Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

161–170 of 442 posts

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#161

Post by JoblessWonder »

junto wrote: post #123
ricg wrote: post #95

It's definitely not only relying on cursor movements. A simple $('iframe').contents().find('.recaptcha-checkbox-checkmark').click() proved that I'm not a robot, without me touching the mouse.

I tried this demo ( https://www.google.com/recaptcha/api2/demo ) in a new incognito window. Then in devtools: javascript:if(!window.jQuery||confirm('Overwrite\x20current\x20version?\x20v'+jQuery.fn.jquery))(function(d,s){s=d.createElement('script');s.src='https://ajax.googleapis.com/ajax/libs/jquery/1.8/jquery.js';(d.head||d.documentElement).appendChild(s)})(document); $('iframe').contents().find('.recaptcha-checkbox…

Probably the incognito window. It seems to rely heavily on cookies (likely linked to their analytics data.)

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#162

Post by _lce0 »

cJ0th wrote: post #94

It says that they do take mouse movement into account but the cookie part makes me feel a little uneasy: > IP addresses and cookies provide evidence that the user is the same friendly human Google remembers from elsewhere on the Web. If this becomes a trend then major commercial websites will become unusable for people who are not accepting (third-party) cookies. "Because those damn bots" is a straw man argument to m…

I'm using a tablet device, thus no mouse, and it gives me a captcha whenever I'm not logged in..

Really is this the breakthrough of bot detection? They are just leveraging cookies --which is nice improv UX-- but why do I need to click? delay loading to relax servers?

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#163

Post by taoufix »

grecy wrote: post #156
m_myers wrote: post #141

Earlier quoted context omitted.

Where are you seeing mandatory real name and email validation?

In the video the user has to type in their first and last name, and an email address. I have to assume there is a confirmation email, otherwise what's the point in asking for an email address?

I think it's just a demo for a typical form.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#164

Post by doodpants »

grecy wrote: post #156
m_myers wrote: post #141

Earlier quoted context omitted.

Where are you seeing mandatory real name and email validation?

In the video the user has to type in their first and last name, and an email address. I have to assume there is a confirmation email, otherwise what's the point in asking for an email address?

I believe that the video was just showing an example of a form on which a CAPTCHA would appear.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#165

Post by lnanek2 »

username223 wrote: post #125

My guess is it's based on the tracking data they already collect on most people. I try to avoid it, so I get stuff like this: http://i.imgur.com/6mGYsav.png I have no idea what that second word is supposed to be, so if you use this, I probably won't use your site.

It isn't user friendly, but often with that type it doesn't care what you enter for the tough to read world. The easy to read word is your test. The other is a way to harness people to do difficult OCR tasks. Some web sites have had fun organizing entering dirty words for the tough to read ones regularly to mess with the results :)

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#166

Post by spacefight »

rbdn wrote: post #109
spacefight wrote: post #65

Earlier quoted context omitted.

The question was more about on how the new captcha works, I guess.

The old system presented you a challenge-response test no matter what.

Sorry, I just thought "all your data" was a bit unspecific. I have no idea what Google collects in order to derive that. I have a lot of guesses, but "all your data" doesn't tell me in fact, how it works. And I thinks that was what the parent poster asked for.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#167

Post by dmak »

xkiwi wrote: post #134

It rise privacy concern for me. If real name and email validation is mandatory, I will wonder what Google will use that data for. Is that some kind of monitor tool which want to know REAL NAME, EMAIL ADDR whenever you want to use a website? Don't forget Google always beg for your telephone number for "security reasons", Google+ wants your real name for "Policy reason", I upgraded one of my Nexus to Android L, and eve…

Its an example form illustrating where CAPTCHAs or where the new captcha will be used

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#168

Post by nobodysfool »

tokenizerrr wrote: post #62
ins0 wrote: post #34

don't know if this works only for me but here is a live example - https://www.google.com/cbk?cb_client=maps_sv.tactile&output=...

It gives me the new version as well, but it seems google is convinced that I am a bot. Getting a regular captcha after clicking the button and I have to say that this is a lot worse of an experience than regular old captchas. Now I have to wait for a few seconds after clicking a button, then still solve a captcha. Hopefully it gets better with time.

Try this one:

http://nomorecaptchas.com/

It's very similar. I might go as far as saying that Google copied them.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#170

Post by userbinator »

"If we can collect behavioural data from you, and it matches closely the behaviour of other humans, you are a human. Otherwise you're not a human."

Does anyone else get that feeling from the description of what Google is doing? I've tripped their "we think you are a bot" detection filter and been presented with a captcha countless times while using complex search queries and searching for relatively obscure things, and it's frankly very insulting and rather disturbing that they think someone who inputs "unusual" search queries, according to their measure, is not human. I have JS and cookies disabled so they definitely cannot track my mouse movements and I can't use this way of verifying "humanness", but what if they get rid of the regular captchas completely (based on the argument that eventually the only ones who will make use of and solve them are bots)? Then they'll basically be saying "you are a human only if you have a browser that supports these features, behave in this way, and act like every other human who does." The fact that Google is attempting to define and thus strongly normalise what is human behaviour is definitely a big red flag to me.

(Or maybe I'm really a bot, just an extremely intelligent one. :-)

Post reply on HN