Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s new reCAPTCHA has a dark side

fastcompany.com

Post reply on HN
Print view View original

81–90 of 566 posts

Re: Google’s new reCAPTCHA has a dark side

#81

Post by oil25 »

ulfw wrote: post #57
superasn wrote: post #24

There are a lot of sites that are totally unusable on Firefox regardless how much you use ff. I do all my mobile browsing on FF yet when I try to use some websites I always get this Recaptcha failed error(1) while it works flawlessly on chrome though I never use it often. Try it, maybe it will happen for you too. Same happens on most sites which show you that "checking your browser" page via cloudflare too. The web i…

It's even worse when you're running a VPN (especially one of the major public ones). When I see reCAPTCHA I basically give up as sometimes I have to go through 6 or 7 full sets to be let into a site. It's the evil of the internet this.

reCAPTCHA on VPN is difficult, but on the Tor network, they are downright impossible. I've never been able to get past it, even after a few dozen painful attempts. That means Google services are entirely off-limits over Tor, even Search, which is a disgrace.

Re: Google’s new reCAPTCHA has a dark side

#82

Post by Theodores »

I had to test a simple contact form implementation with reCAPTCHA yesterday on an office worker's PC that was running Chrome.

I spent all day clicking on sidewalks ans traffic lights! Or buses. No idea what they want the clicks on buses for.

I actually had problems upstream of the CAPTCHA. This was on a Wordpress site and I was patching up the Contact Form 7 implementation on there.

What shocked me was how naff Wordpress is. After however many years it does not come with a contact form built in. Comments yes, but a contact form, no. Then the fairly de-facto Contact Form 7 would not work with Google Captcha 3 and the latest V5 Wordpress. So there must be hundreds of sites out there with contact forms that do not work. Then there are people cussing ReCaptcha when there is this hideous mess of bloat going on.

The Contact Form 7 didn't even use HTML5 form validation and styling it was a nightmare.

I eventually went to CAPTCHA2 with the box you tick. Having the v3 box in the bottom right of the screen on every page was not what the client wanted. Plus it didn't work with this kludge known as Wordpress.

I think the issues raised in the article are not that big a deal. If you have logged in to Chrome and you are on your normal device and IP address then you can get a free pass. Why not?

I seriously advise anyone to test their implementations on a non-logged in PC, it is an eye opener. And a time consumer. But forms have to be made to work. You can't have people locked out.

There is a lot to be said for backend validation based on form data, I like to make forms unique with a hidden timestamp in it that is MD5 encoded. You can then see if someone has spent long enough on the form for it to be 'real'.

Re: Google’s new reCAPTCHA has a dark side

#83

Post by quickthrower2 »

superasn wrote: post #24

There are a lot of sites that are totally unusable on Firefox regardless how much you use ff. I do all my mobile browsing on FF yet when I try to use some websites I always get this Recaptcha failed error(1) while it works flawlessly on chrome though I never use it often. Try it, maybe it will happen for you too. Same happens on most sites which show you that "checking your browser" page via cloudflare too. The web i…

That image link is protected by cloudflare too! Irony intended?

Re: Google’s new reCAPTCHA has a dark side

#84

Post by SquareWheel »

ceejayoz wrote: post #55
SquareWheel wrote: post #52

Earlier quoted context omitted.

reCaptcha isn't able to read your non-Google cookies or history, so most of that isn't being considered.

I was under the impression sites using Google Analytics were included as a reCaptcha signal.

The signals aren't documented (for obvious reasons), but I'd be surprised if Google Analytics were a signal. These things are usually kept separate, and Analytics is a lot less user-specific under GDPR as the anonymizeIP flag is now very common.

That said, I've no evidence one way or the other!

My understanding is that it comes down to information they can read about your browser (does this look like a bot environment?), and heuristically how the user has behaved since the JS has been loaded (mouse movements, time between actions, etc).

Re: Google’s new reCAPTCHA has a dark side

#85

Post by lucb1e »

cbsks wrote: post #5

You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor... I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does. Edit: I also got 0.7 on Firefox with st…

This looks like a RNG: I got 0.7, 0.9, and 0.1 successively. It can't make up its mind whether I'm almost certainly not a bot (0.9) or almost certainly a bot (0.1)?

Re: Google’s new reCAPTCHA has a dark side

#86

Post by oil25 »

quickthrower2 wrote: post #83
superasn wrote: post #24

There are a lot of sites that are totally unusable on Firefox regardless how much you use ff. I do all my mobile browsing on FF yet when I try to use some websites I always get this Recaptcha failed error(1) while it works flawlessly on chrome though I never use it often. Try it, maybe it will happen for you too. Same happens on most sites which show you that "checking your browser" page via cloudflare too. The web i…

That image link is protected by cloudflare too! Irony intended?

The sad and depressing state of the Web in 2019: proprietary third-party JavaScript and cookies are required to view a simple, innocent JPG.

Re: Google’s new reCAPTCHA has a dark side

#88

Post by lostlogin »

jermaustin1 wrote: post #45
cbsks wrote: post #5

You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor... I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does. Edit: I also got 0.7 on Firefox with st…

What is most odd is I get 0.7 on iOS Safari which I use for 100% of my purposeful mobile browsing, but I get .9 on iOS Chrome, which is only used when I accidentally click on links from gmail (so very, very rarely).

It seems a lot is iOS users get 0.7.

Re: Google’s new reCAPTCHA has a dark side

#89

Post by xahrepap »

cbsks wrote: post #5

You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor... I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does. Edit: I also got 0.7 on Firefox with st…

I get .9 in Firefox on my MBP with UBlock Origin installed. I wondered if it was because I was logged in to Google, so I tried Incognito and got .7. In a never-before-used container I also get .7.

Re: Google’s new reCAPTCHA has a dark side

#90

Post by LinuxBender »

flixic wrote: post #78
LinuxBender wrote: post #58

So this is probably a bit off topic, but why don't more site owners just create their own unique anti-spam system? In my opinion, if they were simpler, yet all unique, there would be less bots that could mass spam and privacy would be improved. Even something as simple as a question: "How many legs does a spider have?" ____ And then cycle through different types of free form questions of things that most people shoul…

Most sites use reCAPTCHA to protect against bot registrations, sometimes targeted to their specific registration system. Any simple solution would defeat the purpose of a CAPTCHA.

Would it though? If each system was unique and rotated through different types of challenges, the bot would have to be custom tailored to handle every challenge type.

i.e. free form questions, count the gray dots (vision impaired friendly), math questions, play tic-tac-toe and get a stalemate, ascii hang-man ... I could think of hundreds of different challenges. The bot would have to constantly adapt and the bot developer would have to really love puzzles. The bot consumers would have to update constantly and would have to learn all the challenges of each site owner.

As a bonus, google the all knowing, is less knowing and no longer a gate-keeper.

Post reply on HN