Interesting perspective on the changes! Our lead designer actually had similar concerns (can read them here: https://www.funcaptcha.co/2014/12/04/killing-the-captcha-wit...). You both look to be drawing the same conclusions. What are your thoughts on the metaphorical 'black box' being implemented into the new reCAPTCHA?
The No CAPTCHA problem
11–20 of 100 posts
Re: The No CAPTCHA problem
#12This is why I still recommend using other form spam prevention techniques before sacrificing usability for a CAPTCHA. One of the most effective combinations for 80%+ of the sites I've ever dealt with is having a honeypot field in the form, plus some amount of time required to pass before the form can be submitted successfully. There are other ways to mitigate bots as well, but these two alone have sufficed for quite…
impressed that works so well!
Another alternative that comes to mind (albeit much more complicated) is link encryption ala SpikeStrip: http://www.cs.ucsb.edu/~ravenben/publications/pdf/spikestrip...
This would mainly only work against scrapers, tho, and not so much for account creation.
My argument is that Google could have done better to offer a completely different solution (e.g. some sort of proxy service) than to add a (apparently fallible) whitelist to recaptcha.
Re: The No CAPTCHA problem
#13I do not get the problem of hiring a clickfarm for 1$ an hour to click on cat pics. If we take reputation, IP and cookie. All must be in order to pass. We want to spam a 1000 forms today. Scenario 1: The clickfarm itself fills in the Captcha. Result: Their IP's will soon be blacklisted, reputation of a third-world account will be inherently low. Scenario 2: We let the clickfarm send the answer to our own bot, which s…
Scenario 1 - we don't need to create a clickfarm for this, maybe we can clickjack random users online. Literally every porn site will be happy to make some money with it. Scenario 2 - of course we won't just use 1 IP, it will make us look Bad guy. Speaking of Scenario 3 - which account cookie are you talking about? The clickfarm has thousands of own trustworthy cookies but our bot doesn't send any cookies, it only solves challenges (neutral guy).
As soon as you have valid g-recaptcha response you don't need to persist any cookies - use it outright.
Re: The No CAPTCHA problem
#14I do not get the problem of hiring a clickfarm for 1$ an hour to click on cat pics. If we take reputation, IP and cookie. All must be in order to pass. We want to spam a 1000 forms today. Scenario 1: The clickfarm itself fills in the Captcha. Result: Their IP's will soon be blacklisted, reputation of a third-world account will be inherently low. Scenario 2: We let the clickfarm send the answer to our own bot, which s…
Scenario 1 - we don't need to create a clickfarm for this, maybe we can clickjack random users online. Literally every porn site will be happy to make some money with it. Scenario 2 - of course we won't just use 1 IP, it will make us look Bad guy. Speaking of Scenario 3 - which account cookie are you talking about? The clickfarm has thousands of own trustworthy cookies but our bot doesn't send any cookies, it only so…
+1 also consider s/click farm/malware worm bot/g
Re: The No CAPTCHA problem
#15I have a hunch that it is Google's attempt to be on every form and know more about a Google user and their accounts on other websites. At least what websites they signed up for. I can stop Analytics but this is now out of my control. This is what a website owner required me to do to access their website.
Oh, it's already too late. Google already has enough data about you. I can imagine the future - people train bots like kids, make them visit different websites, google things and pretend to be humans. Your search history will be like your credit score.
I wouldn't be surprised if approval for a Visa depended on your search history.
Re: The No CAPTCHA problem
#16I do not get the problem of hiring a clickfarm for 1$ an hour to click on cat pics. If we take reputation, IP and cookie. All must be in order to pass. We want to spam a 1000 forms today. Scenario 1: The clickfarm itself fills in the Captcha. Result: Their IP's will soon be blacklisted, reputation of a third-world account will be inherently low. Scenario 2: We let the clickfarm send the answer to our own bot, which s…
Here's a scenario: a dissident living in a third world country with pervasive surveillance. He accesses the net using TOR, and disables cookies.
Now his IP is blacklisted, because there are lots of people using the same exit node; his reputation is low for the same reason, and the cookie is rejected. There's a good chance that this one person will be blocked, even though he didn't do anything wrong.
For a simpler case, private browser sessions over a VPN would suffer from the same issue.
Re: The No CAPTCHA problem
#17Earlier quoted context omitted.
Oh, it's already too late. Google already has enough data about you. I can imagine the future - people train bots like kids, make them visit different websites, google things and pretend to be humans. Your search history will be like your credit score.
I wouldn't be surprised if approval for a Visa depended on your search history.
Re: The No CAPTCHA problem
#18Earlier quoted context omitted.
Scenario 1 - we don't need to create a clickfarm for this, maybe we can clickjack random users online. Literally every porn site will be happy to make some money with it. Scenario 2 - of course we won't just use 1 IP, it will make us look Bad guy. Speaking of Scenario 3 - which account cookie are you talking about? The clickfarm has thousands of own trustworthy cookies but our bot doesn't send any cookies, it only so…
+1 also consider s/click farm/malware worm bot/g
Yeah malware bot will generate lots of free g-recaptcha-responses! Good idea
Re: The No CAPTCHA problem
#19Earlier quoted context omitted.
"No CAPTCHA looks fancy but the real No CAPTCHA should always have visibility:none!" I agree, but I suppose they want something that's a Placeholder, if the user needs to type a captcha
Why? If no need to type any captcha - do the verification in the background, don't show me anything until you think I'm a bot
Because of page layout. Having a fixed size element is better than having something (that is not yours) that might be there or not.
Re: The No CAPTCHA problem
#20This is why I still recommend using other form spam prevention techniques before sacrificing usability for a CAPTCHA. One of the most effective combinations for 80%+ of the sites I've ever dealt with is having a honeypot field in the form, plus some amount of time required to pass before the form can be submitted successfully. There are other ways to mitigate bots as well, but these two alone have sufficed for quite…
A custom spam prevention system, such as a honeypot or the simple "What's n+m?" field, works at 100% until your site is valuable enough for the attacker to spend a couple of cycles to circumvent the honeypot - then it drops to 0%. Publishing your solution as a module just serves to increase the value of circumventing it.
The value of "real" CAPTCHAs is that they retain their deterrence no matter how much effort the attacker invests.