Comment by mih | Hacker News Reader

Comment by mih | Hacker News Reader

I hope Firefox turns this option on by default. Overnight millions will face a hard time with reCAPTCHA and Google might be forced to sit up and take note. Fantasy aside, people will simply switch to Chrome-based browsers contributing to Firefox's dwindling market share. A win-win situation for Google.

Most Google products provide me services in exchange for tracking me, offering a reasonable compromise. With reCAPTCHA, they exploit me as an unpaid worker helping classify and train their ML algorithms, cost me time and wreck privacy leaving Google and the captcha hosting website as the only beneficiaries. Google in this case is more like a corrupt gatekeeper preventing you from entering the town. The town can employ more friendly options, but they don't care as long as the undesirables are kept at bay.

For those who have experience with using reCAPTCHA, is it so easy to setup and deploy that more and more sites are switching to them? Are there no decent non-exploitative alternatives which are tough on bots but solvable in reasonable time for humans without being a test of patience?

It really annoys me when companies I do business with make me do extra work for Google by employing reCAPTCHA.

It truly is pervasive now, and the likelihood of being asked to select crosswalks or store fronts or signals subjectively seems to be rising. I question whether that would be the same if I capitulated and used Chrome.

What would once be a certain no, I now question whether google is actively weaponizing reCAPTCHA in the new browser wars. After all, Chrome has such a large market share in the right places that I'd be surprised if the model didn't take into account user agent to determine non-automated users.

The worst pattern I'm seeing now is when login forms decide to add it after just one incorrect password attempt. I completely understand registration forms -- but login forms?

On the login form thing: it's to prevent easy brute force attacks

Isn’t it a bit lazy on the developers side ?

Limiting the number of errors before sending a link to reset your password (for example, I agree there might be different ways to deal with that) is no rocket science, and being dependent on third party for such a trivial thing is, in my opinion, a bad idea.

It really isn't trivial. Rate limiting is great, but not enough. If you lock people out after a certain number of failed login attempts, you allow an adversary to DOS your users by constantly trying to log in as them.

> It really isn't trivial. Rate limiting is great, but not enough.

Rate limiting alone isn't a solution. But it can be part of a solution that doesn't require reCAPTCHA.

> If you lock people out after a certain number of failed login attempts, you allow an adversary to DOS your users by constantly trying to log in as them.

That isn't how the pattern works. On next successful login you basically inform the user that they need to confirm it's them with an email token. It works well. ReCAPTCHA doesn't.

I didn't even consider that it would be different on Chrome, but I guess that is because nowadays users are supposed to be "logged into Chrome"?

I can only hope that firms will eventually figure out that reCAPTCHA is a bad user experience.

> I hope Firefox turns this option on by default.

Unfortunately, it has side-effects like disabling site-specific zoom levels[1], since it can be used as a fingerprinting mechanism.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1369357

Millions? Firefox will have less than 1% market share next year.

It really doesn't matter at all, especially now that even Edge is switching to chromium.

less than 1% next year, it was just less than 9%. Do you mean it will drop 8 percentage points in less than 1 month, or in 12 months? Even so I think you will find there is some core percentage it won't drop below as long as it is competitive with other browsers. I'm think at worst - 5%;

It is less than 9% of the desktop share, so around 5% if you take mobile into account.

Ok so a lot of that drop can be ascribed to a market rising in share of total browsers, and firefox having a lousy share of that market.

which I don't know what to do about that. I use an iphone and I see no benefit to getting FF on my phone, which I guess I would say is due to monopolistic behavior by Apple.

I mean, I just don't know how much people care about mobile browsers. I've never even considered switching away from safari on my phone? I don't really want any advanced features on a phone browser, I'm not running 20 tabs etc etc.

I could be the odd one out here - but whilst on desktop choice is fairly normal, web browser on a phone feels like a core OS tool. Realistically this is probably due to how shitty IE was, along with the enforced browser choice dialogs on Windows?

You have an iphone, so all your browsers are essentially Safari. The other features they may compete on are syncing to your desktop and stuff like that.

On android, Firefox Mobbile has uBlock Origin, whereas Browser, Chrome and any other one do not.

Anyone not using an ad blocker is out of their mind, especially on mobile; The simplest way to do that is Firefox Mobile + uBlock Origin.

How effective do you find uBlock Origin on mobile? I find that half the time elements don't get blocked. Disabling most JS using uMatrix seems to be more effective.

Very effective. Depends, of course, on the lists you select (I select most of the general and a few regional that are relevant to me) - and your tolerance to having to whitelist specific domains when things don't work. Mine is very high - and if you're a uMatrix user, it seems yours is too.

(I use uMatrix on the desktop, but only surf casually on mobile, so I find uBO sufficient).

Actually below 9% is just desktop market. If you include also mobile market, it's already below 5%..

Reply on news.ycombinator.com