Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s new reCAPTCHA has a dark side

fastcompany.com

Post reply on HN
Print view View original

441–450 of 566 posts

Re: Google’s new reCAPTCHA has a dark side

#441

Post by laughinghan »

benreesman wrote: post #331
bad_user wrote: post #323

Earlier quoted context omitted.

How about our friends and family? Should we configure a VPN for them too? Btw the argument you just made applies to any form of surveillance or censorship. Just because your can still find functional VPN services for China, is China's great firewall OK? And what happens when web services start blocking VPNs? Netflix does it quite successfully. And I'm sure Cloudflare could provide such a service for free.

I’m not making a moral argument for the surveillance state, I wear Curve25519 on one arm and the word “citizenfour” on the other. I agree that there is a vast and almost impossible to regulate overreach by these companies. Your argument is extremely compelling. But when HN users complain about being spied on I smell a FAANG rejection letter.

If you think their argument is compelling, why are you insulting them?

(This is a genuine question. Many of your comments have added to the discussion and I've upvoted them. But I've also downvoted many that haven't.)

Re: Google’s new reCAPTCHA has a dark side

#442

Post by ma2rten »

cbsks wrote: post #5

You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor... I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does. Edit: I also got 0.7 on Firefox with st…

I got 0.9 on Chrome, logged into google. I also got 0.9 on Firefox, not logged into google.

In incognito mode in chrome, I sometimes get 0.9 and sometimes 0.7 when I reload.

Re: Google’s new reCAPTCHA has a dark side

#444

Post by laughinghan »

benreesman wrote: post #322
saagarjha wrote: post #317

Earlier quoted context omitted.

> reeks of sour grapes that a mediocre employee at one of these places makes 3-20x what anyone makes (as a rank and file employee) anywhere else This is not an argument and moreover not even true: there are companies that pay well and don’t collect reams of data on their users.

You didn’t address my argument and unless you’ve been on more comp committees than me then I would annotate that as sources needed.

What argument? What possible position could "if you can't configure a VPN, you're probably mediocre" be an argument for?

Re: Google’s new reCAPTCHA has a dark side

#445

Post by laughinghan »

benreesman wrote: post #349
heartbreak wrote: post #337

Earlier quoted context omitted.

This is a ridiculous argument. Advanced technical competency can not be a prerequisite for maintaining personal privacy.

We’re on a site premised on entrepreneurship, and you’re pointing out what sounds like a big market gap. I angel invest now and then, if you have a plausible way to make two billion people care about something that we agree could be better my email is in my profile. Even from the inside I didn’t see a way, but I’ve been wrong before.

Your HN profile appears to be blank, actually. Is this you? https://github.com/benreesman

Re: Google’s new reCAPTCHA has a dark side

#446

Post by whenchamenia »

benreesman wrote: post #390
bongobongo wrote: post #361

Earlier quoted context omitted.

It is not "wild speculative hyperbole" not to give the benefit of the doubt to companies that have repeatedly demonstrated that they are not entitled to the benefit of the doubt.

GPS tracker installed in people’s skull sounds hyperbolic to me.

How about peoples pockets? Its hyperbole, but not a huge reach.

Re: Google’s new reCAPTCHA has a dark side

#447

Post by erklik »

dessant wrote: post #126

Google has been doing the same with reCAPTCHA v2 [1]. They are aware of the legal risk of outright blocking users from accessing services, so reCAPTCHA v3 contains no user facing UI, Google merely makes a suggestion in the form of a user score, so the responsibility to delay or block access and the legal liability that comes with it falls on websites. reCAPTCHA v2 is superseded by v3 because it presents a broader opp…

> Since reCAPTCHA v3 scripts must be loaded on every page of a site, you must send Google your browsing history and detailed data about how you interact with sites in order to access basic services on the internet, such as paying your bills, or accessing healthcare services.

From a technical pov, how does one access a user's browsing history from client-side javascript. Isn't that something the browser should protect? or do you mean more that since the reCAPTCHA gets loaded on each page, Google can track what that IP is visiting by where reCAPTCHA gets loaded?

Re: Google’s new reCAPTCHA has a dark side

#448

Post by laughinghan »

jakobegger wrote: post #269
benreesman wrote: post #239

Earlier quoted context omitted.

I admit that I inferred the proposed intent for grabbing maximum personal data, but if you’re interested in anecdotes from the trenches: no one below senior director level gets a couple million in stock for any other reason than they pushed CTR by a few basis points. What I was trying to say is that seen through the lens of mechanism design no one is incentivized to query the like button table because there’s no upsi…

I'm not sure I understand correctly. Are you saying that all the personal user data is in reality not as valuable as everyone says it is? That is, all those megacorps are collecting terabytes of mostly useless data? Then why is this data collected and archived in the first place?

Because it costs practically nothing. If the cost is zero and the expected value is greater than zero, then no matter how little value it has it's still rational to collect it.

The problem is that the individual bears a very small risk of something very bad happening: "consider the hypothetical case of a gay blogger in Moscow who opens a LiveJournal account in 2004, to keep a private diary. In 2007 LiveJournal is sold to a Russian company, and a few years later—to everyone's surpise—homophobia is elevated to state ideology. Now that blogger has to live with a dark pit of fear in his stomach."

https://idlewords.com/talks/haunted_by_data.htm

The individual of course gets no benefit from the small chance the company can monetize on this data trove. So even though chances are they aren't harmed at all by this data collection, arguably the expected value of the benefit/harm to the individual is negative (harmful). But that doesn't change the data collector's calculation, of course. That's why government regulation is necessary.

Re: Google’s new reCAPTCHA has a dark side

#449

Post by taneq »

benreesman wrote: post #223
dessant wrote: post #126

Google has been doing the same with reCAPTCHA v2 [1]. They are aware of the legal risk of outright blocking users from accessing services, so reCAPTCHA v3 contains no user facing UI, Google merely makes a suggestion in the form of a user score, so the responsibility to delay or block access and the legal liability that comes with it falls on websites. reCAPTCHA v2 is superseded by v3 because it presents a broader opp…

Your comment adds a lot to the conversation, so I don’t want to be more contrary than necessary. It’s nonetheless a shame that it’s so universally misunderstood how ad-supported megacorps make their money that even highly sophisticated users of the web still talk about the value of personal data (source: I ran Facebook’s ads backend for years). Much like the highest information-gain feature for the future price of a…

> if your browsing history can juice CTR prediction then I’ve never seen it

That's great. So if my browsing history is useless then you won't mind not trying to snoop on it.

Re: Google’s new reCAPTCHA has a dark side

#450

Post by judge2020 »

AgentME wrote: post #436
judge2020 wrote: post #348

Earlier quoted context omitted.

Even UBO doesn't block ReCaptcha by default, so I don't see Rv3 being added to easylist anytime soon.

It doesn't block it because it's generally not active on all pages of a site. The description of v3 sounds more like Google Analytics and will probably be treated similarly.

I find a v3 block to be unlikely for the same reason v2 isn't in easylist - too much friction for the list users. Websites will likely break completely when performing actions if they don't receive any sort of verify token from the browser. It would probably be best to have a list for recaptcha v3 as a built-in optional filter so that users know they've enabled it and know why websites might be breaking.
Post reply on HN