Google's Captcha in Firefox vs. in Chrome • Hacker News Board

Re: Google's Captcha in Firefox vs. in Chrome

#411

Post by m463 » Tue, Jun 11, 2019, 1:39 AM UTC

swebs wrote: post #262

dessant wrote: post #39

I was going through the same ordeal as a Firefox user, so I've made Buster to solve challenges and reclaim some of that lost time: https://github.com/dessant/buster If you're a developer, please consider replacing reCAPTCHA on your site with an alternative. reCAPTCHA discriminates against people with disabilities and those who seek privacy, and it gaslights you into thinking you did not solve the challenge correctly,…

Honest question: can we start a class action lawsuit for psychological damages due to this? I've experienced this firsthand when trying to use a service through a VPN. I spent legitimately 5 minutes trying to get through only to get "Please try again" every time even though I selected them meticulously. It is infuriating. I thought I was going crazy

You cannot make an appointment on the california dmv website without using google services, in particular recaptcha. Also, just browsing the website, it tries to log you in.

https://dmv.ca.gov

additionally, lots of schools now require their students to use google services.

I hope there is a privacy lawsuit in the future to stop this sort of nonsense.

Re: Google's Captcha in Firefox vs. in Chrome

#412

Post by camgunz » Tue, Jun 11, 2019, 1:43 AM UTC

Antitrust investigators should look into captcha stats for at least browser, ISP, mobile device, IP address, and referer header. It would be better if they could just get Google's algorithm, which I assume is based on more data. I'd be very surprised if Google popped captchas less for non-Google IPs, devices, and browsers.

Re: Google's Captcha in Firefox vs. in Chrome

#413

Post by ashaikh » Tue, Jun 11, 2019, 1:48 AM UTC

Does Google use this data to help train its self driving cars and maps for identifying information?

I feel like every captcha is about a street scene of some sort... house numbers, cars, motorcycles, hydrants, stop lights etc.

Re: Google's Captcha in Firefox vs. in Chrome

#414

Post by lscotte » Tue, Jun 11, 2019, 1:51 AM UTC

DownGoat wrote: post #290

capsha wrote: post #252

Earlier quoted context omitted.

Yeah, but then again, so many times that I run into Captcha issues, it's on a site that really doesn't need Captcha to begin with. Why make me solve a Captcha to see static content? Why make me solve a Captcha to log in when I've already completed one to register? Why make me solve a Captcha to pay utility bills? Is there some underground group of deviants going around surreptitiously paying other people's utility bi…

> Why make me solve a Captcha to see static content? Fair point, I usually run into this when using Tor, or VPN when accessing content behind Cloudflare, and or similar services. This is some anti abuse stuff, but is often overly agressive with giving you captchas. > Why make me solve a Captcha to log in when I've already completed one to register? So attackers cannot password spray. This is typically after attackers…

My electric company requires one to login - but only after a the browser session expires and I have to login again anyway.

Re: Google's Captcha in Firefox vs. in Chrome

#415

Post by doomglobe » Tue, Jun 11, 2019, 1:57 AM UTC

robin_reala wrote: post #366

reaperducer wrote: post #319

Earlier quoted context omitted.

Your site isn't worth going to if I have to spend literally minutes "solving" captchas for googles stupid ai which is treating me like prove i'm a bot even when I prove i'm not. I've run into state and local tax agencies, utility companies, and large healthcare companies that require Google's reCAPTCHA. So, unless you don't want healthcare, to have water service at your home, or you're in the mood to just shut down y…

UK Gov doesn’t allow CAPTCHAs on central gov services: https://www.gov.uk/service-manual/technology/using-captchas

They can still use them if they meet certain criteria, and show that they 'need' them. The overuse probably comes from the incentive - Google is incentivized to encourage the use of captcha because it is curating a data collection for ai training. I imagine some of the 'gaslighting' that people experience is when they are given images that don't yet have a confidence rating high enough. I wonder if answering incorrectly often enough would result in being asked fewer questions?

Re: Google's Captcha in Firefox vs. in Chrome

#416

Post by p2t2p » Tue, Jun 11, 2019, 2:04 AM UTC

reaperducer wrote: post #319

mitchty wrote: post #316

Earlier quoted context omitted.

> The problem with recaptcha alternatives is that they either are insecure or require time and money to continue to be ahead of bots. Sure great, but when I see behavior like the above, I just hit back and add the site to my routers firewall black list. If its this much of a PITA to "solve" a captcha, CORRECTLY but I keep getting the middle finger I don't give a crap anymore. Your site isn't worth going to if I have…

Your site isn't worth going to if I have to spend literally minutes "solving" captchas for googles stupid ai which is treating me like prove i'm a bot even when I prove i'm not. I've run into state and local tax agencies, utility companies, and large healthcare companies that require Google's reCAPTCHA. So, unless you don't want healthcare, to have water service at your home, or you're in the mood to just shut down y…

It this case they get to deal with me offline. Like I'm using a credit card right now without internet banking. They send me letters, on paper, with how much I owe them and then I pay. All because registering for their internet banking was a crazy shitty experience that I abandoned.

Re: Google's Captcha in Firefox vs. in Chrome

#417

Post by penagwin » Tue, Jun 11, 2019, 2:06 AM UTC

grinsekatze wrote: post #270

michaelt wrote: post #149

Earlier quoted context omitted.

they're just discriminating against Firefox users? At least part of the behaviour shown in the video depends on factors like cookies, IP address, and whether you have features like anti-fingerprinting protection turned on. [1] Recaptcha is frustrating and I dislike it, especially the slow fade-ins and multiple challenges, but if you repeat the test shown in the video you won't find it 100% repeatable just because you…

I just wasted ~15 minutes on doing the disqus login captcha under different conditions .. turns out that as soon as uMatrix is enabled (and blocks 18 cookies from google.com and 5 more from www.google.com), it starts to act up and get annoying..at least for me. It then takes between 1 minute and 1 minute 30 to get past the recaptcha when blocking those cookies - and I was certain to be 100% correct in most cases and…

That's what I don't understand. If you're building a bot to get past reCAPTCHA then you're almost certainly in some selenium/chrome headless environment, with full chrome support of cookies, Javascript, you name it. There's certain methods of detecting such environments based on their environmental variables there were again more work around to patch those.

Also the fade is irrelevant because the bot already has access to the image without the fade (although it still has to await the fades completion to continue).

Re: Google's Captcha in Firefox vs. in Chrome

#418

Post by userbinator » Tue, Jun 11, 2019, 2:07 AM UTC

DownGoat wrote: post #290

capsha wrote: post #252

Earlier quoted context omitted.

Yeah, but then again, so many times that I run into Captcha issues, it's on a site that really doesn't need Captcha to begin with. Why make me solve a Captcha to see static content? Why make me solve a Captcha to log in when I've already completed one to register? Why make me solve a Captcha to pay utility bills? Is there some underground group of deviants going around surreptitiously paying other people's utility bi…

> Why make me solve a Captcha to see static content? Fair point, I usually run into this when using Tor, or VPN when accessing content behind Cloudflare, and or similar services. This is some anti abuse stuff, but is often overly agressive with giving you captchas. > Why make me solve a Captcha to log in when I've already completed one to register? So attackers cannot password spray. This is typically after attackers…

So attackers cannot password spray. This is typically after attackers has gotten access to the latest database breach, and are just blindly trying username/password combinations.

A simple ratelimit takes care of that. Plus, it's not like attackers would be easily defeated by a CAPTCHA anyway --- there are services selling batches of valid tokens, likely generated by actual humans or very close emulations thereof, for ReCAPTCHA.

Re: Google's Captcha in Firefox vs. in Chrome

#419

Post by tomxor » Tue, Jun 11, 2019, 2:09 AM UTC

mikro2nd wrote: post #195

crazygringo wrote: post #170

I've never understood what happened to reCAPTCHA, it was originally so great and is now just so, so toxic. Originally it was an awesome solution based on OCR'ing books that usually worked quickly on the first try, and almost never took more than two. Then it turned into a single checkbox (analyzing mouse movement) so it was even faster... and I remember some simple image-based like "select the images of cats" that we…

There's a third problem: quite a bit of the stuff they present is (almost) uniquely American and presents a recognition challenge in other cultural contexts. That yellow vehicle? Looks nothing like a bus in most other parts of the world. And so the rest of the world gets to learn what an American Bus looks like... Not, I think, what was intended.

Totally this, I'm British and am probably more exposed to american culture than other nationalities on average, and yet recaptcha still sometimes leaves me clueless on some americanism, that is when it's not driving me crazy with it's infinite loop. For other nationalities it must be straight up discrimination.

I sometimes wonder if these projects are actually internal astroturfing, someone trying to make people hate Google from the inside, it's so bad it must be intentional right?

Re: Google's Captcha in Firefox vs. in Chrome

#420

Post by robin_reala » Tue, Jun 11, 2019, 2:16 AM UTC

doomglobe wrote: post #415

robin_reala wrote: post #366

Earlier quoted context omitted.

UK Gov doesn’t allow CAPTCHAs on central gov services: https://www.gov.uk/service-manual/technology/using-captchas

They can still use them if they meet certain criteria, and show that they 'need' them. The overuse probably comes from the incentive - Google is incentivized to encourage the use of captcha because it is curating a data collection for ai training. I imagine some of the 'gaslighting' that people experience is when they are given images that don't yet have a confidence rating high enough. I wonder if answering incorrec…

(I used to work at GDS)

‘Need’ here means exhausted all other opportunities, and have built alternative accessible ways of accessing the same service. I’d certainly have expected a service to have investigated a self-hosted solution, and I doubt a reliance on 3rd party JS from a Google service would fly, regardless of the service, as it breaks a whole bunch of separate resilience guidelines.