Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s new reCAPTCHA has a dark side

fastcompany.com

Post reply on HN
Print view View original

471–480 of 566 posts

Re: Google’s new reCAPTCHA has a dark side

#471

Post by mirimir »

kbenson wrote: post #365
benreesman wrote: post #353

Earlier quoted context omitted.

I assure you that a clean browser and IP will break any surveillance that I know about.

No, a clean browser and IP with the combination of what fonts I have installed, how my video card renders a canvas and WebGL instance (which may be affected not just by the video card you have, but the driver version used with it), my screen size, and a few other system level items that come through may or may or may not be enough to uniquely identify you. Along with linking to a prior profile if you screw up one tim…

You gotta compartmentalize.

My meatspace identity uses a desktop that hits the Internet directly. It displays no interest in technical matters. Just banking, cards, shopping, general news, etc. It never accesses HN, or any of the other sites that Mirimir uses. Or that any of my other personas use.

Mirimir uses a VM, on a different host machine, and hits the Internet through three VPNs, in a nested chain. Some other personas use different VMs on the same host, connecting through different nested VPN chains. Some are Whonix instances, connecting via Tor, and reaching Tor through nested VPN chains.

So basically, each persona that I want isolated uses a different host machine and/or VM, a different browser, and a different IP address.

Re: Google’s new reCAPTCHA has a dark side

#472

Post by austhrow743 »

benreesman wrote: post #292
smsm42 wrote: post #260

Earlier quoted context omitted.

That's the annoying part of it. They try to collect everything about me, down to my favorite color and the brand of tea I am drinking, and they can't even deliver a semi-relevant ad. Best they can do is to bombard me with shoe and riding classes ads for 6 month after I search for "weight of a horseshoe" and stuff like that. They kill the privacy, they make 99% of the sites unusable without an ad blocker, and at the e…

If I were you I’d be more worried that Google de facto controls whatever we’re calling HTTP these days than that they have a BigTable entry that ties a browser you once used to a preference for Earl Grey.

do you deviate from social norms in any way more significant than tea preference? Have you ever? No extreme political opinions? No fetishes? There's really nothing in everything big tech companies have about you that would be worse for you to have leaked?

Re: Google’s new reCAPTCHA has a dark side

#473

Post by mirimir »

kbenson wrote: post #394
literallycancer wrote: post #386

Earlier quoted context omitted.

You use something that blocks scripts (like uMatrix) with an aggressive ruleset. On some sites you'll need to allow things to make them work. If they are loading trackers from the same servers that they load content from, you can't do much without wasting more time than you want. I'd say it breaks most of the tracking though. More sites than you'd expect work without js or with first-party js only. It's annoying when…

This was already with uBlock Origin. Also tried combinations of Ghostery and Privacy badger. All of it made very little difference for panopticlick, and that's probably a low-bar compared to what's common these days.

I don't care if every site that I browse using this VM knows that I'm Mirimir. I don't even try to hide that.

What matter is that my personas using other VMs, through other VPNs or Tor, don't get linked to my meatspace identity, to Mirimir, or to my other personas. And that's doable, I think.

Re: Google’s new reCAPTCHA has a dark side

#474

Post by dodobirdlord »

OrgNet wrote: post #457
saagarjha wrote: post #429

Earlier quoted context omitted.

Those aren’t extensions that an average user would install.

oh... so i should not be able to use any websites because of the extensions I use?

You should not be able to use any website that the host doesn't want you to use. That seems pretty straightforward. There's a strong correlation between profiles that look like yours and bots. Why should the web admin do free labor for you to put together a sufficiently nuanced bot-detection system to tell the difference, when the one they have is clearly good enough for them?

Re: Google’s new reCAPTCHA has a dark side

#475

Post by vlozko »

stickfigure wrote: post #374
__jal wrote: post #299

Earlier quoted context omitted.

> It’s nonetheless a shame that it’s so universally misunderstood how ad-supported megacorps make their money that even highly sophisticated users of the web still talk about the value of personal data (source: I ran Facebook’s ads backend for years). That may be the case for some people, but that is not my complaint, nor that of many folks I know. I simply don't care how FB, Google and other surveillance outfits mak…

They have no right to it, and I have every right to try to limit their visibility. That's entirely fair! But also: You have no right to use my website, and I have every right to limit your access. Recaptcha is simply part of this negotiation.

Except it happens on government-owned sites from the local to the national level where I have EVERY right to visit, especially as my tax dollars are paying for it and it’s for services that are available to the general public.

Re: Google’s new reCAPTCHA has a dark side

#476

Post by dvdkhlng »

__jal wrote: post #299
benreesman wrote: post #223

Earlier quoted context omitted.

Your comment adds a lot to the conversation, so I don’t want to be more contrary than necessary. It’s nonetheless a shame that it’s so universally misunderstood how ad-supported megacorps make their money that even highly sophisticated users of the web still talk about the value of personal data (source: I ran Facebook’s ads backend for years). Much like the highest information-gain feature for the future price of a…

> It’s nonetheless a shame that it’s so universally misunderstood how ad-supported megacorps make their money that even highly sophisticated users of the web still talk about the value of personal data (source: I ran Facebook’s ads backend for years). That may be the case for some people, but that is not my complaint, nor that of many folks I know. I simply don't care how FB, Google and other surveillance outfits mak…

> FB and Google are the equivalent of Superfund sites waiting to happen, and storing that data should be considered criminal.

I would think, that in the EU, under GDPR, collecting, transmitting and storing that data is in fact criminal, or at least subject to heavy fines. And under GDPR it won't help to just note the data collection in the TOS or ask the user for permission (under threat to not allow access to the service). So I really wonder how google plans to run this in europe.

Re: Google’s new reCAPTCHA has a dark side

#477

Post by braindead_in »

zuzun wrote: post #367
braindead_in wrote: post #166

What about Google Analytics? They already have all my browsing history. reCAPTCHA data is not even as detailed as GA.

Difference is you can block Google Analytics and the websites continue to work.

You can roll your own captcha as well. Nobody forces you to use reCAPTCHA v3.

Re: Google’s new reCAPTCHA has a dark side

#478

Post by worik »

__jal wrote: post #378
stickfigure wrote: post #374

Earlier quoted context omitted.

They have no right to it, and I have every right to try to limit their visibility. That's entirely fair! But also: You have no right to use my website, and I have every right to limit your access. Recaptcha is simply part of this negotiation.

> You have no right to use my website Of course. > Recaptcha is simply part of this negotiation. It is only a negotiation if I know it is there.

Privacy Badger will know it is there

Re: Google’s new reCAPTCHA has a dark side

#480

Post by smt88 »

benreesman wrote: post #393
__jal wrote: post #378

Earlier quoted context omitted.

> You have no right to use my website Of course. > Recaptcha is simply part of this negotiation. It is only a negotiation if I know it is there.

You’re commenting on HN, you know it’s there.

I'm commenting on HN. I've been developing for the web for 24 years. I don't know how and when my data is collected or shared most of the time.

The idea that FB and Google are openly making a trade with users is ludicrous. I'm horrified that you either sincerely believe that there's a fair negotiation happening or that you don't care (given your employment history).

Post reply on HN