Live data from Hacker News

Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

googleonlinesecurity.blogspot.com

281–290 of 442 posts

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#282
post #107

Earlier quoted context omitted.

okay, that's reasonable.

But then a bot need only copy a human's mouse movements and disable cookies and we're back to the status quo.

Sure, for the bot. Captchas are pretty effective against bots, what's wrong with presenting the status quo to a bot? This is meant to improve things for the real people. I will appreciate not having to decipher some strange text.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#283

Earlier quoted context omitted.

It gives me the new version as well, but it seems google is convinced that I am a bot. Getting a regular captcha after clicking the button and I have to say that this is a lot worse of an experience than regular old captchas. Now I have to wait for a few seconds after clicking a button, then still solve a captcha. Hopefully it gets better with time.

Try this one: http://nomorecaptchas.com/ It's very similar. I might go as far as saying that Google copied them.

NMC is a little different and goes beyond wasting a users time choosing colors. This is passive user authentication detecting human vs bot and bot vs bot. Today is an announcement of more platforms that can use it. Worlds most user friendly login protection in more flavors: #ClassicASP @DotNet @Drupal @Joomla #JSP #PHP

http://ow.ly/FiuTi

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#284
post #94

It says that they do take mouse movement into account but the cookie part makes me feel a little uneasy: > IP addresses and cookies provide evidence that the user is the same friendly human Google remembers from elsewhere on the Web. If this becomes a trend then major commercial websites will become unusable for people who are not accepting (third-party) cookies. "Because those damn bots" is a straw man argument to m…

It's only used to generate a confidence level. "In cases when the risk analysis engine can't confidently predict whether a user is a human or an abusive agent, it will prompt a CAPTCHA to elicit more cues" So if you have cookies disabled, you'll probably just get a regular captcha

that is the bait part of the bait&switch strategy.

Just ask anyone older enough to have worked with Microsoft et all in the past.

yeah, the company is nice now, but nobody can say anything about tomorrow. So do you their sane offerings, but be aware that you may have to be on the line to change it at a moments notice. and try to not depend on it too much. (i.e. always have a 1% bucket with an alternative solution, least you find yourself locked in when you 'thought' you had an alternative if you 'needed')

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#285

Earlier quoted context omitted.

> and it's frankly very insulting and rather disturbing that they think someone who inputs "unusual" search queries, according to their measure, is not human. Insulting? how is that insulting? You are entitled. You are entitled you block scripts, use Google's FREE service to perform any search query to search the web while blocking any program that attempts to identify you as not a bot. But if while using their free…

No one should complain about anything, ever.

Including about other people's complaining.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#287

Earlier quoted context omitted.

I read it in the wired.com article about this also submitted to HN: "And [Vinay] Shet says even the tiny movements a user’s mouse makes as it hovers and approaches a checkbox can help reveal an automated bot."

I guess it's a lot more complicated than it looks at a cursory glance.

It's almost as if Google is playing its cards close to its chest to avoid tipping off people intent on defeating it's captchas!

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#288
post #92

Hmmmm. Nice move Google. But I also remember that a machine passed the Turing test. And I don't like the sound of these two news together. Not because I'm worried about you, but because I'm worried about the websites I run as a dev. Moreover, I'm not sure if most people know this, but reCaptcha was supposed to be converting ancient text to digital text[I read that once on quora, I'm not really sure if it's entirely t…

ha yeah that was definitely the original purpose/project of reCAPTCHA.... but I think shortly after the google purchase, the AI got so good at reading garbled ancient texts that G allowed it to move on to other things..like house numbers.

House numbers are actually the easier version, you got them if reCAPTCHA already knew you're probably human. After screwing it up a few times, it punts you back into the general category and you get two words again.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#289
post #284

Earlier quoted context omitted.

It's only used to generate a confidence level. "In cases when the risk analysis engine can't confidently predict whether a user is a human or an abusive agent, it will prompt a CAPTCHA to elicit more cues" So if you have cookies disabled, you'll probably just get a regular captcha

that is the bait part of the bait&switch strategy. Just ask anyone older enough to have worked with Microsoft et all in the past. yeah, the company is nice now, but nobody can say anything about tomorrow. So do you their sane offerings, but be aware that you may have to be on the line to change it at a moments notice. and try to not depend on it too much. (i.e. always have a 1% bucket with an alternative solution, le…

Sorry, can you expand on their long game here? They've just made it easier, is that the bait? Captcha was already everywhere so it doesn't seem they needed bait to popularise it? It's also used by non Google companies who will presumably stop including it if Google decide to make it an impassable lock - which would I guess be the switch? Making it harder would just be back to before, so an actual effective switch would just be a lock? Which doesn't make sense for the obvious reason that Google make more money in their services are accessible. What are you getting at here?

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#290
post #254

Earlier quoted context omitted.

Actually it would be great is someone has some ideas for ways to identify humans that don't require stuff like javascript. From the perspective of a service provider (and I'm one) the bots are a scourge, they consume resources and they are clearly attempting to 'mine' the search engine for something, but they are unwilling to come forward and just ask the search provider if they would sell it to them. And since they…

Isn't this just the cost of having a "free" product? Bots are not really a problem. Its just that their traffic cannot be monetized. If you could monetize-bot traffic your problem would be solved. Or put another way, if you framed the issue as a business model one, not a technical one, it might be a useful exercise.

   > if you framed the issue as a business model one, not 
   > a technical one, it might be a useful exercise.
That was kind of my point. Clearly most of the bots are trying to scrape my search engine for some specific data. I would (generally) be happy to just sell them that data rather than have them waste time trying to scrape us (that is the business model, which goes something like "Hey we have a copy of the big chunk of the web on our servers, what do you want to know?" but none of the bot writers seem willing to got there. They don't even send an email to ask us "Hey, could we get a list of every site you've crawled that uses the following Wordpress theme?" No instead they send query after query for "/theme/xxx" p=1, p=2, ... p=300.

On a good day I just ban their IP for a while, when I'm feeling annoyed I send them results back that are bogus. But the weird thing is you can't even start a conversation with these folks, and I suppose that would be like looters saying "Well ok how about you help load this on a truck for me for 10 cents on the dollar and then your store won't be damaged." or something.

Post reply on HN