You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor... I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does. Edit: I also got 0.7 on Firefox with st…
> NOTE:This is a sample implementation, the score returned here is not a reflection on your Google account or type of traffic.
Google’s new reCAPTCHA has a dark side
161–170 of 566 posts
Re: Google’s new reCAPTCHA has a dark side
#162Earlier quoted context omitted.
reCAPTCHA on VPN is difficult, but on the Tor network, they are downright impossible. I've never been able to get past it, even after a few dozen painful attempts. That means Google services are entirely off-limits over Tor, even Search, which is a disgrace.
> That means Google services are entirely off-limits over Tor If only it was Google services alone. CloudFlare loves serving up a ReCAPTCHA for Tor users before they can even passively read site contents. That hugely expands the damage done.
https://support.cloudflare.com/hc/en-us/articles/11500199265...
https://blog.cloudflare.com/cloudflare-supports-privacy-pass...
Re: Google’s new reCAPTCHA has a dark side
#163There are government services, such as the USPTO, that rely on Google reCAPTCHA. The new reCAPTCHA has made it difficult for me to access documents, and sometimes they think that I'm a bot and thus deny me access entirely. Does the government realize the consequences of this? Both that it pushes users to use Chromium-based browsers, and that they're helping to solidify a company that already has a near monopoly in th…
It will also log you in to google on the first page.
Additionally, the stations at the DMV all have tablets on stands, showing Google logins for some operations.
Re: Google’s new reCAPTCHA has a dark side
#164Google has been doing the same with reCAPTCHA v2 [1]. They are aware of the legal risk of outright blocking users from accessing services, so reCAPTCHA v3 contains no user facing UI, Google merely makes a suggestion in the form of a user score, so the responsibility to delay or block access and the legal liability that comes with it falls on websites. reCAPTCHA v2 is superseded by v3 because it presents a broader opp…
Re: Google’s new reCAPTCHA has a dark side
#165Earlier quoted context omitted.
reCAPTCHA on VPN is difficult, but on the Tor network, they are downright impossible. I've never been able to get past it, even after a few dozen painful attempts. That means Google services are entirely off-limits over Tor, even Search, which is a disgrace.
they have a patent on giving out unbeatable challenges when the computer thinks it's dealing with a 'malicious agent'. https://patents.google.com/patent/US9407661B2/en
Re: Google’s new reCAPTCHA has a dark side
#166Re: Google’s new reCAPTCHA has a dark side
#167There are government services, such as the USPTO, that rely on Google reCAPTCHA. The new reCAPTCHA has made it difficult for me to access documents, and sometimes they think that I'm a bot and thus deny me access entirely. Does the government realize the consequences of this? Both that it pushes users to use Chromium-based browsers, and that they're helping to solidify a company that already has a near monopoly in th…
You are required to use reCAPTCHA on the California DMV website when making appointments and other functions. https://www.dmv.ca.gov It will also log you in to google on the first page. Additionally, the stations at the DMV all have tablets on stands, showing Google logins for some operations.
Re: Google’s new reCAPTCHA has a dark side
#168For example, even Cloudflare, which has its own "checking your browser" protection, still uses reCaptcha in some other cases... Why doesn't Cloudflare offer a reCaptcha alternative to their customers? (a transparent one, more like reCaptcha v3 rather than the intrusive 5-second one...).
Re: Google’s new reCAPTCHA has a dark side
#169Google's captcha system is overkill for most websites. If I want to filter out bad actors (on a simple straight-forward site), there are other more simpler and easier to solve captcha systems out there. They might not have the rigour of Google's system, but they do the job, and well. I would however use Google's system if the site is massive and there is the possibility that someone is using a script or some program…
That's not a viable reason. Anyone doing so is going to have a budget and human reCAPTCHA solving is less than $0.01 per CAPTCHA. It costs very little for mass account creation, reCAPTCHA or not.
Re: Google’s new reCAPTCHA has a dark side
#170Earlier quoted context omitted.
If they looked for identifying information in cookies or browsing history people would be even more upset and spammers would just simulate it with browser bots... which is why I believe it takes a black box approach to each detection regardless of external state. Besides obviously the cookies set within the iframe of the recatcha. This of course doesn’t help explain why Firefox is so heavily targeted by what’s suppos…
I've heard that being signed into your Google account can make the challenges simpler, presumably reducing things like the noise and the slow-fade load animations.
The idea of tracking your history across multiple reCAPTCHA loads across multiple domains to build a user profile is what sounds like a giant privacy red flag, even though it's entirely possible given the current implementation.
Additionally asking hosts to include JS directly onto their domain which sets 3rd party cookies/data across every page in addition to tracking referring domains is equally a bad idea. reCAPTCHA 2/3 does require loading 3rd party JS directly on page, which I'd imagine is necessary to create callbacks in the frontend upon verification (as iframe content messaging is very awkward):
https://developers.google.com/recaptcha/docs/v3
Ideally the JS simply loads an iframe of the captcha HTML and handles the callbacks from events in the iframe. That's it. It shouldn't be touching anything else on your website. I'd be curious to see a reverse engineering to see how much the JS really does...