Hacker News Reader

Comment by webmobdev | Hacker News Reader

What many commentors here don't realise is that Google also uses reCaptcha to make you do free work for them.

I think people realize that, but is it much worse than proof of work that is helpful to nobody? It's easy to take a position against Google and Recaptcha. It's easy to take a position against something that inconveniences you.

What people actually don't seem to realize ITT is that abuse is becoming so easy and such a problem that we are becoming increasingly reliant on centralized services like Cloudflare and Google.

You used to be able to just generate your own captcha on the server with simple libraries, but Xrumer (mass website-spamming software) could crack those 10 years ago.

I'd like to see more comments addressing the ever-lowering barrier of online spam/abuse instead of opting for the low hanging fruit of condemning people for trying to save their websites/platforms from it.

I liked the idea when they just showed images of words that an OCR couldn't read accurately.

But now all this damn clicking of hydrants, crossing, traffic lights, store fronts, vehicles etc. etc. is becoming really irritating.

And no, I disagree that we have no option but to rely on "centralised" services like cloudfare or Google.

> I liked the idea when they just showed images of words that an OCR couldn't read accurately.

Like I said, popular spamming software like Xrumer could crack those captchas ten years ago.

> And no, I disagree that we have no option but to rely on "centralised" services like cloudfare or Google.

Can you pitch alternatives, though? For example, an attacker can still spoof IP addresses in 2019 and create volumetric attacks that you certainly cannot endure without someone's help upstream (i.e. centralization). No need to bother with spoofing though since you can rent a botnet for peanuts. Attackers have decentralized attacks but there is increasingly only centralized defense.

In my mind the answer is in building decentralized apps/services.

A DDoS on a static site cached on just about any CDN that runs logic exclusively on the client is much harder to pull off successfully because it's so much cheaper (practically free?) to mitigate, and doesn't affect any existing users who would already have the necessary resources cached locally.

I thought that until my sites behind AWS' CloudFront were repeatedly DDoSed and I saw my bill.

AWS did let me report these DDoSes and they would reimburse me, but it felt wayyy too precarious and I ended up switching to Cloudflare (free).

And I think that should worry us all.

Also, only the most trivial sites can be 100% cached. And those are the sites who need Recaptcha the least (or need a server to get a challenge from). Abuse is not a simple issue to solve.

If Google created captcha service for dataset, Uber, Facebook, Toyota, etc, could also create one too.

Uber business case: driverless cars. Users who are already uber users can bypass it.

Facebook: can sell datasets. Can authenticate users. I wonder if fb is used on more sites than Google?

Toyota: Aside from driveless, they would have a weak case but case nonetheless for starting a captcha service.

> I think people realize that, but is it much worse than proof of work that is helpful to nobody?

It pollutes the original intention with a different goal. Is the goal to easily distinguish between bots and humans, or is the goal to trick people into doing free classification work for Google? Different intentions lead to different incentives which may lead to different results.

My first reaction to your comment was that I would be pretty shocked if anyone here didn’t realize that, and wouldn’t you know I have now read more of the comments and here I am shocked.

The idea that this problem results from heightened security measures is wrong, but it’s not laughable; it’s just sad.

Whenever I browse with the TOR browser, it's been 100% impossible for me to verify myself as a human even if all my answers are correct. I think they need to fix this bug, or at least give a message that the CAPTCHA won't be solved so we no longer waste our time.

Their No CAPTCHA's are very rare for me when I'm browsing logged in to my personal google account under the same session, on a normal browser.

They can be confident I'm not some kind of a bot, yet they still require me to solve on average two different tests to train their "AI".

Oh wow, yeah I use FF with uBlock Origin and they are not short by any means.

An aside from the corporate dystopia at hand: I do not know as much as I wish about how this works, but am intrigued at how the objects so often bleed into other “boxes” at just the right amount to demand multitudes more cognitive energy to negotiate with myself over what side of this false binary to place my bets on.

Back to corporate dystopia, my awareness of the procedure and intent is so blackboxed that I feel like a mule. Since I started approaching them with sloppy selection and minimal to no discern, I’m doubtful that the length of the challenge has any correlation with a measurement of suspicion at all. Rather, those liable to be this considerate will similarly recognize identify the wrath the cookie monster.

> Whenever I browse with the TOR browser, it's been 100% impossible for me to verify myself as a human even if all my answers are correct

Consider this a canary that Tor is working as intended. If you get past Captcha on Tor, to me that is a sign something is terribly amiss.

Proving one is human takes human effort. Given that, I'd rather do something marginally useful than something completely pointless.

It would be cool if they released the gained data as open source, but that might compromise the service, and I guess someone has to develop and host this thing, so keeping it to themselves is fair enough.

The only issue is the conflict of interest (they benefit from giving me more captchas), but they don't seem to be abusing it for that end. They sure abuse their position of power by hellbanning you when they suspect foul play, but I doubt that it's because they want you to do more work.

The problem is that as soon as you're getting value from users solving captchas, there's an incentive to show them more captchas to solve before accepting that they're human.

From the post:

> The only issue is the conflict of interest (they benefit from giving me more captchas),

Can you elaborate on this? What work are people actually doing for Google when they complete these awful captchas?

On any level, the data represents an average product of human visual calculation. A simple use case would be comparing that with the product of machine visual calculations to better understand and optimize the systems they are designing.

I believe the "read this hard-to-read text" ones are helping machines read text, the "is this a street sign" ones are helping machines drive cars.

The older captcha with words was for the digitization of books. It helped in the Google Books, and Internet Archive projects notably.

https://cogdogblog.com/2013/12/recaptcha-all-the-books/

The current one helps in identifying and navigating streets, useful for maps and autonomous driving.

https://techcrunch.com/2012/03/29/google-now-using-recaptcha...

You'll notice that recaptcha always has a direct effect on current projects of Google/Alphabet: Google Books, Google Maps, Waymo.

Incidentally, it's a mystery to me why so many of the Gutenberg/Internet Archive books have such ludicrously bad plain-text renderings, utterly unusable/unreadable, with often barely one word correct per page - since neural nets have been getting very high scores on MNIST handwriting recognition (for example) for a long time now, maybe since the 90s? It's a shame.

Reply on news.ycombinator.com