Trigger warning: passing the CAPTCHA on homakov's demo page (https://homakov.github.io/nocaptcha.html) registers an account (blog?) at wordpress.org.
The No CAPTCHA problem
51–60 of 100 posts
Re: The No CAPTCHA problem
#52Seriously guys? This made to the top of the front page? First of all, to all people saying "HUR DUR GOOGLE WANTS YOUR BROWSING DATA", well they already fucking have/had it for a looong time. Secondly, If you tell me that one dude [author] ruled the one+ year work of the engineering team at google as a flaw and simplified it as [So what Google is trying to sell us as a comprehensive bot detecting algorithm is simply a…
> one dude
Since you obviously don't know who Homakov is I can't take your post very seriously.
Homakov has exposed several serious security flaws at Facebook and Google before. I'm pretty sure Google is actively trying to headhunt him since he is one of the best in the web security field.
Re: The No CAPTCHA problem
#53Seriously guys? This made to the top of the front page? First of all, to all people saying "HUR DUR GOOGLE WANTS YOUR BROWSING DATA", well they already fucking have/had it for a looong time. Secondly, If you tell me that one dude [author] ruled the one+ year work of the engineering team at google as a flaw and simplified it as [So what Google is trying to sell us as a comprehensive bot detecting algorithm is simply a…
Half of the post is about how the new technique is vulnerable to clickjacking.
Re: The No CAPTCHA problem
#54People love not to think... Google is a business and the primary objective of any business is to make money (the vision/mission and others is for the people who love free lunch) Why captcha? to provide a service in a trade for "free" human recognition capabilities. Q//But google now is better at recognizing those numbers.... A//Right... that's why they now request the next "way to expensive" to implement "free" servi…
>>People love not to think
O_O
judging by the comment you wrote right after that, I would assume you are one of the people who likes not to think.
They are making people click checkboxes and deviating from the old model of recognition. Your comment makes no sense.
Re: The No CAPTCHA problem
#55Seriously guys? This made to the top of the front page? First of all, to all people saying "HUR DUR GOOGLE WANTS YOUR BROWSING DATA", well they already fucking have/had it for a looong time. Secondly, If you tell me that one dude [author] ruled the one+ year work of the engineering team at google as a flaw and simplified it as [So what Google is trying to sell us as a comprehensive bot detecting algorithm is simply a…
> Do you really think that they would go ahead and implement a such system without rigorous testing of effectiveness? I am sure that they tested it extensively with users, AND with bots, and decided that it is better than the current system, and ONLY then deployed it.
I think the gap between the marketing material for nocaptcha (a simplified website, a youtube video with animations) and the seemingly lacking actual implementation is why this blog post was relevant for me.
Like other tech people around here, I was hyped up by the "smarts" of a system that uses cursor detection etc. to silently validate that I am a human. This blog post seems to indicate that the validation is a much simpler issue of previously passed tests and the amount of data that Google has associated with the user.
Re: The No CAPTCHA problem
#56Seriously guys? This made to the top of the front page? First of all, to all people saying "HUR DUR GOOGLE WANTS YOUR BROWSING DATA", well they already fucking have/had it for a looong time. Secondly, If you tell me that one dude [author] ruled the one+ year work of the engineering team at google as a flaw and simplified it as [So what Google is trying to sell us as a comprehensive bot detecting algorithm is simply a…
>So my guess would be they analyze users behaviour on the page where captcha is located, things like mouse movements
If they can track mouse movements why in incognito mode i'm not a human for them anymore? I was expecting same but from what I see it's just a whitelist. And it's OK. Problem is, which you probably didn't care to read, is it's vulnerable to simple clickjacking which opens another weakness - i can use your click on my page to get your reCAPTCHA token and feed it to my spam bot.
I'm actually happy with No CAPTCHA, because it's making progress. But it's not good enough (see the rest of comments, it could be a background AJAX request instead).
Re: The No CAPTCHA problem
#57Seriously guys? This made to the top of the front page? First of all, to all people saying "HUR DUR GOOGLE WANTS YOUR BROWSING DATA", well they already fucking have/had it for a looong time. Secondly, If you tell me that one dude [author] ruled the one+ year work of the engineering team at google as a flaw and simplified it as [So what Google is trying to sell us as a comprehensive bot detecting algorithm is simply a…
Half of the post is about how the new technique is vulnerable to clickjacking.
The google's blogpost says that 98 something percent of old text could be deciphered by AI. My point is, regardless of vulnerabilities of the new system, I am certain that it is more effective than the old alternative. They would have tested it.
Re: The No CAPTCHA problem
#58Seriously guys? This made to the top of the front page? First of all, to all people saying "HUR DUR GOOGLE WANTS YOUR BROWSING DATA", well they already fucking have/had it for a looong time. Secondly, If you tell me that one dude [author] ruled the one+ year work of the engineering team at google as a flaw and simplified it as [So what Google is trying to sell us as a comprehensive bot detecting algorithm is simply a…
> Do you really think that they would go ahead and implement a such system without rigorous testing of effectiveness? I am sure that they tested it extensively with users, AND with bots, and decided that it is better than the current system, and ONLY then deployed it. I think the gap between the marketing material for nocaptcha (a simplified website, a youtube video with animations) and the seemingly lacking actual i…
That's exactly why I wrote this post. I wish Google proved me wrong and demonstrate us how they use cool tech to detect bots instead of user.isGoogleUser? and user.acceptedCaptchas > 5
Re: The No CAPTCHA problem
#59Earlier quoted context omitted.
There's no session ID for current user. They can try to use IP as identifier. Admins can send remoteip to google to prevent spoofing but that parameter is optional and I suppose they don't rely on it.
... Okay, why not establish a session then?
Would require an extra roundtrip... Problem is that you get challenges with client side and solve it with server side. It's website who should go, get a challenge for you, put it in your session cookie and make sure you don't go and get another one. Which complicates it a lot
Re: The No CAPTCHA problem
#60Seriously guys? This made to the top of the front page? First of all, to all people saying "HUR DUR GOOGLE WANTS YOUR BROWSING DATA", well they already fucking have/had it for a looong time. Secondly, If you tell me that one dude [author] ruled the one+ year work of the engineering team at google as a flaw and simplified it as [So what Google is trying to sell us as a comprehensive bot detecting algorithm is simply a…
>So my guess would be they analyze users behaviour on the page where captcha is located, things like mouse movements If they can track mouse movements why in incognito mode i'm not a human for them anymore? I was expecting same but from what I see it's just a whitelist. And it's OK. Problem is, which you probably didn't care to read, is it's vulnerable to simple clickjacking which opens another weakness - i can use y…
>>which you probably didn't care to read
I did read it. My point is, you, or I, or anyone for that matter does not know the inner details of how it works.
>>If they can track mouse movements why in incognito mode i'm not a human for them anymore?
Maybe having a clean cookie history is not good enough during the risk assessment.
Look, my entire point is, google is not a joke company. I am certain that they tested it for effectiveness before deploying.