Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's Captcha in Firefox vs. in Chrome

grumpy.website

Post reply on HN
Print view View original

471–480 of 503 posts

Re: Google's Captcha in Firefox vs. in Chrome

#471

Post by themacguffinman »

ClassyJacket wrote: post #380
themacguffinman wrote: post #312

Earlier quoted context omitted.

I'm sure there's room for improvement but at some point this is paradoxical. Users who want data privacy want their presence and behavior obfuscated, which is fundamentally opposed to anti-fraud systems which are designed to analyze the presence and behavior of users to determine if they are fraudulent.

The way recaptcha happens to work now, and its purported goal - to differentiate humans from bots - are two different things. Privacy is not fundamentally opposed to anti-fraud in the slightest.

I said that privacy is fundamentally opposed to anti-fraud systems, not the general concept of anti-fraud. To an automated anti-fraud system, there is no difference between a user who obfuscates their identity because they want privacy and a bot who obfuscates its identity because it doesn't want to be revealed as a bot.

Re: Google's Captcha in Firefox vs. in Chrome

#472

Post by Dylan16807 »

therein wrote: post #444
Dylan16807 wrote: post #386

Earlier quoted context omitted.

> So attackers cannot password spray. My password's not crackable, so it's annoying to be lumped in to that. I'd happily use a service-generated password to avoid login hassles.

I imagine what you are proposing then is to record the entropy on the password when you first register and for accounts with sufficient password entropy to not ask for a captcha after few failed attempts. With that, the site gives away whether the account has a low entropy password or not.

> With that, the site gives away whether the account has a low entropy password or not.

Sure, why not? Way more than half of passwords are low-entropy, so that doesn't meaningfully help them focus attacks.

And they still have to keep solving captchas to make those attempts.

Re: Google's Captcha in Firefox vs. in Chrome

#473

Post by Kaiyou »

doomglobe wrote: post #415
robin_reala wrote: post #366

Earlier quoted context omitted.

UK Gov doesn’t allow CAPTCHAs on central gov services: https://www.gov.uk/service-manual/technology/using-captchas

They can still use them if they meet certain criteria, and show that they 'need' them. The overuse probably comes from the incentive - Google is incentivized to encourage the use of captcha because it is curating a data collection for ai training. I imagine some of the 'gaslighting' that people experience is when they are given images that don't yet have a confidence rating high enough. I wonder if answering incorrec…

It will let you through eventually, even when intentionally selecting wrong fields, when you do it often enough.

Re: Google's Captcha in Firefox vs. in Chrome

#474

Post by mcv »

judge2020 wrote: post #112
dessant wrote: post #39

I was going through the same ordeal as a Firefox user, so I've made Buster to solve challenges and reclaim some of that lost time: https://github.com/dessant/buster If you're a developer, please consider replacing reCAPTCHA on your site with an alternative. reCAPTCHA discriminates against people with disabilities and those who seek privacy, and it gaslights you into thinking you did not solve the challenge correctly,…

The problem with recaptcha alternatives is that they either are insecure or require time and money to continue to be ahead of bots. All of the "interactive stand-alone approaches" from that page can be beaten with run-of-the-mill OCR (other than perhaps the 3d challenge) and with almost any mobile phone speech recognition engine (and, if the attacker has the money, can send it off to Google's cloud speech-to-text). A…

> The problem with recaptcha alternatives is that they either are insecure or require time and money to continue to be ahead of bots.

You're posting this in response to an automated recaptcha solver. Clearly recaptcha also has trouble staying ahead of bots.

It seems to me that any simple automated test at the entrance is inevitably going to be easy to solve by bots, especially when it's a one-size-fits-all test like recaptcha, so bots have only a single target to aim at. A small-scale unique test will be more successful simply for that reason.

But it seems to me that the better way than to ban bots together with humans who fail to pass your Turing test, is to check for the behaviour you want. If you don't want spam, have a system to recognise spamming behaviour, rather than traffic lights.

Re: Google's Captcha in Firefox vs. in Chrome

#475

Post by _khau »

skybrian wrote: post #292
AYBABTME wrote: post #288

Earlier quoted context omitted.

Not sure why you're downvoted, it's a valid point. It feels icky to use a service that you pay for, and incidentally provide free labor to Google's AI which they resell in Google Cloud as a walled garden. The result of reCaptcha isn't public as far as I can tell, and humanity probably doesn't get a net benefit from Google's monopoly on AI anymore.

People talk about "free labor" and forget all the times they were able to do Google searches or use Google Maps for free. It seems rather ungrateful? This isn't a one-sided relationship, both sides benefit.

This is simple corporate sycophancy.

Re: Google's Captcha in Firefox vs. in Chrome

#476

Post by Kaiyou »

LaGrange wrote: post #443
basilgohar wrote: post #431

Earlier quoted context omitted.

By the account. 3 failed login attempts in a row, and you disallow further logins for 30 seconds. This should waste less time than reCAPTCHAs. I know it's not 1:1 in terms of pros/cons, but it gets a good subset of the advantages without the key disadvantages mentioned above.

> By the account. 3 failed login attempts in a row, and you disallow further logins for 30 seconds. ...congratulations, I just locked out all of your users. Have a nice day.

How did you get the email addresses of all my users, which are used as login name?

Re: Google's Captcha in Firefox vs. in Chrome

#477

Post by addicted »

josefresco wrote: post #276
mikro2nd wrote: post #195

Earlier quoted context omitted.

There's a third problem: quite a bit of the stuff they present is (almost) uniquely American and presents a recognition challenge in other cultural contexts. That yellow vehicle? Looks nothing like a bus in most other parts of the world. And so the rest of the world gets to learn what an American Bus looks like... Not, I think, what was intended.

That hasn't been my experience. Most of the "storefronts" are (from what I can tell) based on Asia. I almost never see English signs. I'm still able to complete these challenges with only a little bit of difficulty.

Because it’s still created in an entirely American context. For example, the word storefront is an Americanism. The more commonly used word in the UK is shopfront, and in other English speaking countries they may just call them shops or stores, without the addition of the word front.

Re: Google's Captcha in Firefox vs. in Chrome

#479

Post by mcv »

Kaiyou wrote: post #473
doomglobe wrote: post #415

Earlier quoted context omitted.

They can still use them if they meet certain criteria, and show that they 'need' them. The overuse probably comes from the incentive - Google is incentivized to encourage the use of captcha because it is curating a data collection for ai training. I imagine some of the 'gaslighting' that people experience is when they are given images that don't yet have a confidence rating high enough. I wonder if answering incorrec…

It will let you through eventually, even when intentionally selecting wrong fields, when you do it often enough.

So frustrated people give up, but tireless bots will get through? That sounds like the exact opposite it's supposed to accomplish.

Re: Google's Captcha in Firefox vs. in Chrome

#480

Post by dbbk »

netcraft wrote: post #399
x3sphere wrote: post #216

Earlier quoted context omitted.

reCaptcha v3 works well for me. There are no challenges anymore and it just gives you a score based on whether it thinks the user is a bot/spammer, then you can do whatever with that. Personally if the score is low enough I just place the user in a restricted user group that needs approval on certain site actions.

Was just looking into using v3 today. Can you share what you consider to be low enough? I haven't seen any guidance on thresholds

Google recommends 0.5 as a default threshold, and you can then tweak it based on your analysis of the scores in the dashboard.
Post reply on HN