Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

321–330 of 442 posts

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#321

Post by blisterpeanuts »

forgottenpass wrote: post #246
xtracto wrote: post #178

Earlier quoted context omitted.

> and it's frankly very insulting and rather disturbing that they think someone who inputs "unusual" search queries, according to their measure, is not human. Insulting? how is that insulting? You are entitled. You are entitled you block scripts, use Google's FREE service to perform any search query to search the web while blocking any program that attempts to identify you as not a bot. But if while using their free…

You are entitled. Has calling someone entitled ever been useful? For the last few years it's felt like nothing more than a petty "you're wrong" remark with bonus condensation built right in.

> Has calling someone entitled ever been useful? For the last few years it's felt like nothing more than a petty "you're wrong" remark with bonus condensation built right in.

In this case, calling someone entitled is actually a compliment, not an ad hominem insult or put-down, because it acknowledges the poster's humanity.

The proper response in this case would be, "Why, yes, I probably am a bit entitled, like most people. Thank you for recognizing that I am human."

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#322

Post by rudolf0 »

sesutton wrote: post #237
userbinator wrote: post #170

"If we can collect behavioural data from you, and it matches closely the behaviour of other humans, you are a human. Otherwise you're not a human." Does anyone else get that feeling from the description of what Google is doing? I've tripped their "we think you are a bot" detection filter and been presented with a captcha countless times while using complex search queries and searching for relatively obscure things, a…

I think you're being a little hyperbolic. Google is classifying what is already normal human behavior. Having JavaScript disabled is definitely not "normal" human behavior. Of the stats I found only 1-2% of users don't get JS and the UK's Government Digital Service found[1] that only 0.2% of users disabled or can't support JS. I don't think regular CAPTCHAs are going away anytime soon since any bot detection system i…

Exactly. It's perfectly reasonable to present users who disable JS with a one-time CAPTCHA they have to solve to use the site. Many sites just (usually unintentionally) prevent users with Javascript disabled from navigating a site at all, so this is a huge step up from that.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#323

Post by tracker1 »

azinman2 wrote: post #261
mjt0229 wrote: post #245

Earlier quoted context omitted.

DDG is excellent most of the time, but way behind when doing video or map searches. I have it as my default in most places, but sometimes I just have to fall back to Google.

I wish that were true. I tried to switch to them after they did their 'next' a few months back but the results were most of the time not nearly as good as Google's for my queries and I had to switch back.

Part of the reason google is so good is that they track you.. if you disable traffic, they aren't quite as good.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#324

Post by siavosh »

It's interesting that the adversarial nature of internet security is "breeding" an adversarial AI. Inevitably, people will start working on AI to beat this new captcha. I think in terms of parallels to biological evolution, security/fraud AI has the greatest evolutionary force behind it. Fun and scary to think where this particular breed of AI will lead.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#325

Post by blisterpeanuts »

lnanek2 wrote: post #165
username223 wrote: post #125

My guess is it's based on the tracking data they already collect on most people. I try to avoid it, so I get stuff like this: http://i.imgur.com/6mGYsav.png I have no idea what that second word is supposed to be, so if you use this, I probably won't use your site.

It isn't user friendly, but often with that type it doesn't care what you enter for the tough to read world. The easy to read word is your test. The other is a way to harness people to do difficult OCR tasks. Some web sites have had fun organizing entering dirty words for the tough to read ones regularly to mess with the results :)

This is fascinating. So they're harnessing the collective OCR powers of the internet surfing public? Diabolically clever.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#326

Post by nojvek »

Computer Vision guy here. Okay so you've made some improvements for normal users.

The captchas are still the old same, just not shown everytime. Still can be cracked with latest neural net techniques. The visual matching stuff can be guessed 6/10 times.

You still have audio captchas, that can be cracked.

If all fails you still have cheap labour from third world country. I don't see why this is revolutionary?

Google will now have their captchas present on every site and start logging user behavior in the name of identifying bots. Who says they won't use the data to drive their ad empire?

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#327

Post by xanderstrike »

fragmede wrote: post #297
nathas wrote: post #174

Earlier quoted context omitted.

"I have JS and cookies disabled" So imagine what bots often don't have. Adding JS interaction and cookies takes more effort on the part of the programmer writing a bot. So yeah, you'd look a lot more like a robot. How else would you quickly differentiate between human vs non-human based on a single request, or even a collection of requests over time? It's a game of stats at scale.

Here's a snippet of Python using the splinter library, to visit Google, type in a search query, and click 'search' (which is very Javascript heavy these days with their annoying 'instant' search). from splinter import Browser b = Browser() b.visit(' http://google.com' ) b.fill('q', 'browser automation') btn = b.find_by_name('btnG') btn.click() Not exactly 'more effort'...

With Selenium you can open a full web browser such as Chrome or Firefox and have it run through. A Google search is six lines:

require "selenium-webdriver" driver = Selenium::WebDriver.for :firefox driver.navigate.to "http://google.com" element = driver.find_element(:name, 'q') element.send_keys "Hello WebDriver!" element.submit

https://code.google.com/p/selenium/wiki/RubyBindings

Writing a bot with js and cookies is trivial, but it definitely won't defeat these tools. They probably look for time between actions or track mouse movements, stuff that makes the bots super inefficient.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#328

Post by rdl »

In the long run, I think it's unavoidable that AI-type systems continue to improve, while humans don't, so this will become a harder and harder problem.

One helpful approach would be to separate out "why CAPTCHA" into preventing abuse (through high volumes) and "guaranteed one (or small number) per person" from "am I interacting directly with a live human", and using different things for each.

The naive solution to a lot of this is identity -- if FB profiles are "expensive" to create, especially old ones with lots of social proof, you can use something like FB connect. However, there are a lot of downsides to this (chief being centralization/commercial control by one entity, which might be a direct competitor; secondarily, loss of anonymity overall.)

One interesting approach might be some kind of bond -- ideally with a ZK proof of ownership/control, and where the bond amount is at risk in the case of abuse, but it's not linked to identity.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#329

Post by heinrich5991 »

fragmede wrote: post #297
nathas wrote: post #174

Earlier quoted context omitted.

"I have JS and cookies disabled" So imagine what bots often don't have. Adding JS interaction and cookies takes more effort on the part of the programmer writing a bot. So yeah, you'd look a lot more like a robot. How else would you quickly differentiate between human vs non-human based on a single request, or even a collection of requests over time? It's a game of stats at scale.

Here's a snippet of Python using the splinter library, to visit Google, type in a search query, and click 'search' (which is very Javascript heavy these days with their annoying 'instant' search). from splinter import Browser b = Browser() b.visit(' http://google.com' ) b.fill('q', 'browser automation') btn = b.find_by_name('btnG') btn.click() Not exactly 'more effort'...

It's more effort as less libraries support it, you need to execute unknown code on your computer, etc.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#330

Post by hawleyal »

forgottenpass wrote: post #246
xtracto wrote: post #178

Earlier quoted context omitted.

> and it's frankly very insulting and rather disturbing that they think someone who inputs "unusual" search queries, according to their measure, is not human. Insulting? how is that insulting? You are entitled. You are entitled you block scripts, use Google's FREE service to perform any search query to search the web while blocking any program that attempts to identify you as not a bot. But if while using their free…

You are entitled. Has calling someone entitled ever been useful? For the last few years it's felt like nothing more than a petty "you're wrong" remark with bonus condensation built right in.

Is this Reddit? What year is it?
Post reply on HN