Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

341–350 of 442 posts

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#341

Post by rudolf0 »

Dylan16807 wrote: post #191
Sir_Cmpwn wrote: post #157

Earlier quoted context omitted.

Passing the captcha through an entirely automated procedure.

In bulk? It's not supposed to stop real users from using a bit of scripting.

It kind of is, actually. Cloudflare, for example, uses a single CAPTCHA to prevent ongoing DDoS attacks. If they switched to this new reCAPTCHA and if a DDoSer can use Selenium to get past the challenge, then the CAPTCHA process has failed.

There are always tradeoffs with this. I strongly suspect Google is going to have to restrict it within a year or so, resulting in the number of users who still have to solve CAPTCHAs closer to 10-20%.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#342

Post by mcintyre1994 »

sjs382 wrote: post #129

Those computer-vision challenges mentioned in the blog post aren't 100% clear. For the first one, my eyes went directly to the cranberry sauce, and I thought to myself "Wait... is that one supposed to be clicked, too?"

I thought it was unclear too for a different reason - the text says "that match this one" which I read as being actual identical matches. Sure it's obvious when you see the images but that wording feels really awkward.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#343

Post by xnull1guest »

xtracto wrote: post #178
userbinator wrote: post #170

"If we can collect behavioural data from you, and it matches closely the behaviour of other humans, you are a human. Otherwise you're not a human." Does anyone else get that feeling from the description of what Google is doing? I've tripped their "we think you are a bot" detection filter and been presented with a captcha countless times while using complex search queries and searching for relatively obscure things, a…

> and it's frankly very insulting and rather disturbing that they think someone who inputs "unusual" search queries, according to their measure, is not human. Insulting? how is that insulting? You are entitled. You are entitled you block scripts, use Google's FREE service to perform any search query to search the web while blocking any program that attempts to identify you as not a bot. But if while using their free…

Google's services are not free.

You trade your data, screen real estate, and attention for their service. This is worth a lot - Google is worth a lot. They didn't do it by giving out services for free.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#344

Post by karmacondon »

cbhl wrote: post #239
userbinator wrote: post #170

"If we can collect behavioural data from you, and it matches closely the behaviour of other humans, you are a human. Otherwise you're not a human." Does anyone else get that feeling from the description of what Google is doing? I've tripped their "we think you are a bot" detection filter and been presented with a captcha countless times while using complex search queries and searching for relatively obscure things, a…

(Disclaimer: I work at Google, but not on ReCaptcha.) The point of this change is to make things easier on 90% of humans -- the ones who have JavaScript and third-party cookies enabled now get to tick a checkbox and be on their merry way, instead of doing a useless captcha when we knew they were already humans. Recall that when ReCaptcha initially came out, the argument was "humans are wasting all of this time, let's…

If book-based or street view-based captchas go away, I suspect it will be because bots/spammers got better at solving them than humans

But, wait. Isn't that what we want? It seems like bots and spammers have a relatively small cost to a company like google, while digitizing books and house numbers is relatively valuable. I don't have numbers for a detailed cost-benefit analysis, but if bots get good enough to do time consuming work accurately, that's a win right?

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#346

Post by makomk »

Pwntastic wrote: post #104
cJ0th wrote: post #94

It says that they do take mouse movement into account but the cookie part makes me feel a little uneasy: > IP addresses and cookies provide evidence that the user is the same friendly human Google remembers from elsewhere on the Web. If this becomes a trend then major commercial websites will become unusable for people who are not accepting (third-party) cookies. "Because those damn bots" is a straw man argument to m…

It's only used to generate a confidence level. "In cases when the risk analysis engine can't confidently predict whether a user is a human or an abusive agent, it will prompt a CAPTCHA to elicit more cues" So if you have cookies disabled, you'll probably just get a regular captcha

The regular CAPTCHA is already approaching the point of being unsolvable for mere humans. If the only people who have to use it are cutting into Google's profit margins by blocking tracking, that gives them even more incentive to make life miserable for those users.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#347

Post by Hoffmannnn »

fragmede wrote: post #297
nathas wrote: post #174

Earlier quoted context omitted.

"I have JS and cookies disabled" So imagine what bots often don't have. Adding JS interaction and cookies takes more effort on the part of the programmer writing a bot. So yeah, you'd look a lot more like a robot. How else would you quickly differentiate between human vs non-human based on a single request, or even a collection of requests over time? It's a game of stats at scale.

Here's a snippet of Python using the splinter library, to visit Google, type in a search query, and click 'search' (which is very Javascript heavy these days with their annoying 'instant' search). from splinter import Browser b = Browser() b.visit(' http://google.com' ) b.fill('q', 'browser automation') btn = b.find_by_name('btnG') btn.click() Not exactly 'more effort'...

Seriously?

https://www.google.com/search?q=PROGRAMATICALLY_REPLACE_ME

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#350

Post by hahainternet »

xnull1guest wrote: post #343
xtracto wrote: post #178

Earlier quoted context omitted.

> and it's frankly very insulting and rather disturbing that they think someone who inputs "unusual" search queries, according to their measure, is not human. Insulting? how is that insulting? You are entitled. You are entitled you block scripts, use Google's FREE service to perform any search query to search the web while blocking any program that attempts to identify you as not a bot. But if while using their free…

Google's services are not free. You trade your data, screen real estate, and attention for their service. This is worth a lot - Google is worth a lot. They didn't do it by giving out services for free.

Google's services are free. By trying to redefine what free actually means into 'has no cost whatsoever to anyone' you ruin the word.
Post reply on HN