Live data from Hacker News

Google’s new reCAPTCHA has a dark side

fastcompany.com

561–566 of 566 posts

Re: Google’s new reCAPTCHA has a dark side

#561

Earlier quoted context omitted.

You can block googles crawler with robots.txt

That's not very relavant to my proposed problem. Here's an immaginary scenario: recaptcha blocks all crawlers except google's ones, how are competitors supposed to compete if they can't crawl anything despite robots.txt or whatever?

The purpose of recaptcha is to block malicious bots from accessing parts of a site that automated bots are not supposed to go to.

Why would someone be using recaptcha to block bots from the general part of their web site? Your imaginary scenario would require web masters to become hostile to crawlers.

Re: Google’s new reCAPTCHA has a dark side

#562

Earlier quoted context omitted.

That's not very relavant to my proposed problem. Here's an immaginary scenario: recaptcha blocks all crawlers except google's ones, how are competitors supposed to compete if they can't crawl anything despite robots.txt or whatever?

The purpose of recaptcha is to block malicious bots from accessing parts of a site that automated bots are not supposed to go to. Why would someone be using recaptcha to block bots from the general part of their web site? Your imaginary scenario would require web masters to become hostile to crawlers.

> web masters to become hostile to crawlers

You must have been living under a rock for the past decade, haven't you? Web masters are definitely hostile towards webcrawlers. There's an entire platitude of "web-crawler" protection services - cloudflare for example is probably the biggest one.

Re: Google’s new reCAPTCHA has a dark side

#563

Earlier quoted context omitted.

> The data is collected under a non-reuse agreement Oh you sweet summer child. Would you by any chance be interested in buying a bridge? Despite that, even assuming if it's true and we'll have a lovely accurate AI captcha system. The big down-side is that captcha is breaking programmable web. I maintain a lot of small software crawlers from simple notification applets to bigger analytic crawlers and the web in the pa…

> Despite that, even assuming if it's true and we'll have a lovely accurate AI captcha system. The big down-side is that captcha is breaking programmable web. I actually find this argument to be a bit compelling, if I'm being selfishly honest. It's super annoying that crawlers are so awkward to write these days, and I miss the days when they worked better. > but services like cloudflare, distils, captcha break them a…

No I'm getting down-voted because hackners is notoriously pro corporate medium - of course people don't care about public data and data freedom here.

> It's super annoying that crawlers are so awkward to write these days, and I miss the days when they worked better.

It has never been easier to write crawlers witht he exception of purposfully built in barriers. Just check youtube-dl

> I don't disagree, but I also think we may be asking to keep model T's or gasoline driven 1-person bikes around. These technologies made more sense once, but make much less sense now.

What are you on about? For example to get around some crawler protections you need to execute js with some specific stack of libs. Distributing crawler.py vs distributing a whole stack is much more difficult.

Your logic makes absolutely no sense. In the web there is no distinction between who is behind the ip address. It's a net of ip addresses and headers, right? If I'm asking for your resource that you choose to serve publicly I only need to give you my IP and some http cruft, right? So now it turns out you don't want to serve _some_ ip addresses.

Now you have to introduce an extra layer that is not part of the web - a layer that is incompatible with your goal. You need to use javascript to fingerprint your client - except you know what? client is the one executing your fingerprint code so they can send whatever they want to you. I've never seen more idiotic medium. On one hand I get job security on the other the web is absolutely broken by complete bafoons who have zero logical capabilities.

Re: Google’s new reCAPTCHA has a dark side

#564
post #206

Earlier quoted context omitted.

I'm assuming you are not logged into a Google account during this? What happens if you create a throwaway Google account while on Tor? Or is that also impossible?

I remember that these days google requires a phone number. Finding a throwaway number is hard, especially in some countries.

I find they don't want a phone number if you sign up to youtube and opt to create a new gmail address instead of providing an existing email addr. Whether this works consistently, though ...

edit: also didn't try it over tor

Re: Google’s new reCAPTCHA has a dark side

#565

Earlier quoted context omitted.

Try rebuilding your Tor circuit when this happens. https://tb-manual.torproject.org/managing-identities/

This sort of breaks tor though, doesn't it? Tor works really well if you stay on the same circuit for a while since it reduces the chances you have a compromised circuit. If you start getting recaptcha to block every exit node except those you control, you essentially have amplified your effective strength on the tor network.

Tor is already broken for an adversary with that capability.

Re: Google’s new reCAPTCHA has a dark side

#566

Luckily Idon't need any of the sites that ues this obnoxious tool. Just vote with your feet and tell the site to drop it or lose you.

Yet you're on a website that uses ReCaptcha. Just tried to register via Tor and got this: https://i.imgur.com/svjfLqo.png Kind of toothless to say "I'll NEVER use ReCaptcha (except for websites I want to use)!" In fact, I'd go a step further and assert that, while you complain about ReCaptcha, you're actively benefiting from HN using ReCaptcha since you see less spam day-to-day because of it. ;)

I don't remember using recaptcha on HN.
Post reply on HN