Hacker News Reader

Google's ReCaptcha has done a lot of harm to the Internet and is constantly used when it completely unnecessary (viewing a page? Submitting feedback when you're already logged into an account that you already did a captcha to make or login with?).

>Google CAPTCHAs have gone from asking the question "Are you human?" to "Which human are you?".

This is a good way to put it. I wonder if the Googlers that work on ReCaptcha are somehow able to convince themselves they're Making The World A Better Place, like most Googlers somehow manage to.

Hand on my heart: I've been in a very secure (national security) facility and witnessed someone struggling with Google's captcha thing for hours. They were trying to make a change in a system used for soldier's flights. 200+ Accounts needed a single number swapped on a form. 200+ google captures to solve. Nothing is as frustratingly pathetic as someone in uniform, a trained soldier, screaming about whether "traffic light" includes both sides of the hanging light.

Passwords, access cards, biometrics, hardened doors, guards carrying machine guns, rooms without numbers, and on the inside of all that: google captcha.

That's puzzling.

Were they accessing a secure government site that was serving CAPTCHAs?

Or were they accessing a public site from a government facility with browsers that were so locked down that they triggered CAPTCHAs?

The first would be kinda stupid. The second would be funny. Or tragic, I suppose.

Speaking as someone with some military experience, almost certainly the second. Military computers are locked down excessively, often in ways that are actually counter to real security. Policy is reactionary, and is all-too-often simultaneously too narrow and too broad (in orthogonal ways) which ends up impacting usability while not really adding any security.

Wasnt a military site. It was a civilian service's site, not a public site like travelocity, but one biult for use by government agencies.

What is a good alternative? I'm going to be looking I to our login system soon and have been meaning to read about the options

If there is no way for users to spam other users then there is no need for a captcha at all. Just add rate limiting and alerts to see if one user is using too much resources. If your users can disturb each other than the best solution is to make your system invite only and remove invite perms from anyone who is inviting bots or alternatively have some way where users must add other users as friends before they communicate using an external service so for example someone wants to add a friend they send an email with a friend code then you are using the existing anti spam system of whatever external system the user picks.

Maybe none of these are convenient for you but for some websites they work quite well. Invite only communities often have far less trolls and virtually no spam.

Even if this is true, the problem is that Google reCAPTCHA is way easier to slap on anything, and for the few hurdles it imposes it is very effective at stopping bots.

I'm not in a position to decide on a human verification mechanism, but I used to do WordPress and Drupal CMS work as a freelancer. The number of non-technical people setting up their own sites on these platforms vastly outnumbers the people who even are aware of some of the downsides to Google reCAPTCHA. Until the mechanisms you described implementing are as easy as installing a plug-in, Google reCAPTCHA is here to stay.

github has a good one

you can test it by trying to create a new account

its dead simple and looks to be pretty secure

you have to orient an object so that its not upside down

https://octocaptcha.com

EA use a variant of this for their FIFA app and it was legitimately the most frustrating CAPTCHA I've ever tried to solve. They overlaid several objects at the same time in an attempt to make it harder and it took me 9 minutes to solve them all. Example: https://imgur.com/a/x8x4amL

This is definitely easier. While I don't mind reCAPTCHA on many resources, commercial entities which charge money for you to use their products, should try to make the login process as easy as possible and reCAPTCHA isn't one of them, as at times you have to iterate several times of identifying all cross walks or store fronts.

Are there a fixed number of objects?

I'm more worried about the small state space. Even if there are many possible images, randomly guessing lets in 1/8 of the bots. Is there something to protect against this?

i found this but i dont know if it answers your question

https://blog.jscrambler.com/preventing-automated-abuse-with-...

In my experience, email verification gets you 99% of the way there.

Strategically-placed honeypot form fields get you to 99.5%.

I run a site that gets ~1.2 million visitors a month. YMMV.

Not sure you need to make sure the user is human on a log-in form. Just limit the number of attempts per day per account, perhaps with email verification to pass it.

At even small to moderate scales you will end up with legitimate users being locked out of their accounts en masse with this approach.

Well, most log-in forms do not have any captcha, so I wonder how they do it.

Meanwhile in developing nation's captcha work from home schemes are becoming quite common. Where for a few pounds day/dollars/euros a worker at home will identify 1000's of captcha. From my understanding it's popular work as mum's and those at home can do while caring for children.

I could be wrong, but I assume that Google mostly does this because of the huge amount of malicious garbage bot traffic on the web. Once you go fully anonymous and private, there's no way to distinguish you between the hordes of malicious traffic.

But there seems like there should be a technological solution. Google knows what a "legitimate" user looks like. Either because they come from a safe IP, or they're registered Google users, or they have a normal established browser history. But using your legitimate identify compromises your privacy, because then your IP/user-account can be correlated to your personal identity.

So, let's create zero-knowledge proof identity schemes. Using your legitimate, but non-private, identity you "register" an ephemeral, private anonymous identity. But it's done using zero-knowledge proof, such that Google has no idea about who a particular anonymous identity besides that it must belong to one of its several million legitimate identities.

>I could be wrong, but I assume that Google mostly does this because of the huge amount of malicious garbage bot traffic on the web. Once you go fully anonymous and private, there's no way to distinguish you between the hordes of malicious traffic.

What's "malicious" about simply opening a page on a website? Google bots are doing this all the time and they don't have to solve CAPTCHAs.

If your site is at all worth scraping, it will be scraped, republished and monetized by someone other than you.

Google plays the long game though. By setting themselves up for being the gatekeeper of bot traffic, any bot belonging to a competing search engine cannot possibly index the web as well as Google can.

I assume Google Recaptcha has a way to recognize its own Google Bots.

Isn’t that kind of an antitrust thing?

How does a good, non-Google not solve a Google Recaptcha?

> Isn’t that kind of an antitrust thing?

> How does a good, non-Google not solve a Google Recaptcha?

I'm not sure if it's antitrust, because I would imagine that website admins would _like_ Google to have access to their site while excluding others.

What people fail to realize, I think, is that if this practice had been common, something like Google would have never came to be in the first place! Imagine if websites blocked all but AskJeeves user agents from crawling them?

Just to be clear, I meant to say "a good, non-Google bot".

I would love for something like that to happen, and given all of the activity in the blockchain space, someone will probably come up with a clever solution. I just have a hard time imagining a motivation for Google to switch to using such a thing even if it were invented. They way it works now benefits them.

But even just looking at it from a purely technical perspective... If CAPTCHAs are intended to be "completely automated public Turing test to tell computers and humans apart", then its quite clear that they no longer accomplish this. I am a human and I can't pass. The model is wrong, build a better one.

>> If CAPTCHAs are intended to be "completely automated public Turing test

That's what google says the are for, but they aren't used that way by everyone. Many websites use them not to detect machines but to slow down the humans. They want to make something burdensome so they add the captcha. Maybe they want you to subscribe, pay money, to avoid it. Maybe they just want you to spend a few more seconds looking at of some banner ad. Or maybe including a captcha ticks a useless security box on some compliance form.

> If CAPTCHAs are intended to be "completely automated public Turing test to tell computers and humans apart", then its quite clear that they no longer accomplish this. I am a human and I can't pass. The model is wrong, build a better one.

Google’s CAPTCHA probably knows that you are a human, some of your answers are correct, and Google already uses the answers you give to improve its Maps offering like it always has. The fact that it still won’t let you pass is presumably a way of punishing you for trying to stay anonymous.

There are not. They are here to save money.

Although I provide no link to them. I believe I've read numerous articles and studies that even with generic anonymized data that many have been successful in deanonymozing the user behind the data.

Depending what they data is. It might take more points and samples but I think most people would be surprised how few data points you need before you can be identified.

Even from the most mundane things and especially if they have non anonymized data to compare or find you agaisnt

It somewhat exists: https://blog.cloudflare.com/cloudflare-supports-privacy-pass...

Google doesn’t implement it directly, but any CloudFlare powered website that shows you a Google Captcha because of CF is supported.

A resource for anyone interested in zero-knowledge cryptography: https://zkp.science/

>But there seems like there should be a technological solution.

Even if there was (there isn't) I wouldn't waste a single second thinking about or advocating for it. The only sustainable "solution" can come from Congress and it would look almost exactly like GDPR.

> But the biggest issue, is that Google's CAPTCHAs become unsolveable. I mean literally they wont let you pass. You will get served a large sequence of captchas. I've experienced up to 6 for a single verification. And not only do you get more, but they deliberately add an excruciatingly slow delay to each image. It can take 10-15 seconds to solve a single image set, and then you still need to do 5 more.

All of which is an obnoxious form of unpaid labor to train their AIs.

Add: It's nicely clever, and it should be appreciated if it advances technology as a whole by enabling self-driving cars etc. sooner, but I can't help but feel offended whenever going through its "hard mode."

I think at the absolute worst I've spent almost 10 minutes painstakingly walking through successive google CAPTCHAs before just giving up. The modern web is basically openly hostile to anonymity (or pseudo anonymity). That's one of those genies I don't see any way of putting back in the bottle : the privacy conscious consumer is just too small to matter at any kind of scale. They end up relegated to a niche set of tools and services (which ironically enough presents a neatly encapsulated attack surface for any malicious actors who might be interested in targeting these users).

Ultimately it may all be moot : we're slowly moving towards the point - still years or decades off, admittedly - when effective de-anonymization of the public internet will become a reality. For better or worse, I guess.

I had to use my own computer programs in order to be able to solve Google's CAPTCHAS!!!

Machines solve them much better than I do, way faster and way better.

And the most important thing, it does not frustrate or mentally exhaust me, like the thing does to people.

haha here's one better -- i am using the GOOGLE'S voice to text API to break their own audio captcha!!! so when people say that captcha is about stopping bots, they are wrong. as some of the top comments point out, from google's POV captcha is about enforcing personal identification and training AI.

There's also outsourced services that pay people to solve captchas all day, Mechanical Turk style. At this point I think they're a moral necessity, given that recaptcha will often flatly refuse to allow accessibility options for some users.

The google captcha's are starting to be unsolvable for me.

A shopping website is one thing, but the california dmv website https://dmv.ca.gov logs you into google when you use it, and google captcha is required to make an appointment, otherwise you get a cryptic "server unavailable" message.

OK, so Google CAPTCHAs using Tor can be almost impossible.

But using nested VPN chains, in a VM with a basic Firefox install with NoScript and an ad-blocker, I see hardly any CAPTCHAs. Sure, everything that I do is tracked and correlated. But it's just linked to a VPN exit IP, and a made-up persona. I actually go out of my way to link everything in this VM to Mirimir.

Just to clarify, I wasn't talking about using TOR in my post. I found a certain configuration of Firefox config settings and Add-ons which will fail every CAPTCHA on any site. This is without a VPN, from my home IP address, which I found bizarre as that should be more than enough to identify me uniquely.

And your solution is good. But its kind of ridiculous that we have to jump through hoops like that to stay private.

> I found a certain configuration of Firefox config settings and Add-ons which will fail every CAPTCHA on any site.

Could you share more specifics, please? Reading your comment, that really didn't sink in for me. And I wonder what you're blocking that Tor browser doesn't. And/or how Tor browser reduces CAPTCHA incidence.

It is ridiculous. But for me it's been a hobby. For over 20 years now ;)

Use Canvasblocker and enable all the settings.

The internet punishes anonymous browsing. Every site out there wants to track you. Across websites! Just imagine ordering a Big Mac at the McDrive. Suddenly a McDonald's employee walks out and puts a GPS tracker under your car. How would you respond?

Maybe try Canvas Defender instead. It serves a random canvas, and maybe that doesn't trigger so much.

Within a few years, I wouldn't be too surprised if they'll be printing GPS trackers on packaging ;)

> And not only do you get more, but they deliberately add an excruciatingly slow delay to each image. It can take 10-15 seconds to solve a single image set, and then you still need to do 5 more.

There's a GreaseMonkey script that eliminates this delay.

https://greasyfork.org/en/scripts/382039-speed-up-google-cap...

There's this paper that highlights the techniques (supposedly) including the fingerprinting: https://www.blackhat.com/docs/asia-16/materials/asia-16-Siva...

How about a browser / service that makes you pseudonymous instead?

This would probably be hard to do with canvas-based browser fingerprinting, but might work with the various other fields. Basically create a large pool of 'profiles' based on common browser settings, then assign one at random to clients.

Basically, make it look like thousands of users on the same machine.

>Google CAPTCHAs have gone from asking the question "Are you human?" to "Which human are you?".

Nailed it.

I'd love to see a CAPTCHA for identifying a business/feature in Mapillary imagery which can then be later verified and added to OpenStreetMap!

It is a real PITA when attempting to post to HN via AT&T LTE, same with clicking on any FB link from Google search results.

Huh? HN uses CAPTCHAs?

> But the biggest issue, is that Google's CAPTCHAs become unsolveable.

i've noticed the same... vicious.