Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

371–380 of 442 posts

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#371

Post by Dylan16807 »

rudolf0 wrote: post #341
Dylan16807 wrote: post #191

Earlier quoted context omitted.

In bulk? It's not supposed to stop real users from using a bit of scripting.

It kind of is, actually. Cloudflare, for example, uses a single CAPTCHA to prevent ongoing DDoS attacks. If they switched to this new reCAPTCHA and if a DDoSer can use Selenium to get past the challenge, then the CAPTCHA process has failed. There are always tradeoffs with this. I strongly suspect Google is going to have to restrict it within a year or so, resulting in the number of users who still have to solve CAPTC…

'a bit' being key. It's not like a DDoSer can't already solve captchas for three minutes if that's the only protection.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#373

Post by pimlottc »

mcintyre1994 wrote: post #342
sjs382 wrote: post #129

Those computer-vision challenges mentioned in the blog post aren't 100% clear. For the first one, my eyes went directly to the cranberry sauce, and I thought to myself "Wait... is that one supposed to be clicked, too?"

I thought it was unclear too for a different reason - the text says "that match this one" which I read as being actual identical matches. Sure it's obvious when you see the images but that wording feels really awkward.

Same, my first thought was to look for the identical cat photo, or maybe the same cat from a different angle, not just other cats.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#374

Post by heroh »

AndrewKemendo wrote: post #212
userbinator wrote: post #170

"If we can collect behavioural data from you, and it matches closely the behaviour of other humans, you are a human. Otherwise you're not a human." Does anyone else get that feeling from the description of what Google is doing? I've tripped their "we think you are a bot" detection filter and been presented with a captcha countless times while using complex search queries and searching for relatively obscure things, a…

The fact that Google is attempting to define and thus strongly normalise what is human behaviour is definitely a big red flag to me. ...But this is their core search competency and exactly what makes their search so powerful. Page rank is basically distributed wisdom of crowds, aka algorithm of how people behave (build their websites) based on a search term/imbedded link. This seems like a perfect extension of this.…

>Remember the vision of google: "to organize the world's information and make it universally accessible and useful."

I'm sure that's why they got rid of the ability to search what people are saying on forum and blogs. Google still indexes everything, they just got rid of the filter.

Their results now give preference to SEO'd pages & adverts.

The old discussion filter returns an illegal request error https://www.google.com/?tbm=dsc

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#375

Post by kuschku »

raverbashing wrote: post #124
ricg wrote: post #95

It's definitely not only relying on cursor movements. A simple $('iframe').contents().find('.recaptcha-checkbox-checkmark').click() proved that I'm not a robot, without me touching the mouse.

Are you logged into Google? If you have their cookies it's one indication you're not a robot.

Which is a bad idea.

I actually have some bots which scrape Google sites (for the purpose of integrating stuff like Google Keep into KRunner), and they just use the Useragent of a regular phone, send normal POST data, etc. Works perfectly fine, and — I just checked — this bot is recognized as normal user by this captcha system. No Captcha input.

I tried it even with a new Google profile and just using cURL to log into Google, then started a new browser session and imported the cookies from cURL. Worked just as well.

I guess this makes it easier for malicious bot-authors...

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#376

Post by kuschku »

rudolf0 wrote: post #339
Aissen wrote: post #82

So now spammers will use botnets… Oh wait, they already do. They already have the botnets. Now they need to use those end-user machines as proxies, using the credentials already on the machine. They just need to figure out the other parameters: maybe it's running js code ? Then you can use a browser engine/selenium). Maybe it's the click pattern ? Just generate the json data and send it. They can even apply the same…

Yeah, I feel like it won't be too long before spammers start finding ways to emulate users without having to solve any CAPTCHAs. Google is likely going to need to switch their 98%/2% to something more like 80%/20% (that is, 20% of users will still need to enter CAPTCHAs).

I am using a small tool that I wrote to integrate Google Keep and other Google stuff with KRunner and so on, and this tool (essentially being a dumb bot) also passes all the Captchas.

I’d say malicious authors would have it really easy now.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#377

Post by heroh »

1Hz wrote: post #103
ricg wrote: post #95

It's definitely not only relying on cursor movements. A simple $('iframe').contents().find('.recaptcha-checkbox-checkmark').click() proved that I'm not a robot, without me touching the mouse.

The cursor movement story seems to be a smokescreen to dilute the fact they're actually running an internet wide monitoring network, tracking users from site to site and building profiles on them.

Makes perfect sense. This is Google's response to the Facebook 'Like' button [tracker]

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#378

Post by frostmatthew »

xnull1guest wrote: post #369
frostmatthew wrote: post #364

Earlier quoted context omitted.

free as in beer: Free in the sense of costing no money ; gratis.[1] [1] http://en.wiktionary.org/wiki/free_as_in_beer

I don't understand how this clarifies the term free? Free as in beer is used to specify the freeness of a product or service, rather than the freeness of 'freedom', say from authoritarianism. This conversation is about the meaning of ' money ' modulo this understanding of free-as-in-beer - i.e. whether non-fiat scarce resources (user data/screen real estate) count as money.

free has 20+ definitions.[1] A discussion about what we mean when we say Google's services are (or are not) free is using free the same way we use it in free as in beer [thus its definition is relevant].

Colloquially we usually use free to mean not having a financial cost. Another word or phrase is usually used when referring to non-monetary costs. i.e. I would say "Google is free" but I would never say "Google costs nothing."

[1] http://en.wiktionary.org/wiki/free

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#379

Post by mdb333 »

davecyen wrote: post #252

Perhaps Google will be using this to train a more broader purposed image recognition AI

Yes exactly... the whole concept of their original captcha came from fixing OCR where the text was distorted. ie put armies of unsuspecting individuals across the globe to work to help their ability to digitize text content into something more searchable.

So, no surprise, same thing is going on here. It's much less about security than it is about deriving value from the solved image matches.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#380

Post by kuschku »

echeese wrote: post #87
BogdanCalin wrote: post #60

Earlier quoted context omitted.

On what page did you tested the new system?

Here you go: https://www.google.com/recaptcha/api2/demo

So, I tried it. With a Google Account that had ZERO activity for two years. Using a Java program to activate that site.

Passed the CAPTCHA. Without any further verification.

I mean, spammers are going to love it xD

Post reply on HN