Hacker News Reader

Comment by hawaiian | Hacker News Reader

ReCAPTCHA has crossed into the domain of cattle-corralling users and thus should be considered harmful. If the system decides it doesn't like you (most likely because you're "too anonymous," but you don't really know) you will be presented with slower-loading images to click and more click-all-the-things rounds. To pretend this is about slowing down bots is disingenuous as best. On top of that, usage of ReCAPTCHA perpetuates the very problems I just described.

Why isn't there a solid alternative offering yet?

View on HN

There should be an open source captcha solution where all the labeled images can be used to develop a model available freely to the public.

Y'know, this would be a great project for Mozilla, if they have the resources for it. They're already doing that crowdsourced voice training data thing.

I bet CloudFlare has the bandwidth for it.

And yet they use reCaptcha. I hit it all the time accessing sites when I was in France.

They also have great IP address reputation data

As if IP addresses are not shared. IPv6 isn't present enough.

and you don’t think that will be quickly used to make a tool to break the captchas?

No. You cycle through new types of challenges that the model can't solve yet.

For example, one week of stop-sign recognition, another week of pedestrian labeling, etc.

Building those models sounds like a lot of continuous and boring work, and is probably best done by a company. Unless you find some crowd-sourced way of building those models.

Exactly, see the other comment in response to mine. If Mozilla can do this for speech recognition, then we can do this for image recognition/transcription tasks.

>Why isn't there a solid alternative offering yet?

The latest version of recaptcha doesn't even prompt users. It loads on the front-end and uses a scoring system. It's likely you've used it but didn't even know because it's invisible.

It's the older implementations that have the slow loading images.

On Google Chrome, with adblock on, without my Google account signed in, in a new incognito tab with no extensions, I have the experience of it being invisible. When I go back to the same site on Firefox, logged onto my Google account, no adblock on, no privacy options on, I have to identify dozens of photos.

As far as I can tell, it just checks to see if your browser is Google Chrome to give you your score.

Again, that's still not the latest version of recaptcha, which never prompts users for photos.

If you use as blocking and privacy extensions or live in a "suspicious country" it's still slow loading and multiple pages of images.

Not really. Thats if the developers code it so that if you get a low score -> trigger images captcha (recaptcha v2)

Recatpcha v3 by itself NEVER shows anything to the user and its entirely up the application itself on how to deal with users who are likely to be bots (which also includes users with anti-fingerprinting measures)

Kicking """questionable""" users off the site entirely is not a "solid alternative".

This is just splitting recaptcha into two pieces and giving you the first half. Okay, fine, but it's the second half that was causing all the problems!

Because when you don't annoy 'too anonymous' users with obnoxious captchas, your service gets flooded with spam, which annoys every single other user.

> To pretend this is about slowing down bots is disingenuous as best.

I'm not sure you have a good understanding of what happens to internet services when they don't throttle spam. They become completely unusable.

ReCAPTCHA doesn't prevent the kind of spam that makes internet services completely unusable (i.e. DDoS botnets), it prevents form submition spam.

To be fair, spamming a user-submitted content site (for example, a blog with comments) is just as bad as a DDoS; either one makes the site unusable.

Most forum or blog comment spam I've seen was trivial to detect, even without access to the server. Isn't written in the right language? Very likely spam. Contains a link and little text? Very likely spam.

If you have access to the server's information, it gets even better. Origin makes it much easier to identify likely spam, previous interactions with the site and their speed ("hits the page and 1s later submits a comment") provide more info.

Sure, all of that can be worked around, but that makes it more complicated and increases the cost for the attacker. If they spend money on faking actual user interaction with your blog, routing all requests through a residential IP in your country etc pp, they are likely spending as much or more than they would on a recaptcha solving service.

I'd much rather have a service where I can submit a comment to check if it's meaningful or likely spam, than to force my users to waste time and share data with Google that they don't want to.

If clearly spam, block it, if clearly okay, allow it. If unsure, leave it for a moderator. It might even train users to write better comments if badly written ones need to wait for moderation.

As if that's not a complete privacy nightmare. I'm sure either the NSA, or an ad-tech agency would love to get a firehose feed of this sort of data, while providing you with a YES-SPAM/NO-SPAM service.

Also, anyone who mentions <something the service wants to censor> can be, of course, blackholed as spam. ;)

As long as it's a public forum, I don't see the issue. It's going to be public anyway, and they could easily scrape it if they want to.

The submission itself should be done by the site, so the user remains anonymous.

There's a lot of information that can improve spam classification, that is not publicly queryable.

Any spam detection engine that asks for that information will outperform ones that don't.

Reply on news.ycombinator.com