Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

61–70 of 442 posts

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#61

Post by moconnor »

towelguy wrote: post #27
Khao wrote: post #18

Earlier quoted context omitted.

It probably uses a LOT more info than only the mouse move/mouse click. Remember, google tracking is embedded in probably 99% of websites you visit so from your ip, cookies, tracking, logged in Google profile, etc... they're able to know if you're a human or not.

So if I don't have a Google account or allow their cookies in other sites then I'm not a human anymore?

If you don't have advertising cookies set then you're either a robot or a potentially unprofitable human user from Google's point of view. Both would be best avoided.

As others have noted here, that's not the goal here and the captcha will degrade to the current ones in this case, but it highlights an interesting way for internet properties to maximize their revenue per user by only allowing users whose existing advertising footprint suggests they will contribute meaningful value to use the service in the first place.

Detecting bots is the first step to this, but detecting potentially unprofitable humans would be a natural extension.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#62

Post by tokenizerrr »

ins0 wrote: post #34

don't know if this works only for me but here is a live example - https://www.google.com/cbk?cb_client=maps_sv.tactile&output=...

It gives me the new version as well, but it seems google is convinced that I am a bot. Getting a regular captcha after clicking the button and I have to say that this is a lot worse of an experience than regular old captchas. Now I have to wait for a few seconds after clicking a button, then still solve a captcha.

Hopefully it gets better with time.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#63

Post by Jgrubb »

_wmd wrote: post #25

Who wants to place bets on the "potential robots" more likely to be those without Google cookies or a Google Account?

I can't think of many better uses for the menagerie of different tracking methods that they have planted on me, to be honest.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#64

Post by jcfrei »

cm2012 wrote: post #42
ins0 wrote: post #34

don't know if this works only for me but here is a live example - https://www.google.com/cbk?cb_client=maps_sv.tactile&output=...

It worked for me, though Google thought I was a robot at first.

Probably because lots of users are currently visiting the link.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#65

Post by spacefight »

rbdn wrote: post #48
spain wrote: post #36

So how does it work?

Google collects all your data and applies machine learning to predict a probability value that you are human. If it is below a certain threshold you have to enter a CAPTCHA.

The question was more about on how the new captcha works, I guess.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#67

Post by talles »

ggambetta wrote: post #37
whyNotBoth wrote: post #13

Oh, so just program bots to provide a mouse movement toward a form element along a distorted path, and always trigger them through the UI rather than as events. Got it!

Yeah, good luck with that.

Ya, a little good luck to he, but not so much...

I have seen video-games bots that does that unbelievably well. Some powerbot.org scripts are sincerely more human than myself.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#68

Post by xioxox »

rbdn wrote: post #54
towelguy wrote: post #26

Is it keyboard friendly?

You can try it out here: https://www.google.com/recaptcha/api2/demo If you are a recognized as human you could perhaps try it via Tor.

I wish these google pages wouldn't automatically assume you speak some language based on your IP address - I get mine in German without any option to switch. Aren't there standards for setting language in web browsers?

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#70

Post by fatratchet »

grimtrigger wrote: post #40

It seems like they're using cursor tracking to validate human-ness. Assuming thats the case: Since the cursor is outside of javascript's control, it would force the attacker one level higher (to the browser/os, instead of the dom). Not impossible, but still a significant barrier.

Not really, you would just need to reverse the js code, look at what data they actually send to google and randomly generate appropriate data like mouse movements.
Post reply on HN