Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s new reCAPTCHA has a dark side

fastcompany.com

Post reply on HN
Print view View original

171–180 of 566 posts

Re: Google’s new reCAPTCHA has a dark side

#171

Post by tinus_hn »

stri8ed wrote: post #164
dessant wrote: post #126

Google has been doing the same with reCAPTCHA v2 [1]. They are aware of the legal risk of outright blocking users from accessing services, so reCAPTCHA v3 contains no user facing UI, Google merely makes a suggestion in the form of a user score, so the responsibility to delay or block access and the legal liability that comes with it falls on websites. reCAPTCHA v2 is superseded by v3 because it presents a broader opp…

Is it that different from the way Google Analytics works?

You can’t block recaptcha!

Re: Google’s new reCAPTCHA has a dark side

#172

Post by dessant »

stri8ed wrote: post #164
dessant wrote: post #126

Google has been doing the same with reCAPTCHA v2 [1]. They are aware of the legal risk of outright blocking users from accessing services, so reCAPTCHA v3 contains no user facing UI, Google merely makes a suggestion in the form of a user score, so the responsibility to delay or block access and the legal liability that comes with it falls on websites. reCAPTCHA v2 is superseded by v3 because it presents a broader opp…

Is it that different from the way Google Analytics works?

You should expect a similar impact on your privacy.

The important difference is that unlike Google Analytics, reCAPTCHA v3 is inescapable. You cannot prevent the collection of your personal data, because then you would loose access to large portions of the web.

Re: Google’s new reCAPTCHA has a dark side

#173

Post by aidenn0 »

dheera wrote: post #69

I guess another question is why we really need captchas. What are we trying to protect against that can't be accomplished with rate limits, voting systems, or other ways to regulate meaningful use of a website? Ultimately why does it matter if the user is a human or bot, as long as they are being a valuable user? What's wrong if a bot buys some of your inventory, pays for it and everything? What's wrong if an NLP bot…

Don't think bot; think botnet. Ratelimits do not work against botnets since they appear to be independent actors. e.g. if you think it's fine for everyone to do something 1-3 times, then you are letting a botnet of 10k hosts do something 10k-30k times.

[edit]

Also, NAT means that there could be hundreds or thousands of individual users on the same IP address (many dorms at smaller colleges are setup this way), so you don't want to rate limit by IP address either.

Re: Google’s new reCAPTCHA has a dark side

#176

Post by lonelappd »

baq wrote: post #156
oil25 wrote: post #81

Earlier quoted context omitted.

reCAPTCHA on VPN is difficult, but on the Tor network, they are downright impossible. I've never been able to get past it, even after a few dozen painful attempts. That means Google services are entirely off-limits over Tor, even Search, which is a disgrace.

they have a patent on giving out unbeatable challenges when the computer thinks it's dealing with a 'malicious agent'. https://patents.google.com/patent/US9407661B2/en

That's Juniper, not Google.

Juniper patented saying "No" to a client.

Re: Google’s new reCAPTCHA has a dark side

#177

Post by btown »

benologist wrote: post #8
ixwt wrote: post #7

Earlier quoted context omitted.

I get a 0.7 on my computer on Firefox. If I use the same website in Chrome (which is signed into a Google account) I get a 0.9. I guess it's a [0,1] scale?

I'm guessing their a-listers came up with something like this: // TODO: add impressive-looking math if (signedin && trackedEverywhere) { return 0.9 } else { return 0.7 } I think we give Google way too much credit for their talent. This is the same company that didn't feel like finishing their website for two decades and subsequently stole $75 million from their users even when Google knew [1]. The same company that s…

The GP post's IP address or other fingerprint may be validated from other Google properties they might have visited, so I wouldn't put so much stock in the 0.7.

Honestly... if it's the same team that did ReCaptcha 2.0, this is a team that pulls out all the stops. Per https://github.com/neuroradiology/InsideReCaptcha ... they implemented a freaking VM in Javascript to obfuscate the code that combines various signals. There's a lot going on here that's likely highly obfuscated and quantized before it's displayed to us.

EDIT: non-paywall link for [1] in the parent post: https://outline.com/aA7HS5

Re: Google’s new reCAPTCHA has a dark side

#178

Post by iforgotpassword »

superasn wrote: post #24

There are a lot of sites that are totally unusable on Firefox regardless how much you use ff. I do all my mobile browsing on FF yet when I try to use some websites I always get this Recaptcha failed error(1) while it works flawlessly on chrome though I never use it often. Try it, maybe it will happen for you too. Same happens on most sites which show you that "checking your browser" page via cloudflare too. The web i…

That's odd. I never had issues with it on Firefox. Most of the time I just check the box and it's happy, sometimes I have to do an image puzzle. And that's with ublock origin. Maybe it depends on country or isp? My work place has its own /16.

Re: Google’s new reCAPTCHA has a dark side

#179

Post by frenchyatwork »

stri8ed wrote: post #164
dessant wrote: post #126

Google has been doing the same with reCAPTCHA v2 [1]. They are aware of the legal risk of outright blocking users from accessing services, so reCAPTCHA v3 contains no user facing UI, Google merely makes a suggestion in the form of a user score, so the responsibility to delay or block access and the legal liability that comes with it falls on websites. reCAPTCHA v2 is superseded by v3 because it presents a broader opp…

Is it that different from the way Google Analytics works?

It is, in the sense that it's easy to disable Google Analytics by disabling tracking in Firefox, and there's no consequences. If a website uses reCAPTCHA, and you have tracking disabled, the website will break.
Post reply on HN