Google's Captcha in Firefox vs. in Chrome • Hacker News Board

Re: Google's Captcha in Firefox vs. in Chrome

#491

Post by DownGoat » Tue, Jun 11, 2019, 2:40 PM UTC

userbinator wrote: post #418

DownGoat wrote: post #290

Earlier quoted context omitted.

> Why make me solve a Captcha to see static content? Fair point, I usually run into this when using Tor, or VPN when accessing content behind Cloudflare, and or similar services. This is some anti abuse stuff, but is often overly agressive with giving you captchas. > Why make me solve a Captcha to log in when I've already completed one to register? So attackers cannot password spray. This is typically after attackers…

So attackers cannot password spray. This is typically after attackers has gotten access to the latest database breach, and are just blindly trying username/password combinations. A simple ratelimit takes care of that. Plus, it's not like attackers would be easily defeated by a CAPTCHA anyway --- there are services selling batches of valid tokens, likely generated by actual humans or very close emulations thereof, for…

CAPTCHA is not a fool proof, it is just the first layer in of defence in the signup/login form. CAPTCHAS increases the cost of password spraying, attackers can't simply fire up Hydra. They'll need additional tools and services which costs money.

Captcha solving service also has other costs than just the money it costs. It adds time costs and additional resource usage on the machines it is running on. A quick look at a service[1] shows that the average response for a challenge was 40 seconds (this value changed a lot when refreshing the page). The attacker has now gone from the 200ms range per attempt to several seconds, slowing the down a lot. This gives defenders additional time to respond, it is also a useful metric for detecting malicious logins.

[1] https://anti-captcha.com/mainpage

Re: Google's Captcha in Firefox vs. in Chrome

#492

Post by threezero » Tue, Jun 11, 2019, 3:06 PM UTC

vageli wrote: post #426

threezero wrote: post #242

Earlier quoted context omitted.

EU may end up dealing with it, they need complaints first. You’d be amazed how few people fill out complaints with the government. I just filed a complaint about this with the US department of justice antitrust division, feel free to do so as well so they realize how abusive this is!

> EU may end up dealing with it, they need complaints first. You’d be amazed how few people fill out complaints with the government. I just filed a complaint about this with the US department of justice antitrust division, feel free to do so as well so they realize how abusive this is! How do you go about filing this complaint? I'm sure many others (myself included) are interested

Here’s the page with the instructions: https://www.justice.gov/atr/report-violations In this case, I let them know that Google was using their position as the market-dominant browser company to make it more difficult for consumers to use alternative browsers by making captchas much harder to use on alternative browsers. I explained what a captcha was and how it affected me as a consumer using Firefox.

Re: Google's Captcha in Firefox vs. in Chrome

#493

Post by Macross8299 » Tue, Jun 11, 2019, 3:40 PM UTC

crazygringo wrote: post #170

I've never understood what happened to reCAPTCHA, it was originally so great and is now just so, so toxic. Originally it was an awesome solution based on OCR'ing books that usually worked quickly on the first try, and almost never took more than two. Then it turned into a single checkbox (analyzing mouse movement) so it was even faster... and I remember some simple image-based like "select the images of cats" that we…

I believe even worse than showing you new sets of images is when the reCAPTCHA system gives you a "low trust score" and intentionally fades out the selected images, but very slowly, and replaces them with new images of the same type. Just downright feels abusive to the end user. Good luck if if you have tweaked any browser settings to be more amenable to privacy!

I wish more sites would implement a Jigsaw-puzzle-style similar to the Binance login captcha, but I can't speak to the efficiency of that in defeating bots.

Re: Google's Captcha in Firefox vs. in Chrome

#494

Post by chrismeller » Tue, Jun 11, 2019, 4:25 PM UTC

notacoward wrote: post #486

simongr3dal wrote: post #275

Earlier quoted context omitted.

I often get asked to identify store fronts. They are the worst. The pictures are blurry and positioned at weird angles. There are lots of signs with east-asian letters (I'm not informed enough to guess what kind of alphabet they belong to) and I have no idea wether they are store fronts or not. Is a sign to a dentist's office a store front? Generally it seems like anything with a sign above some sort of door or windo…

Came here to say the same thing. It's literally impossible to distinguish a store from any other kind of business in many of those pictures. If Google wants to do behavioral fingerprinting they should just say so instead of pretending to do image recognition. But I guess some people just lie so much that they forget how to tell the truth.

What makes you think any store is not a store front? I realize that’s part of the problem, I’m just wondering why you wouldn’t assume the very literal “it is the front of a store” interpretation.

Re: Google's Captcha in Firefox vs. in Chrome

#495

Post by BuckRogers » Tue, Jun 11, 2019, 4:47 PM UTC

dessant wrote: post #39

I was going through the same ordeal as a Firefox user, so I've made Buster to solve challenges and reclaim some of that lost time: https://github.com/dessant/buster If you're a developer, please consider replacing reCAPTCHA on your site with an alternative. reCAPTCHA discriminates against people with disabilities and those who seek privacy, and it gaslights you into thinking you did not solve the challenge correctly,…

I just wanted to say thanks for posting this. I installed your addon when I first read the HN comments yesterday, and looking forward to testing out your work. It looked great!

Re: Google's Captcha in Firefox vs. in Chrome

#496

Post by notacoward » Tue, Jun 11, 2019, 5:47 PM UTC

chrismeller wrote: post #494

notacoward wrote: post #486

Earlier quoted context omitted.

Came here to say the same thing. It's literally impossible to distinguish a store from any other kind of business in many of those pictures. If Google wants to do behavioral fingerprinting they should just say so instead of pretending to do image recognition. But I guess some people just lie so much that they forget how to tell the truth.

What makes you think any store is not a store front? I realize that’s part of the problem, I’m just wondering why you wouldn’t assume the very literal “it is the front of a store” interpretation.

A commercial building with a sign on it might not be a store. They didn't ask for officefronts or warehousefronts. What about a bank or brokerage? A dental office or urgent-care center? Those can look a lot like storefronts, but whether they're considered such is pretty arbitrary.

Re: Google's Captcha in Firefox vs. in Chrome

#497

Post by [deleted] » Tue, Jun 11, 2019, 6:27 PM UTC

tomxor wrote: post #419

mikro2nd wrote: post #195

Earlier quoted context omitted.

There's a third problem: quite a bit of the stuff they present is (almost) uniquely American and presents a recognition challenge in other cultural contexts. That yellow vehicle? Looks nothing like a bus in most other parts of the world. And so the rest of the world gets to learn what an American Bus looks like... Not, I think, what was intended.

Totally this, I'm British and am probably more exposed to american culture than other nationalities on average, and yet recaptcha still sometimes leaves me clueless on some americanism, that is when it's not driving me crazy with it's infinite loop. For other nationalities it must be straight up discrimination. I sometimes wonder if these projects are actually internal astroturfing, someone trying to make people hate…

[deleted]

Re: Google's Captcha in Firefox vs. in Chrome

#498

Post by antisemiotic » Tue, Jun 11, 2019, 9:46 PM UTC

crazygringo wrote: post #170

I've never understood what happened to reCAPTCHA, it was originally so great and is now just so, so toxic. Originally it was an awesome solution based on OCR'ing books that usually worked quickly on the first try, and almost never took more than two. Then it turned into a single checkbox (analyzing mouse movement) so it was even faster... and I remember some simple image-based like "select the images of cats" that we…

>Originally it was an awesome solution based on OCR'ing books that usually worked quickly on the first try, and almost never took more than two.

People kept trolling it by typing the test word correctly, and random garbage instead of the OCR word. It was easy to spot which one was which. Source: I was one of these people.

Re: Google's Captcha in Firefox vs. in Chrome

#499

Post by collinmanderson » Wed, Jun 12, 2019, 1:42 PM UTC

dmitrygr wrote: post #321

fasthandle wrote: post #85

Earlier quoted context omitted.

reCAPTCHA also just doesn't work in the most populous country in the world. translate.google.cn does, but Google's reCAPTCHA does not. This is a big pain point. Thanks for the link to turingtest, I will certainly test it.

reCaptcha works just fine in India. It does have some troubles in the world's second most populous country.

Source for India being most populous?

All sources I can find say that population of China is bigger than India.

Re: Google's Captcha in Firefox vs. in Chrome

#500

Post by chrismeller » Wed, Jun 12, 2019, 3:16 PM UTC

notacoward wrote: post #496

chrismeller wrote: post #494

Earlier quoted context omitted.

What makes you think any store is not a store front? I realize that’s part of the problem, I’m just wondering why you wouldn’t assume the very literal “it is the front of a store” interpretation.

A commercial building with a sign on it might not be a store. They didn't ask for officefronts or warehousefronts. What about a bank or brokerage? A dental office or urgent-care center? Those can look a lot like storefronts, but whether they're considered such is pretty arbitrary.

I understand where you’re coming from and I’m having difficulty explaining the difference... it mostly comes down to what you consider a store (or a shop or whatever you call it). I know they could localize it more, but I feel like it should be pretty obvious what they’re talking about - a place of business selling good to the general public. Whatever you call that, banks and dentists and warehouses and medical facilities don’t really apply.

So yes, it’s arbitrary, but it’s supposed to be. It’s about your gut feeling as a human because that’s the whole reason they’re showing you any of these images.

If it “looks a lot like” a storefront then you’ve really got the same problem as everyone else in the comments: they’re small, blurry, images and it’s hard to tell what it is. That’s also the whole point: their algorithms can’t tell, so they want a general consensus from users. There are images they know and use as a control, but some percentage of the ones you see they’re legitimately not sure about.