Google's Captcha in Firefox vs. in Chrome • Hacker News Board

Re: Google's Captcha in Firefox vs. in Chrome

#461

Post by dorgo » Tue, Jun 11, 2019, 6:51 AM UTC

doomglobe wrote: post #415

robin_reala wrote: post #366

Earlier quoted context omitted.

UK Gov doesn’t allow CAPTCHAs on central gov services: https://www.gov.uk/service-manual/technology/using-captchas

They can still use them if they meet certain criteria, and show that they 'need' them. The overuse probably comes from the incentive - Google is incentivized to encourage the use of captcha because it is curating a data collection for ai training. I imagine some of the 'gaslighting' that people experience is when they are given images that don't yet have a confidence rating high enough. I wonder if answering incorrec…

The few times I couldn't avoid Recaptcha, I spent 5 minutes randomly clicking on image tiles. Sometimes I got through by this strategy. If it didn't work, I tried a less random approach.

Re: Google's Captcha in Firefox vs. in Chrome

#462

Post by llao » Tue, Jun 11, 2019, 6:56 AM UTC

vageli wrote: post #428

gwoplock wrote: post #346

Earlier quoted context omitted.

> Use self-hosted CAPTCHA with simpler solutions My favorite CAPTCHA is the one on the Arch Linux forms but I realize this cant be used many places. > What is the output of "date -u +%V$(uname)|sha1sum|sed 's/\W//g'"? Easy to do but hard to do with computers. My second favorite are the math problems one. However if these become popular people will just write bots for them and were back to square 1.

> > Use self-hosted CAPTCHA with simpler solutions > My favorite CAPTCHA is the one on the Arch Linux forms but I realize this cant be used many places. > What is the output of "date -u +%V$(uname)|sha1sum|sed 's/\W//g'"? > Easy to do but hard to do with computers. My second favorite are the math problems one. > However if these become popular people will just write bots for them and were back to square 1. Interestin…

It would not be funny if even just one person ended up with that so I hope not. A bot would not end up in that situation anyways, either the earlier commands were already evaluated or your proposed remote kill would also not work.

Re: Google's Captcha in Firefox vs. in Chrome

#463

Post by frenchy » Tue, Jun 11, 2019, 7:03 AM UTC

tootahe45 wrote: post #305

Izkata wrote: post #204

Earlier quoted context omitted.

> 1) The images are so blurry and ambiguous it's really hard to get right, it feels like a test designed to make you fail On top of that, I think some of the training sets are wrong. Multiple times I've been asked to find traffic signs, but it would only let me pass when including street signs.

If you use Chrome or Brave you can get multiple boxes wrong and still get through i've found, even on a cheap VPN IP.

Here's a hint: VPNs do almost nothing to safeguard you from modern fingerprinting techniques. If you're using any browser [1] but Firefox or Safari, Google probably knows exactly who you are and is just doing the boxes for shits & giggles.

[1] except those that reCaptcha doesn't support.

Re: Google's Captcha in Firefox vs. in Chrome

#464

Post by tyler_larson » Tue, Jun 11, 2019, 7:05 AM UTC

yc12340 wrote: post #454

atombender wrote: post #434

Earlier quoted context omitted.

First, that's a bit user-hostile (and suddenly a DoS-vector; I can prevent a site's users from logging in by continuously firing bad password attempts). Secondly, botnets can, and presumably do, randomize which accounts they try, too.

So rate-limiting is "user-hostile", but permanently hell-banning someone because their network is considered "seedy" is user-friendly? Incidentally, you still need rate-limiting if you use Google's CAPTCHA. If you don't rate-limit CAPTCHA endpoint, an attacker can DDoS you (especially if your server-side captcha component uses low-performance single-threaded HTTP client). Furthermore, an attacker within the same AS a…

reCAPTCHA is a rate-limiting measure. Google handles all the heavy-lifting and attacker protection for you, and the slow fade you see in the video is that rate-limiting in action. But if you get a clean CAPTCHA result back from them, then that client is very unlikely to be an automated attacker. It's super easy and scales really well.

Conveniently, normal users with typical browser configurations get nothing but the animated checkbox. For nearly everyone, the whole experience is simple and easy. The only people who get inconvenienced are the low-grade privacy enthusiasts who think that preventing tracking is the path to Internet safety. Ironically, "tracking" is literally the mechanism by which legitimate users can be distinguished from attackers, so down that road lies a sort of self-inflicted hell for which the only sensible solution is to stop hitting yourself.

Re: Google's Captcha in Firefox vs. in Chrome

#465

Post by zrm » Tue, Jun 11, 2019, 7:10 AM UTC

matt-attack wrote: post #421

zrm wrote: post #323

Earlier quoted context omitted.

How hard would it be to create an alternative using GPT-2 or the like? Create a dozen models based on different things. Street signs, cats, houses, cars, etc. Then show the user a random selection of images generated from different models and say "select all the cats" and they get it right if they choose the images generated from the cat model.

To understand the depth and complexity of Captcha2 I highly recommend this: https://www.quora.com/Why-cant-bots-check-“I-am-not-a-robot”... Was posted on HN a while ago.

So the short version is that they try to fingerprint the user and then distinguish fingerprints that seem like humans from fingerprints that don't.

The interesting question then becomes how this is going to interact with future browser anti-fingerprinting measures whose purpose is to prevent just that.

Re: Google's Captcha in Firefox vs. in Chrome

#466

Post by [deleted] » Tue, Jun 11, 2019, 7:40 AM UTC

quwert95 wrote: post #235

As a developer who has worked with reCAPTCHA in the past and as a diehard Firefox user, what likely happened here is a form of shadow banning. You're moving too fast; your mouse and mouse clicks are "too good" to be human. Try solving the reCAPTCHA slower and you'll see wildly different results, or, purposely fail one reCAPTCHA to get easier ones. reCAPTCHA tech is crazy; reCAPTCHAs are not simple web forms and Javas…

[deleted]

Re: Google's Captcha in Firefox vs. in Chrome

#467

Post by achingtooth » Tue, Jun 11, 2019, 7:50 AM UTC

judge2020 wrote: post #112

dessant wrote: post #39

I was going through the same ordeal as a Firefox user, so I've made Buster to solve challenges and reclaim some of that lost time: https://github.com/dessant/buster If you're a developer, please consider replacing reCAPTCHA on your site with an alternative. reCAPTCHA discriminates against people with disabilities and those who seek privacy, and it gaslights you into thinking you did not solve the challenge correctly,…

The problem with recaptcha alternatives is that they either are insecure or require time and money to continue to be ahead of bots. All of the "interactive stand-alone approaches" from that page can be beaten with run-of-the-mill OCR (other than perhaps the 3d challenge) and with almost any mobile phone speech recognition engine (and, if the attacker has the money, can send it off to Google's cloud speech-to-text). A…

I don't doubt that it's far easier to abuse traditional captcha systems, but I wonder how wide spread that is. A while ago I did a test with securimage and tensorflow/python/opencv/keras after I read a Medium post. While it could solve captchas with a little distortion when I added squiggles, dots, and more distortion it was unable to solve the captchas. I'm sure you could spend more time and create a system that can solve these captchas, I wonder how much effort some random spammer will put in to attack your blog. Yandex uses traditional captchas, and they don't seem to have any issues.

Re: Google's Captcha in Firefox vs. in Chrome

#468

Post by tylerl » Tue, Jun 11, 2019, 8:18 AM UTC

grinsekatze wrote: post #270

michaelt wrote: post #149

Earlier quoted context omitted.

they're just discriminating against Firefox users? At least part of the behaviour shown in the video depends on factors like cookies, IP address, and whether you have features like anti-fingerprinting protection turned on. [1] Recaptcha is frustrating and I dislike it, especially the slow fade-ins and multiple challenges, but if you repeat the test shown in the video you won't find it 100% repeatable just because you…

I just wasted ~15 minutes on doing the disqus login captcha under different conditions .. turns out that as soon as uMatrix is enabled (and blocks 18 cookies from google.com and 5 more from www.google.com), it starts to act up and get annoying..at least for me. It then takes between 1 minute and 1 minute 30 to get past the recaptcha when blocking those cookies - and I was certain to be 100% correct in most cases and…

The fade thing is to rate limit attackers.

By blocking specific cookies you're making yourself look like a certain kind of botnet, so obviously you're going to have a difficult time convincing the site that you're a legitimate user.

Most users don't block normal cookies, so if you go tweaking the machinery that manages the relationship between your browser and the site, then be prepared to deal with a buggy experience. This is what it means when they say that what you're doing is "unsupported." Nobody is going to spend any time optimizing for your weird setup.

Re: Google's Captcha in Firefox vs. in Chrome

#469

Post by Aissen » Tue, Jun 11, 2019, 8:40 AM UTC

llao wrote: post #28

While relatable, this is just a low effort post more suited for Twitter or Reddit. For a fair comparison OP would need to use clean browser profiles on fresh IPs. Like this it is just fan-service for Google Captcha victims (like me).

That's a good idea for a research paper. Not something I'd OP though :-)

Re: Google's Captcha in Firefox vs. in Chrome

#470

Post by andromeduck » Tue, Jun 11, 2019, 9:02 AM UTC

piyush_soni wrote: post #452

MrMember wrote: post #327

Earlier quoted context omitted.

I've noticed the opposite on #2, especially in the last year or so. I've been solving a lot more captchas than I used to. I run Firefox with a lot of privacy focused add ons and I don't stay logged in to Google, I wonder if those have something to do with it.

Same here. When this highly advertized service was launched ('just a click!') it worked perfectly. Slowly, over the past couple of years, they deliberately replaced that wonderful service with another one where we act as Google's unpaid workers.

Captcha Data has been used to traon ML models for a very long time. What's changed recently is that simple stuff like OCR has already been solved and democratized so the simple puzzles no longer work.