Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

381–390 of 442 posts

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#381

Post by IndianAstronaut »

userbinator wrote: post #170

"If we can collect behavioural data from you, and it matches closely the behaviour of other humans, you are a human. Otherwise you're not a human." Does anyone else get that feeling from the description of what Google is doing? I've tripped their "we think you are a bot" detection filter and been presented with a captcha countless times while using complex search queries and searching for relatively obscure things, a…

I used to use selenium to crawl Google webmaster tools data. Despite randomizations and such, they still had me marked as a bot.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#382

Post by kuschku »

iso8859-1 wrote: post #357
pizzashark wrote: post #345

If a bot just makes more random mouse movements of varied speeds, and takes a bit longer, won't it appear human?

The bot probably has too much or too little mail in it's Gmail inbox, or maybe its is not many Google+ circles of confirmed authentic humans. Maybe the bot has not been using Google Chrome for a very long time, so its browsing patterns may still seem incoherent. This socially disconnected bot is abnormal; it doesn't fit into society. It deserves punishment; we'll make it click pictures of cats. Once it gets enough fr…

I posted this multiple times in this thread already, but I tried it with a Google Account that has a fake name, hasn’t been used for over 2 years, has received nor sent any emails since then, is in only one Google+ circle, and was only ever used from Firefox.

And it passed the test. While trying it from within a Java client toolkit.

Like, I took the worst setup any spammer would have, and it passed.

How is this going to protect my sites from spammers? And on the other hand, am I even allowed to embed this into my site, if I am in the EU (Data protection, etc)?

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#384

Post by foxylad »

ChuckMcM wrote: post #223
Houshalter wrote: post #206

Earlier quoted context omitted.

No one should complain about anything, ever.

Actually it would be great is someone has some ideas for ways to identify humans that don't require stuff like javascript. From the perspective of a service provider (and I'm one) the bots are a scourge, they consume resources and they are clearly attempting to 'mine' the search engine for something, but they are unwilling to come forward and just ask the search provider if they would sell it to them. And since they…

On a small scale, it's not too difficult. Detecting form POSTs with a new session catches most comment spam bots, and if an empty input field hidden with CSS is submitted with content, that's also a giveaway.

And I wouldn't discount javascript - another hidden field populated by onSubmit() is simple and effective. A few vocal paranoiacs advocate browsing with javascript turned off, but they are few and far between - and I bet they get sick of adding sites they want to see to their whitlist. We have over three thousand fairly technically aware users, and none have been tripped up by the javascript test.

If your site is valuable enough for an attacker to manually figure out your defences, then you need to consider emailing a a verification token - or even better, use SMS if you can afford the cost. Because this gives you a number to pass to law-enforcement, it means an attacker has to buy a burner SIM card.

Back on topic, Google's initiative is a useful tool to add to your defences.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#385

Post by foxylad »

xnull1guest wrote: post #343
xtracto wrote: post #178

Earlier quoted context omitted.

> and it's frankly very insulting and rather disturbing that they think someone who inputs "unusual" search queries, according to their measure, is not human. Insulting? how is that insulting? You are entitled. You are entitled you block scripts, use Google's FREE service to perform any search query to search the web while blocking any program that attempts to identify you as not a bot. But if while using their free…

Google's services are not free. You trade your data, screen real estate, and attention for their service. This is worth a lot - Google is worth a lot. They didn't do it by giving out services for free.

I know what you are saying, but actually this service is free. Blocking bots effectively is in both the website owner and Google's interests, because bots disrupt the value propositions of both. And you could argue that it is in the website reader's interests too, by extension.

Given their scale and resources, Google are able to provide a far more effective bot detector than any of us could do on our own. I for one am delighted they are providing this very valuable service.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#386

Post by ceph_ »

heroh wrote: post #377
1Hz wrote: post #103

Earlier quoted context omitted.

The cursor movement story seems to be a smokescreen to dilute the fact they're actually running an internet wide monitoring network, tracking users from site to site and building profiles on them.

Makes perfect sense. This is Google's response to the Facebook 'Like' button [tracker]

Then what is Google Analytics?

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#387

Post by pcthrowaway »

slayed0 wrote: post #276
forgottenpass wrote: post #246

Earlier quoted context omitted.

You are entitled. Has calling someone entitled ever been useful? For the last few years it's felt like nothing more than a petty "you're wrong" remark with bonus condensation built right in.

Do you mean condescension? Not trying to be a smart ass, I just got a chuckle out of the word choice.

There you go, being condensing again.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#388

Post by grimtrigger »

fatratchet wrote: post #70
grimtrigger wrote: post #40

It seems like they're using cursor tracking to validate human-ness. Assuming thats the case: Since the cursor is outside of javascript's control, it would force the attacker one level higher (to the browser/os, instead of the dom). Not impossible, but still a significant barrier.

Not really, you would just need to reverse the js code, look at what data they actually send to google and randomly generate appropriate data like mouse movements.

Ah, good point

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#389

Post by userbinator »

AndrewKemendo wrote: post #221
userbinator wrote: post #215

Earlier quoted context omitted.

Their search is only "powerful" for finding the more mundane and widely disseminated information; I've noticed that it's increasingly difficult to find very specific information with it as it basically misunderstands the query and returns completely useless results. Maybe that's why I look like a bot, as I try to tell it exactly what I want...

Well this is exactly the point. Obscure information has a very low social/viral index and as a result a lot of people don't interact with it so it is hard to find with Google - which is why I don't think it is a particularly robust search engine on it's own in the grand scale of knowledge development. Google seems robust because humans generally think pretty similarly, and generally look for the things that the peopl…

When trying to use Google to find something obscure, I'm not so much bothered by the difficulty of doing so as I am by the implication that "real humans" don't use complex search queries. They used to teach in computer literacy courses how to use search engines, complete with complex multi-term boolean queries, to find exactly what you're looking for. Now try the same with Google and you're a bot? WTF? They're basically saying "humans are too stupid to do that - humans are supposed to be stupid."
Post reply on HN