Google's Captcha in Firefox vs. in Chrome • Hacker News Board

Re: Google's Captcha in Firefox vs. in Chrome

#311

Post by neilv » Mon, Jun 10, 2019, 7:26 PM UTC

amenod wrote: post #285

neilv wrote: post #259

Earlier quoted context omitted.

An insightful remark about ReCaptcha on HN recently (I don't have a link) was that it went from being "are you human" to "which human are you".

Ha, ha, very accurate observation. And if Google keeps the pressure and nothing hits them back, soon the answer will be "Number 17 of 312 still using Firefox". I still can't believe how Google has changed their tune - from "dont be evil" to being worse than MS ever was, which is quite an achievement in itself.

Google is in some ways much more adverse in impact than MS, but I suspect that hiring a bunch of people under the "don't be evil" mantra (and baking that "we're the good guys" into culture) has helped hold them back from some bad behavior.

At the same time an implicit belief in "we're the good guys" (combined with indoctrination including interview hazing rituals) can enable bad behavior, because then: "of course whatever we do is good, by definition, because we're the good guys" and then not questioned. MS did some really underhanded and insidious things with its power, and it's easier to see some of Google's behavior as due more to hubris/brainwashing.

I've started to use the CS101 whiteboard hazing as a litmus test for whether there's any point in trying to do good at Google, for my own career. So long as they insist on subjecting everyone to that (starting with people having just spent 4 years and a quarter of a million dollars on a Stanford CS education, and then people with verifiable experience on top of that), and also considering having been caught on abusive hiring/mobility conspiracy at they executive level, I think the CS101 whiteboard ridiculousness is not a good sign for corporate ego and intentions. It's also not great when CS students focus on drilling for that, to the exclusion of other things. For myself, if I applied anyway, I'd be fooling myself that I wasn't mainly after the compensation package, rather than wanting to have positive impact.

Re: Google's Captcha in Firefox vs. in Chrome

#312

Post by themacguffinman » Mon, Jun 10, 2019, 7:36 PM UTC

NelsonMinar wrote: post #236

Ocha wrote: post #27

FYI. Title is misleading. This experience has nothing to do Firefox vs Chrome. Result is because of 3rd party cookie and tracker blocking. I had same and even worse (I was not able to get through captcha) experience on chrome itself because I have 3rd party cookies disabled and couple privacy oriented extensions running.

reCAPTCHA needs to be re-engineered to work even in the face of privacy measures in browsers. Otherwise it will be better at distinguishing expert humans from ordinary humans than at distinguishing bots from humans.

I'm sure there's room for improvement but at some point this is paradoxical. Users who want data privacy want their presence and behavior obfuscated, which is fundamentally opposed to anti-fraud systems which are designed to analyze the presence and behavior of users to determine if they are fraudulent.

Re: Google's Captcha in Firefox vs. in Chrome

#313

Post by scarejunba » Mon, Jun 10, 2019, 7:43 PM UTC

earenndil wrote: post #267

ChrisSD wrote: post #218

Earlier quoted context omitted.

There's also the issue that it will lie to you if the alogrithm decides it simply doesn't like you. Which means you'll end up doing at least a couple of rounds before it decides to let you through.

Rather, if it does like you (because you frequently get it right), it'll ask you to give it extra data.

Fascinating. Conspiracy theories around software. Might make for a fun sci-fi creative writing exercise.

Re: Google's Captcha in Firefox vs. in Chrome

#314

Post by r00fus » Mon, Jun 10, 2019, 7:56 PM UTC

I use a site frequently and am on the latest FF and I don't see this behavior - the refresh is quite quick.

Does this mean that Google knows enough about me (ie, privacy leak) that it's choosing to not having infuriating UI?

Re: Google's Captcha in Firefox vs. in Chrome

#315

Post by r00fus » Mon, Jun 10, 2019, 7:59 PM UTC

Recursing wrote: post #221

rhino369 wrote: post #213

Earlier quoted context omitted.

Trying to convince a robot that you aren’t a robot by teaching a robot how to look at pictures is a pretty absurd state of the world. When they reboot the Matrix, instead of being used as batteries, the machines will keep humans around for machine learning test sets.

I think that was the original story for the matrix https://scifi.stackexchange.com/questions/19817/was-executiv...

Well, it might have been too close to the storyline of Hyperion Cantos (which probably got it from somewhere else).

Re: Google's Captcha in Firefox vs. in Chrome

#316

Post by mitchty » Mon, Jun 10, 2019, 8:01 PM UTC

judge2020 wrote: post #112

dessant wrote: post #39

I was going through the same ordeal as a Firefox user, so I've made Buster to solve challenges and reclaim some of that lost time: https://github.com/dessant/buster If you're a developer, please consider replacing reCAPTCHA on your site with an alternative. reCAPTCHA discriminates against people with disabilities and those who seek privacy, and it gaslights you into thinking you did not solve the challenge correctly,…

The problem with recaptcha alternatives is that they either are insecure or require time and money to continue to be ahead of bots. All of the "interactive stand-alone approaches" from that page can be beaten with run-of-the-mill OCR (other than perhaps the 3d challenge) and with almost any mobile phone speech recognition engine (and, if the attacker has the money, can send it off to Google's cloud speech-to-text). A…

> The problem with recaptcha alternatives is that they either are insecure or require time and money to continue to be ahead of bots.

Sure great, but when I see behavior like the above, I just hit back and add the site to my routers firewall black list. If its this much of a PITA to "solve" a captcha, CORRECTLY but I keep getting the middle finger I don't give a crap anymore. Your site isn't worth going to if I have to spend literally minutes "solving" captchas for googles stupid ai which is treating me like prove i'm a bot even when I prove i'm not.

Just realize by using recaptcha this is what you're forcing some users to deal with. And I deal with it by making sure I never come back to your site ever again when you've wasted minutes of my time just to try to get to your page. Even if its googles fault for being jerks, I don't care. You choose to implement it.

Ok rant mode off and stepping off my personal soap box.

Re: Google's Captcha in Firefox vs. in Chrome

#317

Post by teekert » Mon, Jun 10, 2019, 8:04 PM UTC

Oh, I thought it was me... seems like it was my choice of browser. In any case, perhaps Google has a harder time telling me apart from a computer. I guess that is a plus for FF then.

Re: Google's Captcha in Firefox vs. in Chrome

#318

Post by Elv13 » Mon, Jun 10, 2019, 8:04 PM UTC

DownGoat wrote: post #290

capsha wrote: post #252

Earlier quoted context omitted.

Yeah, but then again, so many times that I run into Captcha issues, it's on a site that really doesn't need Captcha to begin with. Why make me solve a Captcha to see static content? Why make me solve a Captcha to log in when I've already completed one to register? Why make me solve a Captcha to pay utility bills? Is there some underground group of deviants going around surreptitiously paying other people's utility bi…

> Why make me solve a Captcha to see static content? Fair point, I usually run into this when using Tor, or VPN when accessing content behind Cloudflare, and or similar services. This is some anti abuse stuff, but is often overly agressive with giving you captchas. > Why make me solve a Captcha to log in when I've already completed one to register? So attackers cannot password spray. This is typically after attackers…

> Sound like a strange place to have a captcha indeed. What information is needed in the form to submit it? Does it validate stuff that an attacker might want to scrape? I guess they added it for a reason.

In the past, I used curl to get some billing info, add the money to a dedicated virtual prepaid card, then pay the bill, then send an email to a gmail (+paidinvoice) label. These day, at least for my bills, they have pre-approved withdraw directly from the bank. However I guess this is not widely deployed.

If other people did this, but ended up doing it from an insecure machine and lost the credentials / got hacked, I can see why at least some orgs might want to prevent people from doing this. This is a classic over reaction, but a plausible scenario.

Re: Google's Captcha in Firefox vs. in Chrome

#319

Post by reaperducer » Mon, Jun 10, 2019, 8:09 PM UTC

mitchty wrote: post #316

judge2020 wrote: post #112

Earlier quoted context omitted.

The problem with recaptcha alternatives is that they either are insecure or require time and money to continue to be ahead of bots. All of the "interactive stand-alone approaches" from that page can be beaten with run-of-the-mill OCR (other than perhaps the 3d challenge) and with almost any mobile phone speech recognition engine (and, if the attacker has the money, can send it off to Google's cloud speech-to-text). A…

> The problem with recaptcha alternatives is that they either are insecure or require time and money to continue to be ahead of bots. Sure great, but when I see behavior like the above, I just hit back and add the site to my routers firewall black list. If its this much of a PITA to "solve" a captcha, CORRECTLY but I keep getting the middle finger I don't give a crap anymore. Your site isn't worth going to if I have…

Your site isn't worth going to if I have to spend literally minutes "solving" captchas for googles stupid ai which is treating me like prove i'm a bot even when I prove i'm not.

I've run into state and local tax agencies, utility companies, and large healthcare companies that require Google's reCAPTCHA. So, unless you don't want healthcare, to have water service at your home, or you're in the mood to just shut down your business, you have to suck it up.

Re: Google's Captcha in Firefox vs. in Chrome

#320

Post by forgottenpass » Mon, Jun 10, 2019, 8:10 PM UTC

bduerst wrote: post #57

woodrowbarlow wrote: post #6

Earlier quoted context omitted.

there are updates coming that will make it much more tied to your google account. i fear that it will mean anybody not currently logged in is assumed to be a robot. (even more so than now, i mean.)

According to the recent Planet Money podcast on Captcha, the upcoming changes will only use the signal of whether or not you have an account, and not any account-based data, since it will be domain based on the website or something. Also, they're doing away with the questionnaire. It works by using a scoring system or something similar since it loads on the pages leading up to form fills. Edit: Source for you disbeli…

>the upcoming changes will only use the signal of whether or not you have an account, and not any account-based data

Recaptcha doesn't care. But totally unrelated, it just accidentally worked out to be awfully convenient for Google's other surveillance products embedded on the same sites, which do care quite a bit about how long and how often they can follow me with a single unique identifier.