Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s new reCAPTCHA has a dark side

fastcompany.com

Post reply on HN
Print view View original

351–360 of 566 posts

Re: Google’s new reCAPTCHA has a dark side

#351

Post by LinuxBender »

pkaye wrote: post #335
LinuxBender wrote: post #90

Earlier quoted context omitted.

Would it though? If each system was unique and rotated through different types of challenges, the bot would have to be custom tailored to handle every challenge type. i.e. free form questions, count the gray dots (vision impaired friendly), math questions, play tic-tac-toe and get a stalemate, ascii hang-man ... I could think of hundreds of different challenges. The bot would have to constantly adapt and the bot deve…

The spammers can also use cheap overseas labor to update the bots.

I would be honored to help them feed their families. It would be a fun game of cat and mouse. Based on discussions here, it sounds like people have already automated Google captcha. I will go ahead and work on a few of my own and see what happens.

Maybe we can turn this into a public competition.

Re: Google’s new reCAPTCHA has a dark side

#352

Post by dmitriid »

benreesman wrote: post #336
amenod wrote: post #327

Earlier quoted context omitted.

> You could either stop using these services or ... Are you serious? Have you tried not using their services? Try blocking Google Analytics, Tag Manager, ReCaptcha, fonts, gstatic,... What you will see is that you can no longer access much of the Internet. Want to participate in StackOverflow? Good luck if you block Google. My beef is not with them trying to find my data when I'm on their site(s). They are however ev…

Unfortunately politically acceptable regulation only deters new ventures because it makes the costs of compliance too high. The right vehicle for this is antitrust, but if you think you can sell that in this climate then I’ve got a great deal for you on the London Bridge.

The costs of compliance are not too high. Compliance is actually ridiculously easy for new companies: they need to collect only the data they need. That is all there is

Re: Google’s new reCAPTCHA has a dark side

#353

Post by benreesman »

kbenson wrote: post #340
benreesman wrote: post #314

Earlier quoted context omitted.

You could either stop using these services or (as I suspect) you find them too valuable to dismiss entirely quarantine them to a VPN/incognito interaction in less time than it took to type that comment. I don’t want to single you out personally but there’s a broad trend on HN of bitter-sounding commentary on the surveillance powers of these companies by people who can easily defeat any tracking that it’s economical f…

> You could either stop using these services or How do you stop using a service when you have little or no indication that it does something like this before hand, and afterwards the privacy is already gone? If I use a site and view my profile page and the url contains aa account id or username and some google or facebook analytics is loaded, or a like button is sitting somewhere, how am I to know that before the pag…

I assure you that a clean browser and IP will break any surveillance that I know about.

Re: Google’s new reCAPTCHA has a dark side

#354

Post by [deleted] »

benreesman wrote: post #314
__jal wrote: post #299

Earlier quoted context omitted.

> It’s nonetheless a shame that it’s so universally misunderstood how ad-supported megacorps make their money that even highly sophisticated users of the web still talk about the value of personal data (source: I ran Facebook’s ads backend for years). That may be the case for some people, but that is not my complaint, nor that of many folks I know. I simply don't care how FB, Google and other surveillance outfits mak…

You could either stop using these services or (as I suspect) you find them too valuable to dismiss entirely quarantine them to a VPN/incognito interaction in less time than it took to type that comment. I don’t want to single you out personally but there’s a broad trend on HN of bitter-sounding commentary on the surveillance powers of these companies by people who can easily defeat any tracking that it’s economical f…

[deleted]

Re: Google’s new reCAPTCHA has a dark side

#355

Post by joaobeno »

behringer wrote: post #325
frenchyatwork wrote: post #179

Earlier quoted context omitted.

It is, in the sense that it's easy to disable Google Analytics by disabling tracking in Firefox, and there's no consequences. If a website uses reCAPTCHA, and you have tracking disabled, the website will break.

Works for me. Assuming one uses something like Privacy Badger and it if it were programmed to block reCaptcha, these websites that require recaptcha will go the way of anti-adblocker popups. People will simply say no and hit the X and go to their competitors.

Sure, my gov (Brazil) uses reCaptcha on the page where you can check your electoral status (For example: if you can vote, where, and if not, what is missing). Where can I find a competitor for that?

Re: Google’s new reCAPTCHA has a dark side

#356

Post by OrgNet »

miohtama wrote: post #318
dessant wrote: post #126

Google has been doing the same with reCAPTCHA v2 [1]. They are aware of the legal risk of outright blocking users from accessing services, so reCAPTCHA v3 contains no user facing UI, Google merely makes a suggestion in the form of a user score, so the responsibility to delay or block access and the legal liability that comes with it falls on websites. reCAPTCHA v2 is superseded by v3 because it presents a broader opp…

From the service provider and devops perspective I find reCAPTCHA beautiful. It brings down malicious form fill, form spam, user creation and password brute forcing rates. Also as a VPN user, I found out that migrating to more expensive, higher grade VPN, solved a lot of my problems. In the end it is not privacy, not your VPN that matters from the service provider point of view. It matters that your IP address is spe…

I don't even use a VPN and have lots of issues solving google's captcha...

Re: Google’s new reCAPTCHA has a dark side

#357

Post by xg15 »

Apart from the privacy nightmare, couldn't this also result in discrimination?

> For instance, if a user with a high risk score attempts to log in, the website can set rules to ask them to enter additional verification information through two-factor authentication.

Seems to me, this could easily flag genuine users who access the site through a non-standard flow - e.g. because they use assistive technologies. In the worst case, this could result in impaired users being forced to jump through additional hoops - or being blocked completely.

Re: Google’s new reCAPTCHA has a dark side

#358

Post by anth_anm »

benreesman wrote: post #223
dessant wrote: post #126

Google has been doing the same with reCAPTCHA v2 [1]. They are aware of the legal risk of outright blocking users from accessing services, so reCAPTCHA v3 contains no user facing UI, Google merely makes a suggestion in the form of a user score, so the responsibility to delay or block access and the legal liability that comes with it falls on websites. reCAPTCHA v2 is superseded by v3 because it presents a broader opp…

Your comment adds a lot to the conversation, so I don’t want to be more contrary than necessary. It’s nonetheless a shame that it’s so universally misunderstood how ad-supported megacorps make their money that even highly sophisticated users of the web still talk about the value of personal data (source: I ran Facebook’s ads backend for years). Much like the highest information-gain feature for the future price of a…

> source: I ran Facebook’s ads backend for years

Why would anyone ever trust a goddamn thing you have to say about their data?

Unless they pay your salary and are asking you to give your expertise on hoarding and abusing user data, obviously.

Re: Google’s new reCAPTCHA has a dark side

#359

Post by smsm42 »

benreesman wrote: post #292
smsm42 wrote: post #260

Earlier quoted context omitted.

That's the annoying part of it. They try to collect everything about me, down to my favorite color and the brand of tea I am drinking, and they can't even deliver a semi-relevant ad. Best they can do is to bombard me with shoe and riding classes ads for 6 month after I search for "weight of a horseshoe" and stuff like that. They kill the privacy, they make 99% of the sites unusable without an ad blocker, and at the e…

If I were you I’d be more worried that Google de facto controls whatever we’re calling HTTP these days than that they have a BigTable entry that ties a browser you once used to a preference for Earl Grey.

I am worried by both. In fact, I am worried by more than these two things about Google, but listing them all would probably take this discussion way off course.

Re: Google’s new reCAPTCHA has a dark side

#360

Post by OrgNet »

danShumway wrote: post #18
cbsks wrote: post #5

You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor... I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does. Edit: I also got 0.7 on Firefox with st…

With Firefox fingerprint resisting turned on and with Ublock Origin/UMatrix, I get a score of 0.1. And I'm not even on a VPN; I'm sure on my home network I'd have an even lower score. To me, it feels like Google's entire strategy behind reCaptcha is to make it harder to protect your privacy. We've basically given up on the idea that there are tasks only humans can do, and to me V3 feels like Google openly saying, "Yo…

I also get 0.1 with the same config as you, except that I had uMatrix disabled (which if anything, should improve the score in Google's eyes)...

so why are they having you solve image puzzles if they know that they are going to fail you? even if they know that you are human...

Post reply on HN