There have been many discussions on HN about this before. Google is making us its free slaves, when they can clearly know in the first click that we are not a robot (it used to work perfectly! How can it unintentionally become that worse?) Is there no Google employee here that sees how absurd this is and get this message sent across?
Google's Captcha in Firefox vs. in Chrome
451–460 of 503 posts
Re: Google's Captcha in Firefox vs. in Chrome
#452Earlier quoted context omitted.
I think two things happened: 1) Computer vision got a lot better over the past few years. It's also become way easier for the average Joe bot operator to run cutting-edge stuff. OCR tasks don't cut it for distinguishing people from machines any more. Every time I see a blog post about a new computer vision architecture or how some random developer trained a neural network to get an X% result on benchmark Y, I think t…
I've noticed the opposite on #2, especially in the last year or so. I've been solving a lot more captchas than I used to. I run Firefox with a lot of privacy focused add ons and I don't stay logged in to Google, I wonder if those have something to do with it.
Same here. When this highly advertized service was launched ('just a click!') it worked perfectly. Slowly, over the past couple of years, they deliberately replaced that wonderful service with another one where we act as Google's unpaid workers.
Re: Google's Captcha in Firefox vs. in Chrome
#453I've never understood what happened to reCAPTCHA, it was originally so great and is now just so, so toxic. Originally it was an awesome solution based on OCR'ing books that usually worked quickly on the first try, and almost never took more than two. Then it turned into a single checkbox (analyzing mouse movement) so it was even faster... and I remember some simple image-based like "select the images of cats" that we…
I think two things happened: 1) Computer vision got a lot better over the past few years. It's also become way easier for the average Joe bot operator to run cutting-edge stuff. OCR tasks don't cut it for distinguishing people from machines any more. Every time I see a blog post about a new computer vision architecture or how some random developer trained a neural network to get an X% result on benchmark Y, I think t…
I am also getting way more captchas at least since the last 6 months. Exclusively using Firefox with clear everything on exit, multiple profiles, fingerprint flag on, some addons etc. No VPN. I get captcha almost all the time, even for Google searches from Firefox address bar (one out of 10 searches I think). But never gets a captcha for Google websites (gmail, youtube etc).
Re: Google's Captcha in Firefox vs. in Chrome
#454Earlier quoted context omitted.
By the account. 3 failed login attempts in a row, and you disallow further logins for 30 seconds. This should waste less time than reCAPTCHAs. I know it's not 1:1 in terms of pros/cons, but it gets a good subset of the advantages without the key disadvantages mentioned above.
First, that's a bit user-hostile (and suddenly a DoS-vector; I can prevent a site's users from logging in by continuously firing bad password attempts). Secondly, botnets can, and presumably do, randomize which accounts they try, too.
So rate-limiting is "user-hostile", but permanently hell-banning someone because their network is considered "seedy" is user-friendly?
Incidentally, you still need rate-limiting if you use Google's CAPTCHA. If you don't rate-limit CAPTCHA endpoint, an attacker can DDoS you (especially if your server-side captcha component uses low-performance single-threaded HTTP client). Furthermore, an attacker within the same AS as their target can purposefully screw over their account by performing attacks on Google's services until the reputation of the network hits rock bottom.
Re: Google's Captcha in Firefox vs. in Chrome
#455Earlier quoted context omitted.
Are you in america or using a vpn that shows as in america?
NZer here. The captures are usually American places with American themes. I have definitely seen the "fire-hydrant" one, and we don't have fire hydrants (they are underground below well marked covers that are illegal to park on or placed where you can't park). And coming from a first-world Western country, I have definitely been flummoxed by at least one that was too American for me to decipher. I feel sorry for anyo…
Huh, there's fire hydrant here in Brazil. Although not as common as it was a time ago!
Re: Google's Captcha in Firefox vs. in Chrome
#456Earlier quoted context omitted.
> So attackers cannot password spray. My password's not crackable, so it's annoying to be lumped in to that. I'd happily use a service-generated password to avoid login hassles.
I imagine what you are proposing then is to record the entropy on the password when you first register and for accounts with sufficient password entropy to not ask for a captcha after few failed attempts. With that, the site gives away whether the account has a low entropy password or not.
> I imagine what you are proposing then is to record the entropy on the password
Or just generate secure high-entropy passwords and force users to use them.
Making users look up SMS codes before each login is acceptable. Making them solve obnoxious, long, privacy-hostile riddles is acceptable. But forcing them to use pre-generated secure passwords?! That can't possibly work. They will revolt!
Re: Google's Captcha in Firefox vs. in Chrome
#457Earlier quoted context omitted.
If it can be statistically proven that this is occurring more on Firefox than Chrome then Google has a really, really big problem. The burden to make sure it isn’t is on them, most especially in the EU. Google is facing a very real future where they will have no web browser and possibly no operating system.
It absolutely is happening more on Firefox. I open Chrome almost exclusively to bypass CAPTCHAS, and I doubt they will get in trouble because Chrome gives more detailed data due to its invasive lack of privacy. You can't really blame Google for using its own tech to provide "better" results, but it is high time we started blaming them for the massive privacy violations they use to make their convenience work.
Safari too. If it also happens in the new Edge, I will be sad but not surprised.
Re: Google's Captcha in Firefox vs. in Chrome
#458Congratulations, you played yourself.
It's not Firefox that's the problem; reCAPTCHA works just fine on Firefox. It's all those anti-tracking measures you installed and enabled -- they work by making your browser indistinguishable from a low-quality bot, kicking the website into self-defense mode. The slow fade is a rate-limiting measure. It's annoying to you, but it's more annoying to people trying to automate login attempts.
The site is attempting to protect your account by preventing automated attacks against it. Meanwhile your browser is doing it's best to look like a shell script, refusing to send any sort of behavioral feedback or distinguishing characteristics that might give away the fact that you're a human.
So the question is: is it really worth alienating those quirky, paranoid users who take extraordinary anti-tracking measures, just to protect your normal users from automated attacks?
Yes.
Of course it is.
Re: Google's Captcha in Firefox vs. in Chrome
#459Earlier quoted context omitted.
The problem with recaptcha alternatives is that they either are insecure or require time and money to continue to be ahead of bots. All of the "interactive stand-alone approaches" from that page can be beaten with run-of-the-mill OCR (other than perhaps the 3d challenge) and with almost any mobile phone speech recognition engine (and, if the attacker has the money, can send it off to Google's cloud speech-to-text). A…
Yeah, but then again, so many times that I run into Captcha issues, it's on a site that really doesn't need Captcha to begin with. Why make me solve a Captcha to see static content? Why make me solve a Captcha to log in when I've already completed one to register? Why make me solve a Captcha to pay utility bills? Is there some underground group of deviants going around surreptitiously paying other people's utility bi…
The weirdest one I have ever seen is on frikking walmart.com - here is my cynical paraphrasing of their 'thought process': "We don't want your money! Go back to Amazon! No captchas there cause they are not stupid!" I persist because I don't want to go back to being a 2nd-class non-Prime Amazon citizen but the darned unnecessary captchas really ruin my walmart.com shopping experience to no end.
If anyone from Walmart.com is reading, please please get rid of these useless captchas - it is an incredibly stupid thing that you do and unfortunately you do it too well as well.
Re: Google's Captcha in Firefox vs. in Chrome
#460Earlier quoted context omitted.
> the time spent fading in only hampers humans not bots Not necessarily, contrast adds detail and mistakes are expensive, so bots too are incentivized to wait for the final picture (this assuming that network communications aren't monitored to get the incoming image out of the request). Also clicking on that image too early is a good signal that it's a bot.
The bot would just read the unfaded image from the DOM.
> Clicking the image too early is a good signal that it’s a bot.
The fade in is actually a nice gesture to the human to show them that an image will be there soon, while still slowing them down to rate limit the bots.