`It works best with context about how humans and bots interact with your website, so for best performance include reCAPTCHA in many places` O.o
Google’s new reCAPTCHA has a dark side
521–530 of 566 posts
Re: Google’s new reCAPTCHA has a dark side
#522Earlier quoted context omitted.
> You have no right to use my website Of course. > Recaptcha is simply part of this negotiation. It is only a negotiation if I know it is there.
> It is only a negotiation if I know it is there. You're not going to get through a site with a properly implemented captcha just by blocking it.
The point is if you see a captcha you can actively decide not to use it. If the website has no such box then you can't decide not to use the captcha
Re: Google’s new reCAPTCHA has a dark side
#523Earlier quoted context omitted.
If the v3 script is supposed to be installed on all pages of the website, in order to track the user's actions, I don't understand how that can be done without explicit user consent under GDPR.
As long as the ONLY processing of the data is for fraud detection/prevention, then GDPR specifically allows it as a “Legitimate Interest” Recital 47: “The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned…” Recital 71: “decision-making based on … profiling should be allowed where expressly authorised by … law … i…
First of all the "legitimate interest" part only works if the publisher can prove that the user data is only used for the stated purpose.
The fact that a third party server handles this is a problem. Because then the publisher has to have a data processing agreement in place with the third party.
This is what makes Google Analytics problematic too. The collection of analytics for improving the service can be a legitimate interest, however the data amendment for Google Analytics basically passes the blame on the publisher. I don't think many publishers read carefully Google's data processing amendment, otherwise they would drop usage of Google Analytics. Actually most publishers aren't even with GDPR for more serious reasons, like not anonymizing the user's IP or sharing data with Google for the purposes of ads targeting.
And there are many questions to be asked here.
Is that data private, for the use of the publisher in question, or is this a shared pool of knowledge between publishers?
If the later, then we have a problem, because even if there is a legitimate interest, it only applies to the publisher being visited. Can a user be blocked due to a profile that was built on another website? We are in murky waters.
---
Then there's always the question ... does the publisher really have a legitimate interest?
Claiming that you can have one under the law, doesn't mean you actually have it. There's a set of conditions that you have to comply with.
For example for the purposes of preventing fraud, at the very least you have to be able to show that fraud is possible. Just because you have a login form that's about managing the user's color preferences on the website doesn't mean that you can transmit the user's traffic to Google.
The requirements for legitimate interests are hard to comply with. And I have a hunch that in this case many websites won't comply.
Re: Google’s new reCAPTCHA has a dark side
#524Google has been doing the same with reCAPTCHA v2 [1]. They are aware of the legal risk of outright blocking users from accessing services, so reCAPTCHA v3 contains no user facing UI, Google merely makes a suggestion in the form of a user score, so the responsibility to delay or block access and the legal liability that comes with it falls on websites. reCAPTCHA v2 is superseded by v3 because it presents a broader opp…
the amount of sites asking me to identify fire-hydrants and traffic lights has dramatically increased since I turned on content-blocking that ships out of the box in firefox. Have been aggressively blocking already before (combo of: UBO, NandoDefender and steve black#s host file), but since turning on this inside FF ... there is no peace.
Anyone got some URL's that I can block all captcha attempts or does it mean I have to also sinkhole www.google.com[1] ?
( I don't have a problem not being able to access captcha enabled sites. )
[1] quick check tells me I would have to banish this endpoint which sucks because I'd have to parse the URL on every request and can't do it in DNS: https://www.google.com/recaptcha/api.js
Re: Google’s new reCAPTCHA has a dark side
#525Earlier quoted context omitted.
> You have no right to use my website Of course. > Recaptcha is simply part of this negotiation. It is only a negotiation if I know it is there.
I'm sure it will be mentioned in the 40 page privacy and cookie policy that pops up on every website asking you to agree before continuing.
Which is not compliant with GDPR.
Re: Google’s new reCAPTCHA has a dark side
#526Earlier quoted context omitted.
On a flip side: you really should check privacy settings in your Firefox, it seems Google can track you easily there. ;)
I use Firefox with Google container and uBlock Origin and Privacy Badger and also get a score of 0.7 How can I get better privacy settings?
I was being sarcastic - high score on captcha probably means G knows too much about you. That said, I don't think the scores are reliable. It is possible (probable even) that G is still running experiments.
Re: Google’s new reCAPTCHA has a dark side
#527Earlier quoted context omitted.
Good info. Thank you. And in keeping with recent revelations on Google's manipulation of search results, I think they have really gone beyond the pale. I un-archived my old iPhone two days ago and went back to iOS after the James O'Keefe/Project Veritas revelations. I now cannot, in good conscience, use anything Google. I always knew about the tracking and all that because, after all, they are an ad company. I'm now…
You know Project Veritas is a load of shit right?
Please explain. Even without the revelations from PV, it's patently obvious Google, et al are biased. Anyone can see it. Silicon Valley is a bloody echo chamber. If the videos by PV were not damning in the least, why did 4 different companies take them down and remove the accounts of PV?
Sunlight is the very best disinfectant. People have a right to know if searches are being manipulated to one side.
Re: Google’s new reCAPTCHA has a dark side
#528Earlier quoted context omitted.
They have no right to it, and I have every right to try to limit their visibility. That's entirely fair! But also: You have no right to use my website, and I have every right to limit your access. Recaptcha is simply part of this negotiation.
Is that so? What about the webmaster who simply wants to combat bots using his page, is the extent of data gathering on Google's behalf just part of the deal? What if selling user data is against the webmaster's ethics? "Don't use it I guess" Sure, except that no one in the exchange was told the extent to which this data is used, or what for. Users of Google's Captcha aren't told about this exchange. I disagree entir…
> Their business model depends on becoming inescapable
What will happen with v3 if I block gstatic.com? Will I be given the highest threat score?
Re: Google’s new reCAPTCHA has a dark side
#529Join me here, ill give you 70 points as a sign up bonus,.we can earn $200 daily..just do the task and youll be rewarded
https://coincircle.com/l/SMuyELTo~m
Re: Google’s new reCAPTCHA has a dark side
#530Earlier quoted context omitted.
> It is only a negotiation if I know it is there. You're not going to get through a site with a properly implemented captcha just by blocking it.
The point is if you see a captcha you can actively decide not to use it. If the website has no such box then you can't decide not to use the captcha
That's not a sinister "land grab" by Google, that's a fundamental aspect of the web, predating the advent of JavaScript. You reveal your identity quite thoroughly to the individual hosting services.
And it's difficult to imagine legislating that away, as it's sort of fundamental to all network computing.