Google's Captcha in Firefox vs. in Chrome

Post by basilgohar » Tue, Jun 11, 2019, 3:14 AM UTC

atombender wrote: post #427

userbinator wrote: post #418

Earlier quoted context omitted.

So attackers cannot password spray. This is typically after attackers has gotten access to the latest database breach, and are just blindly trying username/password combinations. A simple ratelimit takes care of that. Plus, it's not like attackers would be easily defeated by a CAPTCHA anyway --- there are services selling batches of valid tokens, likely generated by actual humans or very close emulations thereof, for…

Rate limit by what? IP? Botnet traffic will originate at random IPs.

Post by Semaphor » Tue, Jun 11, 2019, 3:21 AM UTC

judge2020 wrote: post #112

dessant wrote: post #39

I was going through the same ordeal as a Firefox user, so I've made Buster to solve challenges and reclaim some of that lost time: https://github.com/dessant/buster If you're a developer, please consider replacing reCAPTCHA on your site with an alternative. reCAPTCHA discriminates against people with disabilities and those who seek privacy, and it gaslights you into thinking you did not solve the challenge correctly,…

The problem with recaptcha alternatives is that they either are insecure or require time and money to continue to be ahead of bots. All of the "interactive stand-alone approaches" from that page can be beaten with run-of-the-mill OCR (other than perhaps the 3d challenge) and with almost any mobile phone speech recognition engine (and, if the attacker has the money, can send it off to Google's cloud speech-to-text). A…

Post by baby » Tue, Jun 11, 2019, 3:22 AM UTC

jonas21 wrote: post #215

crazygringo wrote: post #170

I've never understood what happened to reCAPTCHA, it was originally so great and is now just so, so toxic. Originally it was an awesome solution based on OCR'ing books that usually worked quickly on the first try, and almost never took more than two. Then it turned into a single checkbox (analyzing mouse movement) so it was even faster... and I remember some simple image-based like "select the images of cats" that we…

I think two things happened: 1) Computer vision got a lot better over the past few years. It's also become way easier for the average Joe bot operator to run cutting-edge stuff. OCR tasks don't cut it for distinguishing people from machines any more. Every time I see a blog post about a new computer vision architecture or how some random developer trained a neural network to get an X% result on benchmark Y, I think t…

Post by x3sphere » Tue, Jun 11, 2019, 4:11 AM UTC

netcraft wrote: post #399

x3sphere wrote: post #216

Earlier quoted context omitted.

reCaptcha v3 works well for me. There are no challenges anymore and it just gives you a score based on whether it thinks the user is a bot/spammer, then you can do whatever with that. Personally if the score is low enough I just place the user in a restricted user group that needs approval on certain site actions.

Was just looking into using v3 today. Can you share what you consider to be low enough? I haven't seen any guidance on thresholds

Post by mdekkers » Tue, Jun 11, 2019, 4:22 AM UTC

novaleaf wrote: post #99

shawnz wrote: post #91

Earlier quoted context omitted.

I thought recaptcha provided alternate domains/hosts not linked to Google so that you can use it in China. Is that not the case anymore?

if this is true, I'd love to hear the alternate! I use recaptcha and hate that my chinese customers need to do wacky stuff to circumvent it.