Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Recaptcha v3: new way to stop bots

webmasters.googleblog.com

Post reply on HN
Print view View original

41–50 of 147 posts

Re: Recaptcha v3: new way to stop bots

#41

Post by superasn »

Their recaptcha is broken and causes a lot of pain especially when you're on an ISP that may have had some bad apples (pretty common in India where ISPs don't care about spam or piracy). It's like the whole neighborhood is paying the price of someone else's crime and it feels like the digital version of being racially profiled.

Worst part is even after solving dozens of images (which keep refreshing by the way to no end) you still sometimes get we don't believe you're human comment and no way to go forward.

Cloudflare and this recaptcha can really break the internet for some people, esp in small Indian cities.

Re: Recaptcha v3: new way to stop bots

#42

Post by pwnna »

ucaetano wrote: post #31
pwnna wrote: post #21

Earlier quoted context omitted.

>> The other day I was logging into newegg to order something > Newegg uses ads. That's not my point. We generally understand that newegg is there to sell you something. I was using it as a convenient example and perhaps a better one could be found. Just because they use ads does not invalidate my point there. From the HN guidelines: "Please respond to the strongest plausible interpretation of what someone says, not…

> Theoretically speaking, this is true. I can opt to simply close the page, turn off my computer, etc. However, it may not be practical to do this all the time. Some example maybe school/government institutions that you have to use deploys reCAPTCHA, or something like the CloudFlare pages that makes you fill out a reCAPTCHA for each website (which amounts to a large part of the internet). Sure, but what's your sugges…

I don't have a solution to the problem and I concur it is a difficult problem to solve. A sibling comment has pointed towards https://www.gov.uk/service-manual/technology/using-captchas, which doesn't have much enlightenment either.

That said, I'm merely pointing out the problems I see in the current "solution":

1. It is a very robotic approach to design a system: we end up treating human beings like numbers and thereby marginalizing the minority. After inconveniencing these people, we turn around and tell them: "just be normal" or "no you shouldn't think like this". If that's the type of society we would like to build, I think I have nothing else to say.

2. ultimately externalizes the cost of abuse detection to ads, which makes it very tempting for everyone to adopt it as it is "free". Even if differently motivated entity solved this problem, I'm unsure if anyone would want to pay for it given how invisible the issues it causes are to the business (as you have pointed out). This may mean that what I pointed out in (1)_will occur everywhere and I don't even think there's really a way to stop it from getting to the possible dystopia I see.

Maybe I'm just over dramatizing this and I really hope that is the case.

Re: Recaptcha v3: new way to stop bots

#43

Post by wild_preference »

robin_reala wrote: post #34
wild_preference wrote: post #13

Earlier quoted context omitted.

On the flip side, abuse exists, and wishing that anti-abuse measures went away does not acknowledge reality. Just like how I'm annoyed when I have to pay for a cup of coffee, but my annoyance doesn't really inform how things should be. Besides, if a relatively simple puzzle is too much to ask, then maybe you didn't care all that much to begin with. I can think of various platforms where this would be a good filter ev…

The puzzles aren’t simple if you’re blind or hard of vision. Or don’t have a US cultural background (I personally know a sidewalk is US English for a pavement, but I definitely don’t recognise all US street signs or shop hoardings, and have been caught out by that before).

ReCaptcha, of all things, has pretty good accessibility measures. Likely more than the site in which it's embedded.

Nobody is claiming it's perfect. But notice how nobody here is analyzing why people use ReCaptcha in the first place nor providing alternatives.

If you knew nothing of ReCaptcha and only read these comments, you'd wonder if it was a gag website operators put on their website for self-amusement, which is basically how I looked at homework as a kid. But I feel like this discussion is a bit more one-sided than I expected on HN, a place where I would've thought more people had experience running a website and how immediately effective ReCaptcha was the second you added a .

Re: Recaptcha v3: new way to stop bots

#44

Post by ksangeelee »

The language used seems alarmist, particularly given the extent to which Google use bots themselves.

For example, "the new way to stop bots", "alert you of suspicious traffic", "identify the pattern of attackers", "pages are being targeted by bots", "stay ahead of attackers and keep the Internet easy and safe to use (except for bots)"

Many companies have built valuable services by automating HTTP requests. One might even think that Google would like them to stop.

Two things that particularly worry me about this are a) encouraging sites to apply captchas to pages that have nothing to do with authentication and form inputs, and b) the hint of requiring two-factor authentication and phone numbers to proceed. [edit] will Google be offering to handle this on behalf of sites?

Re: Recaptcha v3: new way to stop bots

#45

Post by robin_reala »

wild_preference wrote: post #43
robin_reala wrote: post #34

Earlier quoted context omitted.

The puzzles aren’t simple if you’re blind or hard of vision. Or don’t have a US cultural background (I personally know a sidewalk is US English for a pavement, but I definitely don’t recognise all US street signs or shop hoardings, and have been caught out by that before).

ReCaptcha, of all things, has pretty good accessibility measures. Likely more than the site in which it's embedded. Nobody is claiming it's perfect. But notice how nobody here is analyzing why people use ReCaptcha in the first place nor providing alternatives. If you knew nothing of ReCaptcha and only read these comments, you'd wonder if it was a gag website operators put on their website for self-amusement, which is…

No. They say they do, but neither me not any of the team that tried it was able to complete a single test of the ReCAPTCHA accessible fallbacks. 0%. This was a couple of years ago, but at that point at least putting ReCAPTCHA into a site was putting a fixed roadblock in for people with visual impairments strong enough to force them down their audio route.

Re: Recaptcha v3: new way to stop bots

#46

Post by avip »

superasn wrote: post #41

Their recaptcha is broken and causes a lot of pain especially when you're on an ISP that may have had some bad apples (pretty common in India where ISPs don't care about spam or piracy). It's like the whole neighborhood is paying the price of someone else's crime and it feels like the digital version of being racially profiled. Worst part is even after solving dozens of images (which keep refreshing by the way to no…

I'd be surprised if recaptcha uses IP reputation. That being said, a classifier is not "broken" for introducing false-positives. If you read the post, you see that's one of the issues v3 tries to address.

Re: Recaptcha v3: new way to stop bots

#48

Post by robin_reala »

sgillen wrote: post #40
Kaveren wrote: post #27

I use Firefox with maximum tracking protections and a VPN, so I'm first in line to claim frustration about being forced to solve reCAPTCHAs. But on the other side, it needs to be understood just how important having a CAPTCHA is. The amount of destruction to user experience that bots can cause is sometimes far worse than the pain the CAPTCHA causes. The long chains of reCAPTCHAs annoy me to no end, and I hope a middl…

What exactly do you mean by computational challenges? That seems like the exact kind of thing a bot would be much better at compared to a human.

The thought is that a single user isn’t inconvenienced by a small amount of computational work to access a site, but a scraper is tarpitted into uselessness by it. Unfortunately this completely ignores the fact that the majority of site accesses are on battery power now.

Re: Recaptcha v3: new way to stop bots

#49

Post by wild_preference »

robin_reala wrote: post #45
wild_preference wrote: post #43

Earlier quoted context omitted.

ReCaptcha, of all things, has pretty good accessibility measures. Likely more than the site in which it's embedded. Nobody is claiming it's perfect. But notice how nobody here is analyzing why people use ReCaptcha in the first place nor providing alternatives. If you knew nothing of ReCaptcha and only read these comments, you'd wonder if it was a gag website operators put on their website for self-amusement, which is…

No. They say they do, but neither me not any of the team that tried it was able to complete a single test of the ReCAPTCHA accessible fallbacks. 0%. This was a couple of years ago, but at that point at least putting ReCAPTCHA into a site was putting a fixed roadblock in for people with visual impairments strong enough to force them down their audio route.

You're going to lose users or time/money with any abuse prevention. But you lose even more by letting things like spammers run rampant on your platform. You're stuck analyzing trade-offs, not ignoring reality.

Once again, all trails lead back to you providing some alternative solutions instead of the empty catharsis of coming up with downsides to something in an internet comment.

Here's one of my own: Isn't it annoying that spambots show up the second I launch a website? Ugh! Well, got that out of the way. Now I need a solution.

What's yours?

Re: Recaptcha v3: new way to stop bots

#50

Post by pwnna »

avip wrote: post #39
_pghu wrote: post #22

No, no, no, no. I do not want Google to have any more fucking data about me than it already does! "Put this blob of JavaScript on every page of your site so that we can see how users are clicking, scrolling, and browsing around. Think of the children^W spam and abuse!" I just cannot believe that Google somehow gets away with spinning this as some sort of "guardian of the Internet" thing when it is a transparent attem…

You seem to subtly express the notion that we are somehow "entitled" to access a website, just because it has a public IP address and we happen to have an http client. Well - we're not.

To put it bluntly.. I think this "just don't use it" meme needs to die. At this point in time, accessing certain websites is effectively a requirement of modern life: want to see your bills without paying for paper bills? want to apply for jobs? want to sign up for courses? submit your taxes? or even vote under some jurisdictions? Then you have to access a website. Sure, for a lot of these, there are alternatives. However, the costs will likely be much higher and you'll simply be left behind by everyone else in society.

This effort by Google, at its worst possible implementation, could break a huge number of "required" websites for users. As others have pointed out in this thread, the users who will be impeded are likely already at a disadvantage[1]. This just reinforces that, especially if everyone starts adopting this given how it is "free" for businesses/organizations.

A convenient side effect? Google gets more information about us and encourages us to view more ads.

[1] Someone mentioned smaller villages in India. The GOV.UK reference talks about users with disability. One could also imagine shared locations like public library, whose users may not have direct access to the internet.

Post reply on HN