCAPTCHA has a dark side

#308

Post by peterangular »

jchook wrote: post #227

reCAPTCHA apparently doesn't stop bots well at all. When I published a brand new site, I got thousands of bot sign-ups in the first couple weeks. reCAPTCHA apparently had no effect on stopping them. The bots signed-up with real user emails, causing my site to send unsolicited email to them, which affected my domain's email reputation significantly. I rolled my own invisible CAPTCHA and immediately stopped ALL the bot…

This is 100% accurate. There is no way to stop bots through reCAPTCHA, doesn't matter the version. It's honestly trivial and can be done with even the most basic web automation skillset.

Rolling your own CAPTCHA is a fantastic option, because folks like 2captcha are never going to take the time to integrate against a one-off solution. When you do something like that you drastically increase the barrier by introducing the need for a reverse engineering skillset to bypass your unique solution... and that skillset is expensive lemme tell ya ;)

Re: Google’s new reCAPTCHA has a dark side

#309

Post by rbritton »

remus wrote: post #286
gcbw2 wrote: post #209

Earlier quoted context omitted.

It is used irresponsibly. A responsible spam protection system should allow every spam (and consequentially responsible user) from an ISP. If a ISP shows sign of abuse, then show Captcha or other system that will block some spam while also blocking some valid users . This is a evil-for-the-greater-good solution. Do not fool yourself into thinking this is a solution (i.e. without caveats) Impacted users can complain t…

It seems that your suggestion is that ISP is a good signal for detecting spam, but it's not obvious to me that this is true. For example a site targeted by a botnet could be hit with traffic from a wide range of otherwise legitimate looking ISPs, in which case you're going to be getting a lot of spam on your website.

In our experience, country of origin is a better heuristic for possible abuse than an individual ISP is. Most malicious traffic comes from a fairly small number of countries, many of which are the obvious culprits. That kind of data is never guaranteed accurate, though.
Post reply on HN