Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's Captcha in Firefox vs. in Chrome

grumpy.website

Post reply on HN
Print view View original

421–430 of 503 posts

Re: Google's Captcha in Firefox vs. in Chrome

#421

Post by matt-attack »

zrm wrote: post #323
judge2020 wrote: post #112

Earlier quoted context omitted.

The problem with recaptcha alternatives is that they either are insecure or require time and money to continue to be ahead of bots. All of the "interactive stand-alone approaches" from that page can be beaten with run-of-the-mill OCR (other than perhaps the 3d challenge) and with almost any mobile phone speech recognition engine (and, if the attacker has the money, can send it off to Google's cloud speech-to-text). A…

How hard would it be to create an alternative using GPT-2 or the like? Create a dozen models based on different things. Street signs, cats, houses, cars, etc. Then show the user a random selection of images generated from different models and say "select all the cats" and they get it right if they choose the images generated from the cat model.

To understand the depth and complexity of Captcha2 I highly recommend this:

https://www.quora.com/Why-cant-bots-check-“I-am-not-a-robot”...

Was posted on HN a while ago.

Re: Google's Captcha in Firefox vs. in Chrome

#422

Post by robocat »

BearsAreCool wrote: post #348
squidi wrote: post #228

Earlier quoted context omitted.

E.g “Spot the fire hydrant” - oh, it’s those things that cops drive over in Hollywood movies. I don’t know if other counties have them too but it seems distinctly American and this capatcha is oddly common

Are you in america or using a vpn that shows as in america?

NZer here. The captures are usually American places with American themes.

I have definitely seen the "fire-hydrant" one, and we don't have fire hydrants (they are underground below well marked covers that are illegal to park on or placed where you can't park).

And coming from a first-world Western country, I have definitely been flummoxed by at least one that was too American for me to decipher. I feel sorry for anyone that doesn't watch American media.

Re: Google's Captcha in Firefox vs. in Chrome

#424

Post by judge2020 »

modzu wrote: post #338
judge2020 wrote: post #112

Earlier quoted context omitted.

The problem with recaptcha alternatives is that they either are insecure or require time and money to continue to be ahead of bots. All of the "interactive stand-alone approaches" from that page can be beaten with run-of-the-mill OCR (other than perhaps the 3d challenge) and with almost any mobile phone speech recognition engine (and, if the attacker has the money, can send it off to Google's cloud speech-to-text). A…

wrong. captcha blocks bots and humans alike . so why bother with the fake puzzle at all? just replace whatever triggers your captcha with a straight up block. or else please consider a responsible alternative.

ReCaptcha blocks (or deters) an extraordinarily larger percentage of bots than it does to humans by far.

Re: Google's Captcha in Firefox vs. in Chrome

#426

Post by vageli »

threezero wrote: post #242
SamWhited wrote: post #75

I thought this was just me and their stupid caption being impossible for even humans to solve; turns out I was just being gaslighted this entire time and they're just discriminating against Firefox users? How does the EU or someone not shut down this sort of anti-competative monopolostic nosense? I didn't think I could get more furious about having to struggle with these captions all day, but somehow I am. Please eve…

EU may end up dealing with it, they need complaints first. You’d be amazed how few people fill out complaints with the government. I just filed a complaint about this with the US department of justice antitrust division, feel free to do so as well so they realize how abusive this is!

> EU may end up dealing with it, they need complaints first. You’d be amazed how few people fill out complaints with the government. I just filed a complaint about this with the US department of justice antitrust division, feel free to do so as well so they realize how abusive this is!

How do you go about filing this complaint? I'm sure many others (myself included) are interested

Re: Google's Captcha in Firefox vs. in Chrome

#427

Post by atombender »

userbinator wrote: post #418
DownGoat wrote: post #290

Earlier quoted context omitted.

> Why make me solve a Captcha to see static content? Fair point, I usually run into this when using Tor, or VPN when accessing content behind Cloudflare, and or similar services. This is some anti abuse stuff, but is often overly agressive with giving you captchas. > Why make me solve a Captcha to log in when I've already completed one to register? So attackers cannot password spray. This is typically after attackers…

So attackers cannot password spray. This is typically after attackers has gotten access to the latest database breach, and are just blindly trying username/password combinations. A simple ratelimit takes care of that. Plus, it's not like attackers would be easily defeated by a CAPTCHA anyway --- there are services selling batches of valid tokens, likely generated by actual humans or very close emulations thereof, for…

Rate limit by what? IP? Botnet traffic will originate at random IPs.

Re: Google's Captcha in Firefox vs. in Chrome

#428

Post by vageli »

gwoplock wrote: post #346
driverdan wrote: post #257

Earlier quoted context omitted.

Use self-hosted CAPTCHA with simpler solutions. They still keep out the stupid bots that can't get past ReCAPTCHA.

> Use self-hosted CAPTCHA with simpler solutions My favorite CAPTCHA is the one on the Arch Linux forms but I realize this cant be used many places. > What is the output of "date -u +%V$(uname)|sha1sum|sed 's/\W//g'"? Easy to do but hard to do with computers. My second favorite are the math problems one. However if these become popular people will just write bots for them and were back to square 1.

> > Use self-hosted CAPTCHA with simpler solutions

> My favorite CAPTCHA is the one on the Arch Linux forms but I realize this cant be used many places. > What is the output of "date -u +%V$(uname)|sha1sum|sed 's/\W//g'"?

> Easy to do but hard to do with computers. My second favorite are the math problems one.

> However if these become popular people will just write bots for them and were back to square 1.

Interesting...I wonder if they show destructive commands below a certain threshold. It would be funny if a captcha caused a bot to delete itself.

Re: Google's Captcha in Firefox vs. in Chrome

#429

Post by atombender »

pmontra wrote: post #159
judge2020 wrote: post #112

Earlier quoted context omitted.

The problem with recaptcha alternatives is that they either are insecure or require time and money to continue to be ahead of bots. All of the "interactive stand-alone approaches" from that page can be beaten with run-of-the-mill OCR (other than perhaps the 3d challenge) and with almost any mobile phone speech recognition engine (and, if the attacker has the money, can send it off to Google's cloud speech-to-text). A…

I implemented simple question / answer antibot filters on registration forms for a few sites. Nobosy ever made the effort to customize their bot to answer to those very few questions. I guess it doesn't make sense economically. However if a big site would go that way, it would be filled with bots in a day.

I once implemented a "poor man's captcha" that presented a simple randomized question that anyone would be able to answer (ranging from "what year is it" to "what's 2 + 2"). I guessed that nobody would make the effort to write a custom script for this, because the website in question was so niche and the stakes so low -- a very quiet corner of the Internet; I don't even remember what is was, possibly some feedback form that went to a support email. I actually felt some irrational measure of pride when, probably a year later, I was looking at some logs and discovered that some script kid had cracked the questionnaire and was currently using the form to post nonsense text with Viagra links. Someone had actually sat down and written code to crack my terrible solution, and probably spent more time on it than I had (which is to say, more than five minutes). Made my day.

Re: Google's Captcha in Firefox vs. in Chrome

#430

Post by modzu »

judge2020 wrote: post #424
modzu wrote: post #338

Earlier quoted context omitted.

wrong. captcha blocks bots and humans alike . so why bother with the fake puzzle at all? just replace whatever triggers your captcha with a straight up block. or else please consider a responsible alternative.

ReCaptcha blocks (or deters) an extraordinarily larger percentage of bots than it does to humans by far.

of course it does. so does an automatic ban. that's precisely not the issue.

i think you probably meant to say recaptcha allows an extraordinarily large number of humans compared to false positives? because that would be the relevant metric. you sure about that one?

Post reply on HN