481–490 of 503 posts
I was going through the same ordeal as a Firefox user, so I've made Buster to solve challenges and reclaim some of that lost time: https://github.com/dessant/buster If you're a developer, please consider replacing reCAPTCHA on your site with an alternative. reCAPTCHA discriminates against people with disabilities and those who seek privacy, and it gaslights you into thinking you did not solve the challenge correctly,…
Earlier quoted context omitted.
So rate-limiting is "user-hostile", but permanently hell-banning someone because their network is considered "seedy" is user-friendly? Incidentally, you still need rate-limiting if you use Google's CAPTCHA. If you don't rate-limit CAPTCHA endpoint, an attacker can DDoS you (especially if your server-side captcha component uses low-performance single-threaded HTTP client). Furthermore, an attacker within the same AS a…
reCAPTCHA is a rate-limiting measure. Google handles all the heavy-lifting and attacker protection for you, and the slow fade you see in the video is that rate-limiting in action. But if you get a clean CAPTCHA result back from them, then that client is very unlikely to be an automated attacker. It's super easy and scales really well. Conveniently, normal users with typical browser configurations get nothing but the…
"Be a good little sheeple and do what Big Brother Google says." Fuck no.
Earlier quoted context omitted.
It sounds funny but I don't get it. ReCaptcha doesn't identify you does it?
To the website? No. To Google? Almost certainly given how it works.
It seems like another way to punish people for caring about privacy.
I've never understood what happened to reCAPTCHA, it was originally so great and is now just so, so toxic. Originally it was an awesome solution based on OCR'ing books that usually worked quickly on the first try, and almost never took more than two. Then it turned into a single checkbox (analyzing mouse movement) so it was even faster... and I remember some simple image-based like "select the images of cats" that we…
Earlier quoted context omitted.
There's a third problem: quite a bit of the stuff they present is (almost) uniquely American and presents a recognition challenge in other cultural contexts. That yellow vehicle? Looks nothing like a bus in most other parts of the world. And so the rest of the world gets to learn what an American Bus looks like... Not, I think, what was intended.
I often get asked to identify store fronts. They are the worst. The pictures are blurry and positioned at weird angles. There are lots of signs with east-asian letters (I'm not informed enough to guess what kind of alphabet they belong to) and I have no idea wether they are store fronts or not. Is a sign to a dentist's office a store front? Generally it seems like anything with a sign above some sort of door or windo…
Earlier quoted context omitted.
Same here. When this highly advertized service was launched ('just a click!') it worked perfectly. Slowly, over the past couple of years, they deliberately replaced that wonderful service with another one where we act as Google's unpaid workers.
Captcha Data has been used to traon ML models for a very long time. What's changed recently is that simple stuff like OCR has already been solved and democratized so the simple puzzles no longer work.
Earlier quoted context omitted.
To the website? No. To Google? Almost certainly given how it works.
I can imagine that, if Google already knows enough about you, just clicking "I'm not a bot" would be enough. Though I wouldn't know. It seems like another way to punish people for caring about privacy.
Earlier quoted context omitted.
> Why make me solve a Captcha to see static content? Fair point, I usually run into this when using Tor, or VPN when accessing content behind Cloudflare, and or similar services. This is some anti abuse stuff, but is often overly agressive with giving you captchas. > Why make me solve a Captcha to log in when I've already completed one to register? So attackers cannot password spray. This is typically after attackers…
> Sound like a strange place to have a captcha indeed. What information is needed in the form to submit it? Does it validate stuff that an attacker might want to scrape? I guess they added it for a reason. In the past, I used curl to get some billing info, add the money to a dedicated virtual prepaid card, then pay the bill, then send an email to a gmail (+paidinvoice) label. These day, at least for my bills, they ha…
The measure is not really about protecting the user that is using the payment form, it is meant to "protect" the system that is validating the payment data. The payment form may be a target for attacker which has gotten a large batch of credit cards from somewhere else, and wants to validate the data. They then regularly exploit such forms, or other naive payment system to check if the credit card data is valid.
CandyJapan owner wrote some blog posts about the subject.
https://www.candyjapan.com/behind-the-scenes/how-i-got-credi...
https://www.candyjapan.com/behind-the-scenes/candy-japan-hit...
https://www.candyjapan.com/behind-the-scenes/fraudulent-tran...
Earlier quoted context omitted.
So I can lock you out of your account with 3 attempts from any IP address?
For a minute usually. Prevents flooding. Not a bad approach unless the account is constantly hit. In those cases two factor auth makes sense.