Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s new reCAPTCHA has a dark side

fastcompany.com

Post reply on HN
Print view View original

431–440 of 566 posts

Re: Google’s new reCAPTCHA has a dark side

#431

Post by on_and_off »

lucb1e wrote: post #288
on_and_off wrote: post #198

Earlier quoted context omitted.

from the link >the score returned here is not a reflection on your Google account or type of traffic I got random scores as well. It looks like this is just a sample of the data structure that the service returns, not the actual score.

That would be a useless site, but that's not how I read it. I understand it as "this is not that Google thinks your account is a bot, it's that this request might be made by a bot. And since you didn't use this site as a normal website, it also doesn't score your type of traffic, just this one request". You might be right, but it really does seem to be doing a request to their API.

>That would be a useless site

looks like it is a demo of the API for people wanting to consume it. knowing what the payload looks like is not useless at all in this case.

Re: Google’s new reCAPTCHA has a dark side

#432

Post by GordonS »

cbsks wrote: post #5

You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor... I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does. Edit: I also got 0.7 on Firefox with st…

0.3 with Brave on Android, no extensions. 0.9 with Chrome on the same device, same connection.

Brave isn't particularly "unusual", and is even based on Chromium - surely this is Google blatantly punishing non-Chrome users?

Re: Google’s new reCAPTCHA has a dark side

#433

Post by qes »

lucb1e wrote: post #85
cbsks wrote: post #5

You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor... I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does. Edit: I also got 0.7 on Firefox with st…

This looks like a RNG: I got 0.7, 0.9, and 0.1 successively. It can't make up its mind whether I'm almost certainly not a bot (0.9) or almost certainly a bot (0.1)?

> This looks like a RNG

Come on, how is everyone in this chain so blind. It's literally in bold and the single largest block of content on the page:

NOTE:This is a sample implementation, the score returned here is not a reflection on your Google account or type of traffic. In production, refer to the distribution of scores shown in your admin interface and adjust your own threshold accordingly. Do not raise issues regarding the score you see here.

Re: Google’s new reCAPTCHA has a dark side

#434

Post by cyphar »

benreesman wrote: post #389
deckard1 wrote: post #371

Earlier quoted context omitted.

> You could either stop using these services No you can't. Facebook creates shadow profiles for every single person in the world. If any single one of your friends has WhatsApp, Facebook has your phone number. They have your phone number and the entire address book of your friend, who probably has friends in common. If two of your friends have WhatsApp and they both have your number... You see where I'm going here? T…

There’s a reasonable argument in there, but it applies to any world in which digital cameras are cheap. This is in a sense the worst kind of argument: superficially correct but really meant to tap into a popular groundswell of sentiment. The question isn’t “can FB use an off-the-shelf CNN to identify me personally” but rather: “If it weren’t FB who would be doing it instead?” and: “Should cheap digital cameras be ill…

> The question is “If it weren’t FB who would be doing it instead?” [...] “Should cheap digital cameras be illegal?”

Those are a complete non-sequitur.

Facebook (and Google) analyse every single photo that goes through their system with state-of-the-art ML (it's so good that it almost beat humans at matching faces ~5 years ago). This is a scale of surveillance which the human race has never encountered before in our history[+], and is a serious problem that we (as a society) need to make a decision on. In many countries, car license plates are OCR'd and automatically tracked whenever they travel on almost any main public road. Facial recognition in public places and on public transport is becoming a prevalent problem. And wearing masks is illegal in many countries -- meaning there is no way of "opting out" of the pervasive surveillance in the physical world. None of these things were nearly as commonplace (or even technologically plausible) ~30 years ago.

Cheap digital cameras are a completely unrelated topic. And if such large-scale surveillance was made illegal then nobody would be doing it legally, and those doing it would be held accountable for the public health risk they pose. We don't let people build buildings with asbestos any more.

[+] The Stazi and KGB only really had filing cabinets for tracking people and physical surveillance measures. The Gestapo didn't even have that (the Third Reich had census data which was tabulated using IBM machines in order to track who was Jewish within the Third Reich).

Re: Google’s new reCAPTCHA has a dark side

#435

Post by Sirened »

beardog wrote: post #282
johndough wrote: post #246

Earlier quoted context omitted.

Does not work with Tor. The plugin requires "privacy passes". Those passes can be obtained by solving captchas, but when trying to do so, one is greeted with this message about being blocked: https://i.imgur.com/qXJfl6J.png

Try rebuilding your Tor circuit when this happens. https://tb-manual.torproject.org/managing-identities/

This sort of breaks tor though, doesn't it? Tor works really well if you stay on the same circuit for a while since it reduces the chances you have a compromised circuit. If you start getting recaptcha to block every exit node except those you control, you essentially have amplified your effective strength on the tor network.

Re: Google’s new reCAPTCHA has a dark side

#436

Post by AgentME »

judge2020 wrote: post #348
bscphil wrote: post #311

Earlier quoted context omitted.

> Since reCAPTCHA v3 scripts must be loaded on every page of a site, you must send Google your browsing history and detailed data about how you interact with sites in order to access basic services on the internet, such as paying your bills, or accessing healthcare services. > If you'll refuse to transmit personal data to Google, websites will hinder or block your access. I wonder how true this really is. 20% or so o…

Even UBO doesn't block ReCaptcha by default, so I don't see Rv3 being added to easylist anytime soon.

It doesn't block it because it's generally not active on all pages of a site. The description of v3 sounds more like Google Analytics and will probably be treated similarly.

Re: Google’s new reCAPTCHA has a dark side

#437

Post by tus87 »

dessant wrote: post #126

Google has been doing the same with reCAPTCHA v2 [1]. They are aware of the legal risk of outright blocking users from accessing services, so reCAPTCHA v3 contains no user facing UI, Google merely makes a suggestion in the form of a user score, so the responsibility to delay or block access and the legal liability that comes with it falls on websites. reCAPTCHA v2 is superseded by v3 because it presents a broader opp…

> They are aware of the legal risk of outright blocking users from accessing services

What does this mean? Any sources about these legal risks?

Re: Google’s new reCAPTCHA has a dark side

#438

Post by laughinghan »

benreesman wrote: post #314
__jal wrote: post #299

Earlier quoted context omitted.

> It’s nonetheless a shame that it’s so universally misunderstood how ad-supported megacorps make their money that even highly sophisticated users of the web still talk about the value of personal data (source: I ran Facebook’s ads backend for years). That may be the case for some people, but that is not my complaint, nor that of many folks I know. I simply don't care how FB, Google and other surveillance outfits mak…

You could either stop using these services or (as I suspect) you find them too valuable to dismiss entirely quarantine them to a VPN/incognito interaction in less time than it took to type that comment. I don’t want to single you out personally but there’s a broad trend on HN of bitter-sounding commentary on the surveillance powers of these companies by people who can easily defeat any tracking that it’s economical f…

It takes less time to lock my front door than to configure a VPN, but burglarizing an unlocked house still is and should be illegal.

Re: Google’s new reCAPTCHA has a dark side

#439

Post by themacguffinman »

zcid wrote: post #426
miccah wrote: post #328

> According to two security researchers who’ve studied reCaptcha, one of the ways that Google determines whether you’re a malicious user or not is whether you already have a Google cookie installed on your browser. This makes sense to me. The presence of cookies is a strong indicator of normal human browsing, and Google would only be able to see their own cookie.

Except a lot of people don't like Google having persistent cookies that track your web usage. Why should giving up that data be a prerequisite for accessing a website?

It's not a prerequisite for accessing the website, it's just a prerequisite for skipping the captcha puzzle.

Re: Google’s new reCAPTCHA has a dark side

#440

Post by bduerst »

saagarjha wrote: post #429
OrgNet wrote: post #375

Earlier quoted context omitted.

I use pretty standard extensions... uBlockO, decentral eyes, smart referrer... I just wish that companies would stop using Google's reCAPTCHA service. Also my IP address rarely changes and I don't think that any malicious traffic is coming from it. And I have Comcast, so I hope that they didn't blacklist all of us... (I did talk bad about Google a few times though, maybe that's it)

Those aren’t extensions that an average user would install.

Just Smart Referer alone is a likely culprit. Masking or having no referer is a prime attribute for low-level bots.
Post reply on HN