Hacker News Reader

Comment by swalladge | Hacker News Reader

Google reCaptcha is one of the most pervasive nasty tracking devices because legitimate sites use it for its advertised spam protection without caring about anything else. Suddenly you have Google able to track you on Government sites (like opting out of myhealthrecord), Banks, Exchanges, and a myriad of others. I hate it because they make you choose between letting Google track you fully, letting Google track you only a bit and spend forever trying to solve the captcha (ie if you are logged out of google or have tracking protection on), or not using the service at all. :|

View on HN

It's also the single largest inhibitor to being able to use Tor on a daily basis.

I really like the idea of Tor and would like to use it as my daily driver. When I try, nearly every website I visit (thanks cloudflare) forces me to spend several minutes trying to solving recaptchas. Despite my best efforts at solving them correctly it usually takes several attempts.

I've written scripts that use the APIs of human-powered captcha solving services but even those can often take a couple minutes so I'm stuck sitting around waiting for a result.

I really wish recaptcha would die. I understand that they're intended to stop scrapers and bots (or at least it's marketed as such). I'd gladly pay a few satoshis to websites to bypass these things.

Yeah cloudflare is silently man-in-the-middling many websites too... Now imagine what could happen if, I don't know, there was some bug that leaked some of that sensitive information that cloudflare deals with throughout the entire web...

Even the UX of reCaptcha has seriously gone downhill recently. I wonder how many hours per week I spend clicking pictures of busses and traffic lights. I would rather pay than complete them at this point.

I wonder how many hours per week I spend clicking pictures

Where are you running into this problem. I spend an embarrassing amount of time online and I'd probably estimate that I average around 1 minute a month "clicking pictures"

Spend a day or two using Tor browser and you'll feel the pain that recatpcha causes real human users. It's beyond frustrating.

I do a lot of crypto trading, and many sites probably have the reCaptcha security set to max.

If you were to pay, then you'd have to enable Google cookies to know that you've made the payment. If you enable Google cookies for those sites then you don't have to deal with the reCaptcha (as much).

I'm not a huge privacy freak - I have the default cookie settings on all my browsers and I'm signed into multiple Google accounts. They know who I am. I can only suspect my adblocker could be blocking something there, but other than that I should be about a regular of a user as they come.

> make you choose between letting Google track you fully

It's not black and white. Turn off blocking when logging in and turn it off when you have the access cookie. Yes, it might be a tracking event, but you are not forced into having your privacy blockers turned off all the time for Google.

Thank the spammers and abusers

The point is that there are plenty of captcha services and self hosted captcha software libraries that don't leak information to Google.

Are they still the 'squiggly letters' solution or have done something better?

"Squiggly letters" are still fine. There's a lot of FUD around AI & ML breaking them but I have yet to find an off-the-shelf tool that can break them; and so do the spammers.

Sure, you might break them if you pay a team of computer vision scientists for a few months but that isn't profitable for spammers, so even though they are technically breakable, in practice they're still good enough to thwart spam & bruteforce.

Reply on news.ycombinator.com