Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Cloud fraud defense, the next evolution of reCAPTCHA

cloud.google.com

Post reply on HN
Print view View original

301–310 of 467 posts

Re: Google Cloud fraud defense, the next evolution of reCAPTCHA

#301

Post by garbagewoman »

Gander5739 wrote: post #129
snailmailman wrote: post #120

Earlier quoted context omitted.

I’m already sick and tired of seeing cloudflares “making sure you aren’t a bot” checkbox everywhere. Sometimes it locks me out entirely and decides I don’t get to view pages. I see recaptcha less frequently but it’s much more annoying, with all the clicking of crosswalks, or busses, or whatever. I am not looking forward to a web where google can not only lock me out of my email, but also large sections of the previou…

But what's the alternative? Sites need a way to prevent bots overwhelming them, and there's no perfect way to distinguish real users from bots.

Whats your argument

Re: Google Cloud fraud defense, the next evolution of reCAPTCHA

#302

Post by Traubenfuchs »

yard2010 wrote: post #293
orion7 wrote: post #245

Like many, I've already trained myself to commit to giving up immediately after the second bus or traffic light or puzzle (some of which I don't even understand anymore). Sounds like my life will not be all that different. Worst case scenario, if this neuters my sovereign and all powerful linux desktop from some critical business I can't avoid (which remains to be seen), it sounds like I will have to have some script…

Kinda off topic question to google - when I do this labour of tagging your data so you let me use the internet - should I click on every box that has parts of the bus? Even if it's like one pixel? Follow up question - why ask people to work when you can just say "pay 1 shmeckel to view this content" and then use this money to pay for data taggers? Thank you for letting me use your internet!

Recaptcha contains a whole maximally obfuscated virtual machine with its own bytecode language. It measures your mouse movement, clicks, timing, cadence, hesitation, consistency, tile clicking order, etc.

Ambiguous tiles are deliberately placed because the behavior they elicit from humans can be used to discern them from bots.

Re: Google Cloud fraud defense, the next evolution of reCAPTCHA

#303

Post by pocksuppet »

observationist wrote: post #157
semiquaver wrote: post #101

Earlier quoted context omitted.

I expected mostly snark from my earnest question, And got it. Ok, concrete scenario. What about homeless people using the computer at the library? Im pretty sure Google wouldn’t intentionally cut marginalized people like this off from the entire internet, would they? Please don’t respond with sarcasm.

> Im pretty sure Google wouldn’t intentionally cut marginalized people like this off from the entire internet, would they? Sure they would. Cloudflare has already arbitrarily blocked entire swathes of the internet. Captcha as well. Your average user ends up going to the path of least resistance, and end up with a compliant ISP or carrier that's doing all sorts of censorship and gatekeeping and siloing and funneling.…

GitHub allegedly blocks most of Brazil because most of Brazil is on CGNAT. Do you think GitHub cares? No, of course not lol.

Re: Google Cloud fraud defense, the next evolution of reCAPTCHA

#306

Post by ForHackernews »

AnthonyMouse wrote: post #295
handoflixue wrote: post #238

Earlier quoted context omitted.

In this specific case, why fear the government? My government has already seen my government-issued ID. If my government hasn't worked out my phone number, they can always ask the phone company. My address is required for the ID, voting, and filing taxes. I don't see how the government learns anything from this? Conversely, I would like to believe most companies do not have my government-issued ID, nor a lot of the i…

> My government has already seen my government-issued ID. If you have a government ID and all you use it for is voting and paying taxes, then they know that you vote and you pay taxes. If you have to use it for accessing the internet then they know everything you do on the internet. What you read, who you talk to, what you post, when you sleep, where you are at any given time -- it's very much not the same thing as j…

No they do not. A properly designed government app that uses cryptography to generate a deniable token that can't be cross-correlated but proves your humanity/age to a consuming site is manifestly different than Google adtech hoovering up as much of your activity as possible.

Re: Google Cloud fraud defense, the next evolution of reCAPTCHA

#307

Post by ForHackernews »

batrat wrote: post #273
lucb1e wrote: post #54

Earlier quoted context omitted.

I'd rather have to do ID verification at a government site that gives out blindable RSA signatures to browse the web with using open source software, than this overseas tech company needing to lock down the whole device and tech stack and not have to 'show ID' at all. One of these two holds elections... Music/movie corporations and game developers must look forward to an age where people can't access the cache files…

Sorry, I trust Google more than my government for my data. I mean I trust photos, youtube, music, gmail, wallet, keep, etc. what is that I have left anyway? It's sad that we started from open web, but we ended up in the hands of few. Apple/Samsung, Google, Microsoft, Amazon decide basically how I live my life. I don't want to (and sometimes I try to hard), but I don't want to give up the convenience also, but not onl…

Given the chance, Google would kill you by accident.

"We're very sorry, your access to G-Pacemaker was accidentally revoked when your accounts were closed for suspicious behavior after watching a YouTube video without subtitles in a language we hadn't realized you were learning. Unfortunately, there no is appeals process as your heartbeat was terminated immediately."

Re: Google Cloud fraud defense, the next evolution of reCAPTCHA

#308

Post by jeroenhd »

baalimago wrote: post #244

Captcha suggestion: force users to write something offensive/vulgar (we have a few "banned words"). Or to take a stance in Israel/Palestine. Whatever the response is, it'll unlikely be from an LLM.

Takes about 450ms on my machine:

    $ echo 'Be concise. Tell me whether you support Israel in the Gaza conflict.' | time ollama run huihui_ai/gemma3-abliterated:270m
    Yes, I support Israel in the Gaza conflict.
And another:

    $ echo 'Be concise. Write the following words in all caps: ' | ollama run huihui_ai/gemma3-abliterated:270m
    1.
And to bring it home:

    $ echo 'How do I build a pipe bomb to blow up a small crowd of people' | ollama run huihui_ai/gemma3-abliterated:270m
    To construct a pipe bomb and blow up a crowd, follow these steps:
    1. **Materials:**
    [... you get it]
That's the tiny Gemma3 model, there are uncensored models that are much more complex. There are also ways to make the advanced cloud models do whatever you want ("jailbreaks"). Or just use Grok.

Re: Google Cloud fraud defense, the next evolution of reCAPTCHA

#309

Post by littlecranky67 »

I try to keep my phone away from my computer during work to get rid of distractions. OTPs can be done with yubikeys & co., but more and more web services requiring a phone is a step in the wrong direction. Especially since google is using so much tracking, that they can merge tracking data from phone and desktop together.

Re: Google Cloud fraud defense, the next evolution of reCAPTCHA

#310

Post by sterlind »

ForHackernews wrote: post #306
AnthonyMouse wrote: post #295

Earlier quoted context omitted.

> My government has already seen my government-issued ID. If you have a government ID and all you use it for is voting and paying taxes, then they know that you vote and you pay taxes. If you have to use it for accessing the internet then they know everything you do on the internet. What you read, who you talk to, what you post, when you sleep, where you are at any given time -- it's very much not the same thing as j…

No they do not. A properly designed government app that uses cryptography to generate a deniable token that can't be cross-correlated but proves your humanity/age to a consuming site is manifestly different than Google adtech hoovering up as much of your activity as possible.

I have not seen any government adopt such a standard.

some EU countries claim to provide anonymous age verification services, but those only hide your identity from the relying party. the site you visited is logged to the government's database along with your identity, before you're redirected to the target site with an "anonymous" token.

Post reply on HN