Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's Captcha in Firefox vs. in Chrome

grumpy.website

Post reply on HN
Print view View original

371–380 of 503 posts

Re: Google's Captcha in Firefox vs. in Chrome

#371

Post by mehrdadn »

neilv wrote: post #259
crazygringo wrote: post #170

I've never understood what happened to reCAPTCHA, it was originally so great and is now just so, so toxic. Originally it was an awesome solution based on OCR'ing books that usually worked quickly on the first try, and almost never took more than two. Then it turned into a single checkbox (analyzing mouse movement) so it was even faster... and I remember some simple image-based like "select the images of cats" that we…

An insightful remark about ReCaptcha on HN recently (I don't have a link) was that it went from being "are you human" to "which human are you".

It sounds funny but I don't get it. ReCaptcha doesn't identify you does it?

Re: Google's Captcha in Firefox vs. in Chrome

#372

Post by oarsinsync »

modzu wrote: post #370
drusepth wrote: post #361

Earlier quoted context omitted.

Uh, using a wheelchair vs walking is a lot less of a personal choice than using Firefox vs Chrome. Or: people who need a wheelchair are protected by anti-discriminatory laws, while people who prefer not to use Google products aren't.

uh, captchas don't just appear on Google products. Third parties use it -- government services, online shopping, all kinds of things you take for granted because clearly you aren't one of the people affected by it (ie you're fingerprinted). Many things we used to do in physical space now occurs virtually. There is a serious philosophical and moral case to be made for the relevance of privacy and anonymity that captch…

I suspect the Google product that the GP was referring to was Chrome, given that this is a co, ent thread about Firefox vs Chrome, and the behaviour of another Google product (recaptcha) betwee the aforementioned products.

Re: Google's Captcha in Firefox vs. in Chrome

#373

Post by Zak »

DownGoat wrote: post #290
capsha wrote: post #252

Earlier quoted context omitted.

Yeah, but then again, so many times that I run into Captcha issues, it's on a site that really doesn't need Captcha to begin with. Why make me solve a Captcha to see static content? Why make me solve a Captcha to log in when I've already completed one to register? Why make me solve a Captcha to pay utility bills? Is there some underground group of deviants going around surreptitiously paying other people's utility bi…

> Why make me solve a Captcha to see static content? Fair point, I usually run into this when using Tor, or VPN when accessing content behind Cloudflare, and or similar services. This is some anti abuse stuff, but is often overly agressive with giving you captchas. > Why make me solve a Captcha to log in when I've already completed one to register? So attackers cannot password spray. This is typically after attackers…

> I guess they added it for a reason.

This is not necessarily a reasonable assumption. People often do things because they heard it was a good practice, or because it solves a problem they don't actually have, but think they might, or arbitrarily without giving it much thought.

Re: Google's Captcha in Firefox vs. in Chrome

#374

Post by [deleted] »

capsha wrote: post #252
judge2020 wrote: post #112

Earlier quoted context omitted.

The problem with recaptcha alternatives is that they either are insecure or require time and money to continue to be ahead of bots. All of the "interactive stand-alone approaches" from that page can be beaten with run-of-the-mill OCR (other than perhaps the 3d challenge) and with almost any mobile phone speech recognition engine (and, if the attacker has the money, can send it off to Google's cloud speech-to-text). A…

Yeah, but then again, so many times that I run into Captcha issues, it's on a site that really doesn't need Captcha to begin with. Why make me solve a Captcha to see static content? Why make me solve a Captcha to log in when I've already completed one to register? Why make me solve a Captcha to pay utility bills? Is there some underground group of deviants going around surreptitiously paying other people's utility bi…

[deleted]

Re: Google's Captcha in Firefox vs. in Chrome

#375

Post by gouh »

driverdan wrote: post #368

Based on some CAPTCHA solving sites it costs about $3 per 1000 ReCAPTCHAs solved. That shows you how worthless adding ReCAPTCHA to your site is. All it'll do is slow bots down a bit and cost $0.003. Here's an extension to use those services in the browser so you never have to solve one again: https://addons.mozilla.org/en-US/firefox/addon/recaptcha-sol... That's assuming you can't get Buster to work.

Or even pay, I wouldn't mind paying 0.003$ at each Captcha as long as I have an anonymous payment system.

Re: Google's Captcha in Firefox vs. in Chrome

#376

Post by ClassyJacket »

bad_user wrote: post #167
masukomi wrote: post #50

Earlier quoted context omitted.

you may be right about the fade-out and delay but the time spent fading in only hampers humans not bots. As soon as it starts fading in the image is present in non-faded form and the bots can start processing it.

> the time spent fading in only hampers humans not bots Not necessarily, contrast adds detail and mistakes are expensive, so bots too are incentivized to wait for the final picture (this assuming that network communications aren't monitored to get the incoming image out of the request). Also clicking on that image too early is a good signal that it's a bot.

The bot would just read the unfaded image from the DOM.

Re: Google's Captcha in Firefox vs. in Chrome

#377

Post by a1369209993 »

nishmastime wrote: post #286
addicted wrote: post #79

Earlier quoted context omitted.

I don't log in to Google Captcha sites anymore, unless I absolutely have to. Their discrimination against FF users has been fairly evident over the past year or so. It's amazing how my identification abilities improve exponentially by using Chrome instead of Firefox.

Reading these types of comments on HN, you'd think HN doesn't use Recaptcha for login/register. ;) Easy to hate on Recaptcha while reaping the rewards of participating in a community that deals with less automated spam because of it. :)

> HN doesn't use Recaptcha for login/register

I just created a new account to check; not even so much as a Recaptcha url in the page source.

Re: Google's Captcha in Firefox vs. in Chrome

#378

Post by [deleted] »

Zak wrote: post #373
DownGoat wrote: post #290

Earlier quoted context omitted.

> Why make me solve a Captcha to see static content? Fair point, I usually run into this when using Tor, or VPN when accessing content behind Cloudflare, and or similar services. This is some anti abuse stuff, but is often overly agressive with giving you captchas. > Why make me solve a Captcha to log in when I've already completed one to register? So attackers cannot password spray. This is typically after attackers…

> I guess they added it for a reason. This is not necessarily a reasonable assumption. People often do things because they heard it was a good practice, or because it solves a problem they don't actually have, but think they might, or arbitrarily without giving it much thought.

[deleted]

Re: Google's Captcha in Firefox vs. in Chrome

#379

Post by resoluteteeth »

quwert95 wrote: post #235

As a developer who has worked with reCAPTCHA in the past and as a diehard Firefox user, what likely happened here is a form of shadow banning. You're moving too fast; your mouse and mouse clicks are "too good" to be human. Try solving the reCAPTCHA slower and you'll see wildly different results, or, purposely fail one reCAPTCHA to get easier ones. reCAPTCHA tech is crazy; reCAPTCHAs are not simple web forms and Javas…

> reCAPTCHA tech is crazy; reCAPTCHAs are not simple web forms and Javascript, they're a sandboxed and monitored 'window' to a Google server. If you solve too many reCAPTCHAs too quickly (ie. when you are testing a web page, or are rotating your passwords on many websites) then Google's servers will try to rate limit you with slow animations and harder reCAPTCHAs.

Google should absolutely not be in a position where it can be inadvertently rate limiting your attempts to rotate passwords on different websites across the internet.

Re: Google's Captcha in Firefox vs. in Chrome

#380

Post by ClassyJacket »

themacguffinman wrote: post #312
NelsonMinar wrote: post #236

Earlier quoted context omitted.

reCAPTCHA needs to be re-engineered to work even in the face of privacy measures in browsers. Otherwise it will be better at distinguishing expert humans from ordinary humans than at distinguishing bots from humans.

I'm sure there's room for improvement but at some point this is paradoxical. Users who want data privacy want their presence and behavior obfuscated, which is fundamentally opposed to anti-fraud systems which are designed to analyze the presence and behavior of users to determine if they are fraudulent.

The way recaptcha happens to work now, and its purported goal - to differentiate humans from bots - are two different things. Privacy is not fundamentally opposed to anti-fraud in the slightest.
Post reply on HN