Live data from Hacker News

Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

googleonlinesecurity.blogspot.com

291–300 of 442 posts

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#291

Earlier quoted context omitted.

But then a bot need only copy a human's mouse movements and disable cookies and we're back to the status quo.

i'm sure no one at google thought about that

There's no call for sarcasm. Do you have more insight into what data could allow them to distinguish between bots and people? If you do please share, because the Wired article and Google's own marketing video don't provide much information - it's obviously more focused on marketing than the technology.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#292

Earlier quoted context omitted.

But then a bot need only copy a human's mouse movements and disable cookies and we're back to the status quo.

Sure, for the bot. Captchas are pretty effective against bots, what's wrong with presenting the status quo to a bot? This is meant to improve things for the real people. I will appreciate not having to decipher some strange text.

I'm just not convinced from what's been shown that they'll have a long-term ability to distinguish between human mouse movements and those of a bot. So I'm curious as to really how one can keep this in place before it's overrun by spam and you need to make it more difficult anyway. More power to them if it works, but they're pretty light on details that inspire confidence, IMO.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#293
post #257

Why would you care whether a user is a robot? Surely whether the actions of that user are desirable or not is determined solely by those actions and not whether the thing performing the actions is a human or a robot. It seems like a better idea to disallow bad actions than to disallow robots. There are also people farms who solve captchas (e.g. via porn sites who ask you to solve a captcha which they then input to an…

Robots don't buy stuff. Their actions by definition are undesirable from the service provider's standpoint.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#294
post #257

Why would you care whether a user is a robot? Surely whether the actions of that user are desirable or not is determined solely by those actions and not whether the thing performing the actions is a human or a robot. It seems like a better idea to disallow bad actions than to disallow robots. There are also people farms who solve captchas (e.g. via porn sites who ask you to solve a captcha which they then input to an…

Robots don't buy stuff. Their actions by definition are undesirable from the service provider's standpoint.

Unless its a arbitrage robot!

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#295
post #23

It seems plausible that as more sites adopt this kind of technology, automated web access (e.g. scraping) the web will become harder -- for whatever purpose, good or ill. This has long been an "arms race" between hiding and detection. I can hope that reasonable uses of automation still remain feasible.

You're welcome as long as you're respectful. Just use a bot with a clear User Agent, not "Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) CriOS/36.0.1985.57 Mobile/11D257 Safari/9537.53". And, don't forget to start by reading my /robots.txt. If you behave yourself and abide by the rules, why should I ban your bot? If for whatever reason I don't want to allow your bot in, you mi…

That strongly depends on the data you have. I have written boots to scrape sites with government data so that I could do searches that wasn't possible using their online forms. I did not look at, nor attempt to obey, their robots text, nor would I have given a rats ass about breaking whatever they would put up to stop me.

There is also the argument that when you make something available on the web you make it available to everybody.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#296

Earlier quoted context omitted.

You are entitled. Has calling someone entitled ever been useful? For the last few years it's felt like nothing more than a petty "you're wrong" remark with bonus condensation built right in.

>Has calling someone entitled ever been useful? Not useful, and more over, it's ad hominem.

It's only ad hominem if it's used as support for an argument not directly related to the other's personality. It's not ad hominem in this case, because "you're entitled" is being used to support the claim, or as a parallel claim, that it's unreasonable to be insulted by a computer program thinking you're another computer program.

Claim: Turing was wrong about the Church-Turing Thesis because he was a homosexual -> ad hominem

Claim: Turing was immoral because he was a homosexual -> not ad hominem (although still not a good argument)

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#297
post #174

"If we can collect behavioural data from you, and it matches closely the behaviour of other humans, you are a human. Otherwise you're not a human." Does anyone else get that feeling from the description of what Google is doing? I've tripped their "we think you are a bot" detection filter and been presented with a captcha countless times while using complex search queries and searching for relatively obscure things, a…

"I have JS and cookies disabled" So imagine what bots often don't have. Adding JS interaction and cookies takes more effort on the part of the programmer writing a bot. So yeah, you'd look a lot more like a robot. How else would you quickly differentiate between human vs non-human based on a single request, or even a collection of requests over time? It's a game of stats at scale.

Here's a snippet of Python using the splinter library, to visit Google, type in a search query, and click 'search' (which is very Javascript heavy these days with their annoying 'instant' search).

from splinter import Browser b = Browser() b.visit('http://google.com') b.fill('q', 'browser automation') btn = b.find_by_name('btnG') btn.click()

Not exactly 'more effort'...

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#298
post #249

"If we can collect behavioural data from you, and it matches closely the behaviour of other humans, you are a human. Otherwise you're not a human." Does anyone else get that feeling from the description of what Google is doing? I've tripped their "we think you are a bot" detection filter and been presented with a captcha countless times while using complex search queries and searching for relatively obscure things, a…

You sound like a robot.

A robot permanently stuck on the "outraged" setting.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#299
post #257

Why would you care whether a user is a robot? Surely whether the actions of that user are desirable or not is determined solely by those actions and not whether the thing performing the actions is a human or a robot. It seems like a better idea to disallow bad actions than to disallow robots. There are also people farms who solve captchas (e.g. via porn sites who ask you to solve a captcha which they then input to an…

Robots don't buy stuff. Their actions by definition are undesirable from the service provider's standpoint.

Then limit the access of everyone who does not buy stuff to X requests per minute?

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#300

Earlier quoted context omitted.

Yeah, good luck with that.

http://phantomjs.org/ makes this easy enough to do.

You seem to be assuming Google doesn't know of PhantomJS and many other automation frameworks. In fact, I personally wrote some of the code to detect them - not in ReCaptcha, but in a closely related project (which ReCaptcha may be using, even...)
Post reply on HN