Google’s new reCAPTCHA has a dark side | Hacker News Reader

Google’s new reCAPTCHA has a dark side

fastcompany.com

1,091 pointsProAm542 comments

Google has been doing the same with reCAPTCHA v2 [1]. They are aware of the legal risk of outright blocking users from accessing services, so reCAPTCHA v3 contains no user facing UI, Google merely makes a suggestion in the form of a user score, so the responsibility to delay or block access and the legal liability that comes with it falls on websites.

reCAPTCHA v2 is superseded by v3 because it presents a broader opportunity for Google to collect data, and do so with reduced legal risk.

Since reCAPTCHA v3 scripts must be loaded on every page of a site, you must send Google your browsing history and detailed data about how you interact with sites in order to access basic services on the internet, such as paying your bills, or accessing healthcare services.

It's needless to say that the kind of data that is collected by reCAPTCHA v3 is extremely sensitive. Those requests contain data about your motor skills, health issues, and your interests and desires based on how you interact with content. Everything about you that can be inferred or extracted from a website visit is collected and sent to Google.

If you'll refuse to transmit personal data to Google, websites will hinder or block your access.

[1] https://github.com/w3c/apa/issues/25

Your comment adds a lot to the conversation, so I don’t want to be more contrary than necessary.

It’s nonetheless a shame that it’s so universally misunderstood how ad-supported megacorps make their money that even highly sophisticated users of the web still talk about the value of personal data (source: I ran Facebook’s ads backend for years).

Much like the highest information-gain feature for the future price of a security is it’s most recent price: ad historical CTR and user historical CTR (called “clickiness” in the business) are basically the whole show when predicting user cross ad CTR. The big shops like to ham up their data advantage with one hand (to advertisers) while washing the other hand of it (to regulators).

As with so many things Hanlon’s Razor cuts deeply here: if your browsing history can juice CTR prediction then I’ve never seen it. I have seen careers premised on that idea, but I’ve never seen it work.

> It’s nonetheless a shame that it’s so universally misunderstood how ad-supported megacorps make their money that even highly sophisticated users of the web still talk about the value of personal data (source: I ran Facebook’s ads backend for years).

That may be the case for some people, but that is not my complaint, nor that of many folks I know.

I simply don't care how FB, Google and other surveillance outfits make money. I don't care about marketers' careers or their CTRs. I don't even care about putting a dollar value on my LTV to them.

I care about denying them visibility into my datastream. It is zero-sum. They have no right to it, and I have every right to try to limit their visibility.

Why? None of your business. Seriously - nobody is owed an explanation for not wanting robots watching.

But I will answer anyway. It is because of future risks. These professional panty sniffers already have the raw material for many thousands of lawsuits, divorces and less legal outcomes in their databases. Who knows what particular bits of information will leak in 10 years, or when FB goes bankrupt? I have no desire to be part of what I suspect will become a massive clusterfuck within our lifetimes.

If you're correct that this data has so little value, then it is more likely it will leak. FB and Google are the equivalent of Superfund sites waiting to happen, and storing that data should be considered criminal.

If I could upvote this comment twice, I would. This succinctly summarises my views on the subject. We shouldn't have to justify _why_ we don't want our private information harvested by these companies. I would still feel remarkably uneasy even _if_ Facebook and Google were demonstrably benevolent citizens of the online world, but we've seen time and time again how invasive and malicious they can be. The fact that both of these companies have political ambition makes the entire situation much scarier. Count me out.

They have no right to it, and I have every right to try to limit their visibility.

That's entirely fair! But also: You have no right to use my website, and I have every right to limit your access.

Recaptcha is simply part of this negotiation.

This. Absolutely this!

Do I think Facebook/Google/etc are abusing my data right now? Probably not.

But do I think that large scale collection of my data could be abused in the future? Most definitely. If the Cambridge Analytica scandal has taught us anything, it’s that having access to this data is rife for abuse and often it might happen in unexpected ways.

And do I owe an explanation for wanting some basic privacy? Absolutely not. If a random stranger stopped me in the street and asked me lots of personal questions there wouldn’t be an expectation that I have to respond. Yet the likes of Facebook and Google seem he’ll bent on turning the discussion around when it’s data collected online.

> FB and Google are the equivalent of Superfund sites waiting to happen, and storing that data should be considered criminal.

I would think, that in the EU, under GDPR, collecting, transmitting and storing that data is in fact criminal, or at least subject to heavy fines. And under GDPR it won't help to just note the data collection in the TOS or ask the user for permission (under threat to not allow access to the service). So I really wonder how google plans to run this in europe.

Exactly! And this is my problem with Apple too - sure , they do some things right and are more conscious of "user privacy" than others, but at the same time they have also started abusing this to further spy on their users.

What use is "we are transparent with our users about the data we collect" when the user does not want you to collect the data in the first place? And they give you no option to opt out of such data collection? (And for what - just so that they can create a better ad network that can better exploit us with our own data?)

(And don't get me started on Safari spying and all their "anonymous" cookie collection crap without giving the user any choice in the matter, essentially forcing everyone of their users to opt-in to be profiled through their browsing history).

And you never know what those corporations could do with the data politically. Recently there has been a lot of talk about how these types of companies seem to favor certain politics. Who's to say that they won't use this data in the future for influence?

You could either stop using these services or (as I suspect) you find them too valuable to dismiss entirely quarantine them to a VPN/incognito interaction in less time than it took to type that comment.

I don’t want to single you out personally but there’s a broad trend on HN of bitter-sounding commentary on the surveillance powers of these companies by people who can easily defeat any tracking that it’s economical for them to even attempt let alone execute that reeks of sour grapes that a mediocre employee at one of these places makes 3-20x what anyone makes (as a rank and file employee) anywhere else.

Again, you’re not likely part of that group, but seriously who hangs out on HN and can’t configure a VPN?

I think it's worth pointing out that the comment you replied to didn't mention money, advertising, or CTR. People are concerned about data collection for more reasons than that. You've seen these attempts and entire careers about it without "juicing" CTR, so perhaps that isn't the true intent.

I admit that I inferred the proposed intent for grabbing maximum personal data, but if you’re interested in anecdotes from the trenches: no one below senior director level gets a couple million in stock for any other reason than they pushed CTR by a few basis points. What I was trying to say is that seen through the lens of mechanism design no one is incentivized to query the like button table because there’s no upside in it.

What other reasons do you think the original post was implying for Google to collect all this data?

That's the annoying part of it. They try to collect everything about me, down to my favorite color and the brand of tea I am drinking, and they can't even deliver a semi-relevant ad. Best they can do is to bombard me with shoe and riding classes ads for 6 month after I search for "weight of a horseshoe" and stuff like that. They kill the privacy, they make 99% of the sites unusable without an ad blocker, and at the end it doesn't even amount to them making relevant ads...

If I were you I’d be more worried that Google de facto controls whatever we’re calling HTTP these days than that they have a BigTable entry that ties a browser you once used to a preference for Earl Grey.

No offence, but your posts in this thread appear to be projections, and they derail the conversation.

The main topic we discuss is corporate surveillance. We are concerned about all the personal data that leaves our control. We are worried that evading this type of surveillance becomes increasingly difficult.

Some HN users may know how to mitigate these risks, but most people may not know how to defend themselves against corporate surveillance.

This is why me must speak up now, and not just for ourselves.

I am falling behind replying to all the comments that this has generated.

For the record I am inked all over with anti-equation group stuff: I agree that these companies are too big and powerful (and I would know).

I just don’t see a solution with the present judiciary. If anyone has a bright idea my email is in my profile.

I will thank you all in advance for not shooting the messenger.

Your HN profile appears to be blank. I think I found your email on GitHub though?

For the record, many of your comments here have been thoughtful, and I've upvoted them. I've also downvoted many where instead of responding to other people's thoughtful comments, you just insult them instead. Those are also the ones that other people seem to be downvoting. I don't think anyone is shooting the messenger here.

Can you provide any evidence that personal data doesn't improve CTR prediction for companies like Google/Facebook?

You state yourself that Google/Facebook publicly claim to advertisers that personal data improves CTR prediction. So I have a hard time believing that personal data isn't useful.

I’m already on a shaky limb being so candid about how the business actually works. If you want the opinion (albeit a little dated but still relevant) of someone who doesn’t give a fuck about who the truth pisses off I recommend a book called “Chaos Monkeys” written by a former YC (exited) founder.

> If your browsing history can juice CTR prediction then I’ve never seen it. I have seen careers premised on that idea, but I’ve never seen it work.

Isn't demographic targeting exactly that, based on your browsing history? Will showing an ad for a car wash have the same CTR for people that liked car products as for people that did not like car products? Or is your point that it still has to be a human that inputs "this is about car things, please show it to people that like car things" and it's not a magic AI that optimizes it automatically? And in that case: isn't that just a matter of time? Build the profile today, build the tech that uses it tomorrow?

Part of the point of objecting to big data surveillance is that we ultimately don't know how it's being used, despite what companies claim about its use.

Can I believe you? ...even if you're telling the truth, big corps can hide their most malicious practices from most of their own employees.

To me, it doesn't matter how e.g. Facebook actually uses my data today, because even if they're telling the truth they could change their policies tomorrow, or get hacked, or some third party (incl. the gov't) could get hacked, etc. It's better as a user to try and prevent such data from ever existing in the first place.

> if your browsing history can juice CTR prediction then I’ve never seen it

That's great. So if my browsing history is useless then you won't mind not trying to snoop on it.

Anectotally, I keep no browser history and do not feel my experience with captchas is different than a user who does.

I would contend that the reason for that is that none of the engineers involved get paid more if that experience is different.

> source: I ran Facebook’s ads backend for years

Why would anyone ever trust a goddamn thing you have to say about their data?

Unless they pay your salary and are asking you to give your expertise on hoarding and abusing user data, obviously.

We've banned this account for repeatedly breaking the site guidelines and ignoring our many requests to stop.

If we allow users to harass and attack people who have genuine expertise for posting here, does that make HN better or worse? Obviously worse. Mob behaviors like this are incompatible with curiosity.

https://news.ycombinator.com/newsguidelines.html

Me spilling tea about the business is far more in the spirit of a whistleblower than a shill.

I have nothing to gain and everything to lose by shedding light on one of the most powerful entities in existence.

But TLDR it’s not as interesting as people like to think.

> Since reCAPTCHA v3 scripts must be loaded on every page of a site, you must send Google your browsing history and detailed data about how you interact with sites in order to access basic services on the internet, such as paying your bills, or accessing healthcare services.

> If you'll refuse to transmit personal data to Google, websites will hinder or block your access.

I wonder how true this really is. 20% or so of web users have ad blockers, and most ad blockers block scripts like Google Analytics out of the box. It isn't hard to see that most of them will not make exceptions for a new Google tracking script. So any site that does any kind of testing at all is going to see that ~15% or so of their users drop off if they block users who don't have a reCaptcha v3 score. The only sane business decision in response to this is to go with some alternative.

(Of course, there will be some sites that continue to block users, it's just that they will mostly be the sites that already block users running ad blockers.)

Even UBO doesn't block ReCaptcha by default, so I don't see Rv3 being added to easylist anytime soon.

It doesn't block it because it's generally not active on all pages of a site. The description of v3 sounds more like Google Analytics and will probably be treated similarly.

I'm not sure there's a significant legal difference in the end. If someone could demonstrate that alternative browsers regularly get a lower score than Chrome, that seems like a pretty good antitrust case.

Or were you referring to the risk that individuals would sue Google for getting blocked from random, potentially essential websites?

Not GP but they most likely meant the second. The V2 prompt blocks people from accessing services, which could be construed as damages at scale.

You do bring up a good point about the V3 being potential antitrust issue, but that has always been a potential problem even with earlier versions of recaptcha. With V3, it's also deferring the liability to the webmaster. The action that the website takes with the score is up to them - in the end it's just a number.

From the service provider and devops perspective I find reCAPTCHA beautiful. It brings down malicious form fill, form spam, user creation and password brute forcing rates.

Also as a VPN user, I found out that migrating to more expensive, higher grade VPN, solved a lot of my problems.

In the end it is not privacy, not your VPN that matters from the service provider point of view. It matters that your IP address is spewing malicious garbage. I do not want to spend time sorting it out, as I can focus my activities to revenue generating tasks. Harming some cheap VPN users in the process is collateral damage, but I rather take it than build a form with a perfect attack mitigation and 10x cost.

I hope to see some alternative for reCAPTCHA that does not come with such a strong privacy oriented risks. hCAPTCHA https://www.hcaptcha.com/ seems to be interesting, also monetization point of view. But they are not yet well established company and I do not know what other risks their approach would bring.

I don't even use a VPN and have lots of issues solving google's captcha...

Potential other causes

- Your ISP is a source of a lot of malicious traffic

- You have some browser extension or other adjustments that makes it harder to analyse you as a genuine web browser

For example, using a browser automation like Selenium testing triggers "hard" reCAPTCHA. Not sure if this because of some automated API that Selenium exposes, or just because your browser profile looks virgin (no cookies) without any prior reCAPTCHA solves.

I don't believe this is true. You only need to include the JavaScript on pages which actively use the reCAPTCHA score. For example, you might only include it on the login and user registration pages.

Did you read the article?

> To make this risk-score system work accurately, website administrators are supposed to embed reCaptcha v3 code on all of the pages of their website, not just on forms or log-in pages.

Google recommends that you include the code on multiple pages, however, it makes it clear in the official docs that this is absolutely NOT required for the reCAPTCHA v3 system to work.

So if the article stated that websites were required to put the code on multiple pages (as the comment I replied to did) then the article is factually incorrect.

Isn't the idea that they can decide whether it's a user or a bot based on what the user does in general, not just whether their browser executes JS on this page that you want to protect?

Running headless chrome is trivial, so just having it sit on the one page where you need to check it won't help much. Collecting more data on the user's action on your site will provide a much clearer picture, much like a video from somebody walking through a store will help you make a decision about whether he's trying to steal something than a single picture of him standing at the check out.

The big "if" here is whether or not Google is actually factoring the user's activity into the score. For all we know, there could be a 80/20 split between "Google account activity" and "human-like behavior on website" when Google outputs a trust score.

Is it that different from the way Google Analytics works?

It is, in the sense that it's easy to disable Google Analytics by disabling tracking in Firefox, and there's no consequences. If a website uses reCAPTCHA, and you have tracking disabled, the website will break.

Works for me. Assuming one uses something like Privacy Badger and it if it were programmed to block reCaptcha, these websites that require recaptcha will go the way of anti-adblocker popups. People will simply say no and hit the X and go to their competitors.

You should expect a similar impact on your privacy.

The important difference is that unlike Google Analytics, reCAPTCHA v3 is inescapable. You cannot prevent the collection of your personal data, because then you would loose access to large portions of the web.

You can’t block recaptcha!

Why not? Is it always self-hosted?

From a technical pov, how does one access a user's browsing history from client-side javascript. Isn't that something the browser should protect? or do you mean more that since the reCAPTCHA gets loaded on each page, Google can track what that IP is visiting by where reCAPTCHA gets loaded?

If the script is loaded in the host site's context (it would have to be), it knows your current location and can use DOM APIs to inspect your browsing history (on the current site, at least) and I believe on first page visit it will also be able to identify what website sent you there. It could also potentially register event listeners to watch what links you click.

"reCAPTCHA v2 is superseded by v3 because it presents a broader opportunity for Google to collect data, and do so with reduced legal risk."

And if you use something to prevent tracking - in my case Brave - reCAPTCHA is a huge pain that often takes dozens of clicks to make it through - delayed by Google to wait out bots.

Some times I think reCAPTCHAs main goal is to bring back those opposing tracking back into the fold of Chrome with painful recaptchas.

This comment has been detached, originally it was a reply to https://news.ycombinator.com/item?id=20295333.

in other words this is a callout to all webmasters:

please consider not using recaptcha.

the amount of sites asking me to identify fire-hydrants and traffic lights has dramatically increased since I turned on content-blocking that ships out of the box in firefox. Have been aggressively blocking already before (combo of: UBO, NandoDefender and steve black#s host file), but since turning on this inside FF ... there is no peace.

Anyone got some URL's that I can block all captcha attempts or does it mean I have to also sinkhole www.google.com[1] ?

( I don't have a problem not being able to access captcha enabled sites. )

[1] quick check tells me I would have to banish this endpoint which sucks because I'd have to parse the URL on every request and can't do it in DNS: https://www.google.com/recaptcha/api.js

If the v3 script is supposed to be installed on all pages of the website, in order to track the user's actions, I don't understand how that can be done without explicit user consent under GDPR.

As long as the ONLY processing of the data is for fraud detection/prevention, then GDPR specifically allows it as a “Legitimate Interest”

Recital 47: “The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned…”

Recital 71: “decision-making based on … profiling should be allowed where expressly authorised by … law … including for fraud or tax evasion monitoring and prevention purposes”

First of all the "legitimate interest" part only works if the publisher can prove that the user data is only used for the stated purpose.

The fact that a third party server handles this is a problem. Because then the publisher has to have a data processing agreement in place with the third party.

This is what makes Google Analytics problematic too. The collection of analytics for improving the service can be a legitimate interest, however the data amendment for Google Analytics basically passes the blame on the publisher. I don't think many publishers read carefully Google's data processing amendment, otherwise they would drop usage of Google Analytics. Actually most publishers aren't even with GDPR for more serious reasons, like not anonymizing the user's IP or sharing data with Google for the purposes of ads targeting.

And there are many questions to be asked here.

Is that data private, for the use of the publisher in question, or is this a shared pool of knowledge between publishers?

If the later, then we have a problem, because even if there is a legitimate interest, it only applies to the publisher being visited. Can a user be blocked due to a profile that was built on another website? We are in murky waters.

---

Then there's always the question ... does the publisher really have a legitimate interest?

Claiming that you can have one under the law, doesn't mean you actually have it. There's a set of conditions that you have to comply with.

For example for the purposes of preventing fraud, at the very least you have to be able to show that fraud is possible. Just because you have a login form that's about managing the user's color preferences on the website doesn't mean that you can transmit the user's traffic to Google.

The requirements for legitimate interests are hard to comply with. And I have a hunch that in this case many websites won't comply.

There are a lot of sites that are totally unusable on Firefox regardless how much you use ff.

I do all my mobile browsing on FF yet when I try to use some websites I always get this Recaptcha failed error(1) while it works flawlessly on chrome though I never use it often. Try it, maybe it will happen for you too.

Same happens on most sites which show you that "checking your browser" page via cloudflare too.

The web is very unusable unless you're using chrome because of such antics.

(1) https://cdn3.imggmi.com/uploads/2019/6/27/0dd96b25707ce6e236...

It's even worse when you're running a VPN (especially one of the major public ones). When I see reCAPTCHA I basically give up as sometimes I have to go through 6 or 7 full sets to be let into a site. It's the evil of the internet this.

reCAPTCHA on VPN is difficult, but on the Tor network, they are downright impossible. I've never been able to get past it, even after a few dozen painful attempts. That means Google services are entirely off-limits over Tor, even Search, which is a disgrace.

> That means Google services are entirely off-limits over Tor

If only it was Google services alone. CloudFlare loves serving up a ReCAPTCHA for Tor users before they can even passively read site contents. That hugely expands the damage done.

they have a patent on giving out unbeatable challenges when the computer thinks it's dealing with a 'malicious agent'.

https://patents.google.com/patent/US9407661B2/en

Tor users don't want to be running reCAPTCHA at all. There's a few privacy problems for people who run that or other ambitious cross-site snooping. Usual stuff (requests, cookies, JS fingerprinting, etc.), behavioral fingerprinting, and very detailed monitoring of what information you were accessing/reading and possibly even entering.

You can hardly blame anyone for blocking Tor traffic. You might not be using it for abuse but a large volume of abuse originates from it.

Sometimes Google will flag you as robot and never allow you to pass no matter how many you get right. It's total horseshit

I'm assuming you are not logged into a Google account during this? What happens if you create a throwaway Google account while on Tor? Or is that also impossible?

Thanks for verifying that for me. I thought it was just me being horrible at figuring out what they want.

No, the same thing happens to me. I often run ProtonVPN + Firefox with uBlock Origin and a couple other privacy-related addons.

I prefer to see the silver lining in this. If Google wants to break the web for Firefox, fine. I'll keep using (and evangelising) FF, and the sites that are broken won't get FF traffic. I believe that FF is doing the right thing far users, and Google, while in a powerful position is currently on the losing side of history with respect to privacy. Apple is taking that fight to them, and putting budget behind inte convincing average internet users that privacy is cool, and Google abuses your privacy.

The walled garden approach worked for a while for Microsoft, and it's working for now for Google, but eventually, it stops working. Once people leave, walled gardens keep them away.

Only the majority of the Internet isn't a walled garden is it? It's more like a minefield because you don't know whether a site is going to use recaptcha and block/hinder your access.

You can't just opt out of using half the Internet because you value privacy, and nor should you have to. This requires legislation to stop.

As long as government sites don’t use it, it’s fine. You don’t need legislation for every single offense, perceived or otherwise. If you don’t like ReCaptcha, block it with an ad blocker and if a site requires it, don’t use it and let them know why. Also let all your friends and random strangers on the internet know why.

I have the same experience, some pages don't work on FF but fine on Chrome. I like to apply Occam's Razor, but with so many users it seems to me as if that's either by design, or certainly there is little desire to fix the issue.

Worst part is my chrome installation is 100% fresh with no browsing history and FF has cookies and history older than an year ago.. still google trusts Chrome more than FF?

If they looked for identifying information in cookies or browsing history people would be even more upset and spammers would just simulate it with browser bots... which is why I believe it takes a black box approach to each detection regardless of external state. Besides obviously the cookies set within the iframe of the recatcha.

This of course doesn’t help explain why Firefox is so heavily targeted by what’s supposed to be a neutral utility like Google Analytics...

To be fair, its not super-hard to follow the incentives there...

reCaptcha isn't able to read your non-Google cookies or history, so most of that isn't being considered.

I know if I was running a mechanical turk or bot farm, I'd be using a Chrome user agent via puppeteer. I'm not sure WTF they are doing other than being malicious against non-chrome.

Also Google punishes Firefox users by forcing them to click on pictures 2-3 times more than Chrome.

Same with Brave: I'm logged in into a gmail account and a custom domain hosted on gmail, yet every time there's a reCAPTCHA widget on the site, I have to do it 2 or 3 times before I'm let in.

One trick that seems to help fool that awful piece of tech: click slowly on the images, as if you were thinking a second or two before each click. Maybe click a wrong image and deselect it again. In other words, behave like a slow human, and it seems to work better than if I solve it as quickly as possible.

I also have the feeling that making mistakes — selecting an image that looks like a traffic light but isn’t — sometimes results in faster admittance than being surgically accurate.

Again, being slower and more error prone seems to be rewarded.

Which I intentionally and repeatedly fail anyway, because I'm not training Google's AI so they can sell it for use in drone strikes.

If this reduces the world Google allows me to access, it doesn't diminish mine because of it.

Other than the occasional reCAPTCHA gaslighting (which does occasionally block some service if it gates logins behind it) that we're all familiar with, I have completely excised Chrome from my life and am able to go to most any website without issue. That's with uBO and Privacy Badger running

That's odd. I never had issues with it on Firefox. Most of the time I just check the box and it's happy, sometimes I have to do an image puzzle. And that's with ublock origin. Maybe it depends on country or isp? My work place has its own /16.

Kickstarter's login has not worked for me with firefox for over a year. People just don't test with anything but chrome and it shows.

Funny enough I had to wait on the 5 second Cloudflare check to access that image. However I am using Chrome. That check I have found to be rather annoying. I assumed it would do it once, but it seems I have to go through it daily on sites I use regardless of which browser or device I use.

That image link is protected by cloudflare too! Irony intended?

The sad and depressing state of the Web in 2019: proprietary third-party JavaScript and cookies are required to view a simple, innocent JPG.

And it'll only get worse. From the article:

> "If you have a Google account it’s more likely you are human"

So, in the future if we don't keep signed into our google account(and let google know every article we read and every website we browse), we'll be cut off from the half of the internet or even more. The amount of control a handful of companies have over the internet is suffocating to know!

I have better luck if I log into Gmail :(

You can view your reCaptcha V3 score here: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor...

I get .7 on my iPhone, I’m guessing that my liberal use of Firefox containers and the cookie auto-delete extension on my desktop will give me a much lower score and cause me to have to jump through extra hoops at websites that implement it, just like the reCaptcha V2 does.

Edit: I also got 0.7 on Firefox with strict content blocking (which is supposed to block fingerprinters), uBlock Origin, and Cookie AutoDelete. I get 0.9 from a container which is logged into Google.

With Firefox fingerprint resisting turned on and with Ublock Origin/UMatrix, I get a score of 0.1. And I'm not even on a VPN; I'm sure on my home network I'd have an even lower score.

To me, it feels like Google's entire strategy behind reCaptcha is to make it harder to protect your privacy. We've basically given up on the idea that there are tasks only humans can do, and to me V3 feels like Google openly saying, "You know how we can prove you're not a robot? Because we literally know exactly who you are." I don't even know if it should be called a captcha -- it feels like it's just identity verification.

I don't think this is an acceptable tradeoff. I know that when reCaptcha shows up on HN there's often a crowd that says, "but how else can we block bots?" I'm gonna draw a personal line in the sand and say that I think protecting privacy is more important than stopping bots. If your website can't stop bots without violating my privacy, then I'm starting to feel like I might be on the bots' side.

> it feels like Google's entire strategy behind reCaptcha is to make it harder to protect your privacy

For the irony, I'm still logged into GMail and it still works perfectly, as basic HTML, even with google.com forbidden to run scripts. But it's the flippin' reCaptchas all over the place that make me temp-allow google.com, and then a reload later, temp-allow gstatic.com and reload again. Only then I get to use someone else's site normally, and I can disallow again... it's irritating. And then, this.

BTW that page plainly says the scores are samples and not related to reality. Refresh a few times and watch it change. 0.3, 0.7, and 0.9 seem to be my lucky numbers. I see everyone else getting those and 0.1.

Please stop reading things into it oh it's too late. Maybe they suddenly started seeing this page hundreds of times in the referrer and added that bit afterward, I don't know.

Not sure how much Ublock Origin makes a difference. I have a score of 0.9 with it turned on.

First try in Vivaldi's private mode got me still a 0.3 . Then I tested it while being logged into Google and it went to 0.9 . However, when I tried it again in private mode, I got 0.9 there too. Temporary fingerprints show quite the effect.

I also get 0.1 with the same config as you, except that I had uMatrix disabled (which if anything, should improve the score in Google's eyes)...

so why are they having you solve image puzzles if they know that they are going to fail you? even if they know that you are human...

Firefox Focus, 0.3. You seem to have triggered something outright penalising.

It seems totally reasonable that Google knows you're not a bot if you have a Google account. This isn't the problem, although it hides the problem.

The problem is that they aren't trying harder for users who aren't logged in.

I’m just waiting for the AI-generates fake people and whatever way they will come up to monetize that!

Your privacy isn't nearly as important as you think, and as long as you continue to overvalue it, you'll continue to be unwilling to trade it for convenience.

That's on you, not Google.

Using Firefox with uBlock and Cookie-Autodelete I get 0.1

Using Chrome, even incognito and with uBlock I get 0.7

(╯°□°）╯︵ ┻━┻. F you, Google, this is blatant bullying, technically unjustifyable abuse of your stranglehold over the whole web platform.

To offer a different datapoint:

On FireFox with uBlock on and logged into my corporate gmail I get 0.9, switching to a private tab I get 0.7. This is with every privacy setting turned on in the FF options.

I also have a similar result (0.7) using my browser at work. I am using containers, uBlock, privacy badger and auto-delete cookies.

> NOTE:This is a sample implementation, the score returned here is not a reflection on your Google account or type of traffic.

This comment should probably be higher up in the thread.

It is both funny and sad to read this thread.

Using chrome on my phone I get 0.9, but if I switch to Firefox I get 0.1.

This is essentially going to let Google gatekeep the web if you aren't using their services.

Really? I don't think so. I get a 0.9 on Google Chrome, and a 0.7 on Firefox. I heavily use Chrome and I have not used Firefox apart from maybe testing some local websites. Despite this I still got 0.7 on there. I expected lower since I don't use the browser.

On a flip side: you really should check privacy settings in your Firefox, it seems Google can track you easily there. ;)

I get 0.1 continuously, possibly because I have resist fingerprinting enabled in Firefox. I'm not changing anything to compensate that score; it shows I must be doing something right. If I encounter a reCAPTCHA I will continue to (usually) just leave the site it's on.

Same, the way to look at a low score is "I'm getting privacy right".

Contrary to the results here, using Firefox + uBlock with DNT and tracking protection enabled, I get a score of 0.9. In private browsing mode it's 0.7.

I wonder how many people here are using a VPN or accessing from a non-western country -- I'd bet those are much bigger factors

Were you logged into your Google account? That seems to almost guarantee a .9

Yes, although not when private browsing of course.

FF logged into Google account: 0.9

FF incognito window not logged into Google account: 0.7

FF incognito window not logged into Google account through VPN: 0.3

FYI I have uBlock, pi-hole and a bunch of privacy widgets enabled

This looks like a RNG: I got 0.7, 0.9, and 0.1 successively. It can't make up its mind whether I'm almost certainly not a bot (0.9) or almost certainly a bot (0.1)?

Perhaps the rapid, repeated identical requests outweighed the initial factors which gave you a positive response

Might very well be. I also get errors on hacker news about "can't process requests that fast". When asking about it (initially because I thought votes didn't work randomly), the limit is a few requests per second. Turns out I click faster than that, either by reading a whole comment thread and making up my mind whose comments were most helpful (to upvote all at once) or by navigating too fast.

> This looks like a RNG

Come on, how is everyone in this chain so blind. It's literally in bold and the single largest block of content on the page:

NOTE:This is a sample implementation, the score returned here is not a reflection on your Google account or type of traffic. In production, refer to the distribution of scores shown in your admin interface and adjust your own threshold accordingly. Do not raise issues regarding the score you see here.

> Come on, how is everyone in this chain so blind

Please see the sibling comments (that were there before yours) where this is already being discussed, before being insulting.

from the link

>the score returned here is not a reflection on your Google account or type of traffic

I got random scores as well. It looks like this is just a sample of the data structure that the service returns, not the actual score.

That would be a useless site, but that's not how I read it. I understand it as "this is not that Google thinks your account is a bot, it's that this request might be made by a bot. And since you didn't use this site as a normal website, it also doesn't score your type of traffic, just this one request". You might be right, but it really does seem to be doing a request to their API.

I too got 0.1 even though I'm not on a VPN, and have a stock FF installation with just uBlock addon. I think my ISP may have some part in it but still 0.1 score is 100% bot right?

I'm also logged into google and fb which also doesn't affect my score. Only shows how broken their algorithm is :(

edit: just tried it with chrome and my score jumped to 0.9! So definitely not my ISP. It's just my browser that Recaptcha doesn't like. If you put two and two together that's really evil shit, even for Google!

I got 0.7 on FF, 0.3 on Opera and Chrome, all in incognito mode. Maybe they have just a few values and return it based on AND OR logic of 2-4 variable. Or maybe they are just playing around trying to gather some stats, for some "Don't be Evil" purpose!

Google is putting a number on us, is honestly some Minority Report level dystopia. Google is already using this to make life hell for anyone who cares about their privacy, we need to do something about this before they finish putting up their iron curtain over the web. Would it be possible to sue website owners for requiring such invasive measures? I'd love to see this ruled as monopoly power and Google broken up but that's probably not very realistic so we would probably do better to make using Google captchas more expensive in court costs alone than just building their own solutions to fight bots.

Work Firefox which I use all the time, no addons (including any adblockers): 0.1

Almost unused Chrome installation, also without addons: 0.7

Seeing what everyone else has posted I'm very suprised that I've received a 0.3 using Chrome on Android. I'm logged in to Google and most of my browsing is via Chrome or Chrome based webview. At least on my phone I've never cleared my cookies or done anything special.

This is total bullshit. My score of 0.1 in firefox shoots up to 0.9 if I change my user agent to ChromeOS. No other changes - same set of ghostery/ad blocker/fingerprinting prevention, etc. What a scam.

Ding ding ding ding, Google's way of killing the other browsers in the market for good, kill off the adblockers manifest, literally become the entity which monitors the internet as much as the NSA...

Oscillates between 0.1 and 0.7 for me, and I'm changing nothing on my end (just hitting "Try again"). Does it have to do with refresh speed, I wonder?

Privacy Badger and ABP on my work (less-locked-down) Mac.

Hitting the same URL over and over again is bot-like behaviour. When working with reCaptcha on forms I usually start getting hit after 4-5 test submissions.

I get .9 in Firefox on my MBP with UBlock Origin installed. I wondered if it was because I was logged in to Google, so I tried Incognito and got .7. In a never-before-used container I also get .7.

I get a 0.7 on my computer on Firefox. If I use the same website in Chrome (which is signed into a Google account) I get a 0.9. I guess it's a [0,1] scale?

I'm guessing their a-listers came up with something like this:

    // TODO: add impressive-looking math
    if (signedin && trackedEverywhere) {
         return 0.9
    } else {
         return 0.7
    }

I think we give Google way too much credit for their talent. This is the same company that didn't feel like finishing their website for two decades and subsequently stole $75 million from their users even when Google knew [1].

The same company that somehow still doesn't reconcile amounts owed and just keeps the money when they randomly-ban users and hide behind fake support emails, but they did feel like paying $11 million to keep that away from scrutiny [2].

[1] https://www.businessinsider.com/google-emails-adtrader-lawsu...

[2] https://www.searchenginejournal.com/adsense-lawsuit/248135/

I get 0.9 on Firefox which is my main browser and 0.7 on Chrome which I use only for hangouts.

So, I still have to whitelist Google in uMatrix and allow cookies for this to work. Even after doing so, I get a 0.1. I reloaded the page to check for variation as some other users mentioned but get the same score each time. I guess Google is saying I shouldn't be allowed to use the internet.

I got a 0.9. What's it out of? 1? Sorry if I completely missed that somewhere already.

Yes, it is out of 1. From https://developers.google.com/recaptcha/docs/v3, > reCAPTCHA v3 returns a score (1.0 is very likely a good interaction, 0.0 is very likely a bot).

0.3 with Brave on Android, no extensions. 0.9 with Chrome on the same device, same connection.

Brave isn't particularly "unusual", and is even based on Chromium - surely this is Google blatantly punishing non-Chrome users?

Interesting.

I get a 0.7 on Chrome with no account logged in and uBlock Origin installed.

Same browser, same plugin but incognito it's 0.1.

Papa google needs my data to trust me. Makes complete sense but still interesting that you can affect your score by giving in.

What is most odd is I get 0.7 on iOS Safari which I use for 100% of my purposeful mobile browsing, but I get .9 on iOS Chrome, which is only used when I accidentally click on links from gmail (so very, very rarely).

Not really odd at all - if you're using the gmail app, there's a shared authentication cookie in all Google apps - including Chrome, so Google knows who you are in Chrome.

It seems a lot is iOS users get 0.7.

A consistent 0.3.

> error-codes": ["score-threshold-not-met"]

Not sure if happy or not happy with that. I will conclude happy enough.

Linux, on VPN, Firefox. Not logged into any Google services. Cleared caches (still same IP), no difference.

Stock Qutebrowser 0.7, FF w/ all the usual extensions (ublock origin) 0.7. Don't know if it matters but I'm rolling Arch. Just adding another point of data for those curious.

From my computer, where I browse fairly equally with all three of Chrome, Safari, and Firefox (albeit different sites), I get the following scores:

Chrome: .9

Safari: .7

Firefox: .1

I have adblock running on all three, and I use containers on Firefox.

interesting my score is 0.9 if I allowed google to track me using cookies, if I block the cookies it goes to 0.7 and if I enable content blocking in Firefox it drops to 0.1

With desktop Chrome I get a 0.3. My browser sends Do Not Track, has PrivacyBadger extension, and has that useless google-profile-in-the-browser feature disabled.

I got 0.9 on Chrome, logged into google. I also got 0.9 on Firefox, not logged into google.

In incognito mode in chrome, I sometimes get 0.9 and sometimes 0.7 when I reload.

Using desktop Safari incognito without a Google account and Ghostery enabled, I get 0.7 too. Interestingly, disabling CSS drops me to 0.1...

Interestingly enough I got .9 on Edge with Ublock origin installed. Perhaps this has something to do with how Edge is using webkit now?

I got 0.9 in my Android phone running chrome. When I opened it in incognito mode, my score was reduced to 0.7

It gives me 0.7 on Safari (uBlock Origin) while 0.3 on Chrome (uBlock Origin) - both macOS Mojave.

Firefox mobile w/ ublock: 0.9

Firefox with uBlock O I get 0.9. Don't know what everyone else here is talking about.

I get 0.7 in both desktop (linux) chrome and firefox. I get 0.3 from android chrome.

>Please upgrade to a supported browser to get a reCAPTCHA challenge

I guess this is a 0 for me then

I use the same extensions on desktop and get 0.3 on my android Firefox

The first time it failed the second time I got a .7 iPhone Xs.

iPhone with a good (not amazing) adblocker: 0.7

Safari macOS with the same adblocker: 0.7

Firefox macOS with a lot of adblockers: 0.1

I get 0.9 on my Firefox

It didn't load for me and I couldn't figure out why.

Then I remembered that I put this in my /etc/hosts a few weeks ago and forgot about it.

    127.0.0.1       google.com
    127.0.0.1       www.google.com

[Edit] So if nothing shows up for you on that page, check for that. Also I just generally recommend it. Google has some unethical practices and duckduckgo.com is pretty good.

I got "reCAPTCHA script loading".

You need not to use hosts to block it, uMatrix could do it by itself.

There are government services, such as the USPTO, that rely on Google reCAPTCHA. The new reCAPTCHA has made it difficult for me to access documents, and sometimes they think that I'm a bot and thus deny me access entirely.

Does the government realize the consequences of this? Both that it pushes users to use Chromium-based browsers, and that they're helping to solidify a company that already has a near monopoly in the browser space?

Further, this quote is very creepy:

> To make this risk-score system work accurately, website administrators are supposed to embed reCaptcha v3 code on all of the pages of their website, not just on forms or log-in pages.

With AMP, Google Ads, and reCAPTCHA, Google now has access to pretty much everything that people do on the web.

To be fair, government at all levels did the same for Adobe by mandating that things be done in the PDF file format. Consistency of government operations sometimes requires that certain private companies be preferred vendors, and of course there's going to be a snowball effect there as big players get increasingly larger shares of available funds. Every government in history has had a government-industrial complex with winners and losers - some of this boils down to human nature.

> Consistency of government operations sometimes requires that certain private companies be preferred vendors

In which case those private companies should now be deemed an extension of the government and fall under all rules a government organization has to abide by. If they do not like it they can forbid the government from using their software/products and can sue if the government does not abide.

You are required to use reCAPTCHA on the California DMV website when making appointments and other functions.

https://www.dmv.ca.gov

It will also log you in to google on the first page.

Additionally, the stations at the DMV all have tablets on stands, showing Google logins for some operations.

When did this start? I used the DMV page without a google account in February with no issues, and the local DMV has no tablets as of May.

I was amused that Elizabeth Warren's campaign site wouldn't display the content for me unless I permitted scripts from google.com (w/ umatrix) since she is promoting breaking up google.

Although you can be pro break-up-Google while using one, or even many, of their services.

So I don't really see the amusement.

It's typical of politicians not to run their own organizations in the same way as they say the world should be run; campaign organizations are a bit fly-by-night, and political platforms are more or less flexible by necessity.

I think it comes from the sad fact that, generally, ambitious politicians create organizations to get themselves elected, rather than previously-existing and purposeful organizations presenting candidates that represent that organization's values to a larger audience.

Makes me wonder if this could cause those sites to run afoul of the ADA? (I'm admittedly not very familiar with the requirements, but thought it was interesting to consider).

I do wonder what these government offices can do otherwise to prevent spam - I can run `curl` on the Georgia DDS appointment listing page and I get back all available slots. Assuming there isn't a captcha later in this process, it would be trivial to build a bot that books fake appointments for the next 5 weeks.

The other tradeoff is you're giving Google an extraordinary amount of power to decide who is allowed and not allowed on your website with no transparency on how this decision was made. Not sure what company is willing to blindly trust Google with that power.

Unfortunately, the answer is (basically) all of them. Combined with CloudFlare, even websites that aren't explicitly making that decision are still opting their users into both CloudFlare and Google's tracking.

I use Tor fairly regularly and it's a complete nightmare. I sometimes spend 5-15 minutes solving reCAPTCHA (since your Tor circuit changes every 10 minutes this can result in having to solve the reCAPTCHA several times).

Plenty of small companies/private website owners might make a simple cost/benefit calculation - 15% less users but in return X reduced false accounts/traffic/...

Bank of America is...

I'm torn on this. reCAPTCHA v2 (mostly useless[0]) and v3 function largely on browser fingerprinting plus a few other heuristics (e.g., whether or not you have a Google cookie). Any meaningful privacy measures to resist fingerprinting end up with a low reCAPTCHA score. I personally run into a wall on most sites using it.

That said, it's one of the most effective means of combatting automated spam and credential stuffing attacks. In a recent implementation I did, having 2FA active for your account bypasses the captcha requirement, but the vast majority of users are still too non-technical to use 2FA and are subject to the frustrations of reCAPTCHA.

[0]: https://github.com/dessant/buster

It is used irresponsibly.

A responsible spam protection system should allow every spam (and consequentially responsible user) from an ISP.

If a ISP shows sign of abuse, then show Captcha or other system that will block some spam while also blocking some valid users. This is a evil-for-the-greater-good solution. Do not fool yourself into thinking this is a solution (i.e. without caveats)

Impacted users can complain to both the service provider (you) and their ISP. And that failing, switching their ISP (i.e. voting with their wallet --how that happens in a monopoly is another discussion)

Bottom line, if you show captcha for all users (even for ISPs that are now showing signs of spam) you are intentionally blocking some users for no good reason. And you are part of the problem. Sadly, this includes the US government as they blanket censor all their forms (from visa request to DMV visits) behind Google(R) captcha(tm) at all times.

It seems that your suggestion is that ISP is a good signal for detecting spam, but it's not obvious to me that this is true. For example a site targeted by a botnet could be hit with traffic from a wide range of otherwise legitimate looking ISPs, in which case you're going to be getting a lot of spam on your website.

In our experience, country of origin is a better heuristic for possible abuse than an individual ISP is. Most malicious traffic comes from a fairly small number of countries, many of which are the obvious culprits. That kind of data is never guaranteed accurate, though.

lots of salty people in denial about being part of the problem ;)

I hate the v3 reCAPTCHA. On FF, I usually KNOW I am answering correctly and it says I failed. I always have to go through it multiple times. It's maddening. It often leaves me second guessing myself... is that sliver of car counted? is a crossing signal a street light? What about those streetlights way off in the distance, do I select those two in addition to the ones front and center? That RV looks sort of like a bus, should I select that too?

It's not really about getting the questions right. The challenges they present aren't that hard for modern computer vision systems. It's more about verifying that you consider the question for a "human" amount of time, make your mouse move like a human might, etc.

You're thinking too hard, reCAPTCHA is made for regular users who won't sit there thinking if they're right or not. I always make sure to select a few wrong squares out of principle and after 6 or 7 attempts I'm usually allowed into whatever site I was visiting. Nobody knows the exact algorithm, so trying to please it, or worse - agonising that you answered wrong - is completely foolish. Just click a few squares that seem right and roll the dice. Beating yourself over not solving reCAPTCHA correctly makes the terrorists win.

You're describing v2, not v3.

I intentionally get a few wrong (to subvert their harvesting of manually labeled training data).

It still either lets me through, or doesn’t even manage to display images for me to click on because it doesn’t like my browser settings. (The latter is more common than the former these days...)

I wonder how much legitimate traffic bounces because of reCaptcha. Can sites even measure this?

Apparently one of the Twitch streamers I sometimes watch had it do that to her just the other day whilst testing out her own site's reCAPTCHA-protected form: https://clips.twitch.tv/BitterTentativeRamenChefFrank

They want all tiles with bicycles... but are showing me a road painted bicycle crossing pictogram...

The subheadline gets it right:

> It’s great for security—but not so great for your privacy.

For individual users, security and privacy frequently go hand-in-hand. But for site operators, user privacy makes security a lot harder. The more you know about a user, the easier it is to figure out if they're an adversary.

Wouldn't reCaptcha V3 also make things much more difficult for Google competitors, assuming that site owners place it on every page? I'm guessing it will block any sort of scraper (since scraper access patterns don't look human) with some sort of whitelist for Google's scrapers.

They typically won't completely deny access, but only disallow certain actions (posting a comment etc). All out denying access will likely get site owners into trouble, at least in the EU - you need to be able to access privacy information, publisher info etc. I'm also not sure whether non-opt-in usage of recaptchav3 is GDPR compliant.

Yes it means Google has p0wnd the web.

I guess another question is why we really need captchas. What are we trying to protect against that can't be accomplished with rate limits, voting systems, or other ways to regulate meaningful use of a website?

Ultimately why does it matter if the user is a human or bot, as long as they are being a valuable user? What's wrong if a bot buys some of your inventory, pays for it and everything? What's wrong if an NLP bot responds to discussion threads with scientific facts and citations?

> What's wrong if a bot buys some of your inventory, pays for it and everything?

100% of the time, a bot buying things from a store is doing so to test a database of stolen credit cards the bot's owner has purchased/stolen. Accepting those sales means you'll get hit with chargebacks a few weeks later as the real owners of those cards see their statements. Then your store gets shut down for exceeding the maximum 1% chargeback ratio mandated by Visa and MasterCard. So preventing this scenario matters a lot, and when someone targets one of my stores for testing like this, enabling a CAPTCHA on the payment page is one of several, often-essential mitigations. Blocking IPs, blocking whole countries, including a nonce in the form, etc are on their own insufficient most of the time: the readily-available tools for this kind of attack already handle rotating IPs, retrieving a new form nonce on each try, spoofing the proper referrer, etc.

> What's wrong if a bot buys some of your inventory, pays for it and everything?

In the book "Spam Nation" (Brian Krebs), a group of students try to fight fake online pharmacies. To do this, they created an army of bots and placed thousands of fake orders every day. The goal was to create so many fake orders that the human processors (many fake pharma stores were not fully automated) had to spend a significant amount of time clearing out the fake orders before getting to the real orders.

Now imagine this on a legitimate website. Not every website is automated, not every organization has the same resources that Amazon does. CAPTCHA's are a great way to ensure orders are coming from real people. They could still be faked, but the bar is a bit higher.

Don't think bot; think botnet. Ratelimits do not work against botnets since they appear to be independent actors. e.g. if you think it's fine for everyone to do something 1-3 times, then you are letting a botnet of 10k hosts do something 10k-30k times.

[edit]

Also, NAT means that there could be hundreds or thousands of individual users on the same IP address (many dorms at smaller colleges are setup this way), so you don't want to rate limit by IP address either.

Indeed, if they need to pay, there is no need for a CAPTCHA. As for responding to discussions, sure, you'd ban any human that posts spam the same as any bot. However, bots can spam your site faster than your human moderators can keep up with, so by using a CAPTCHA, only humans can post (ideally, of course), and thus moderators can keep up.

As a security consultant, it is not uncommon to recommend a CAPTCHA for things like successive, three failed login attempts from a single IP address within a certain time period. But I do agree that CAPTCHAs are used too frequently, and some security people recommend them for just about everything. As someone who blocks a lot of tracking and feels the pain of these tracking monsters (that's what CAPTCHAs are these days, more than the Completely Automatic Public Turing test they're supposed to be), I always think very carefully whether a CAPTCHA is the only option, and I'm sure to recommend CAPTCHAs that fit the situation but are less invasive than a third-party one.

Edit: oh, right, credit cards are common in many countries and banks set chargeback limits. It's still crazy to me that your 'public key' is also the only thing needed to withdraw money from your account, thereby necessitating a chargeback system. I guess for credit cards a CAPTCHA might be useful too.

Here is an answer from the hncynic bot:

I had problems with my spinner at first. However, this is one of the things that is really annoying about using captchas instead of passwords.

It is possible to create a secure account for something useless without using the system and you probably won't get spammers anymore.

What a dumb idea, you would want to implement it yourself, because the people working and maintaining the system(s) will all have some way of doing that already.

I don't know how much the government can take away from a site like this as well. But it's a bit like trying to ban a kid because the kid got an old friend on their facebook because his parents were "bad".

So, even though you have a big idea about voting systems, it would be a better option to require a system that only exists to be able to be used for good reasons.

So this is probably a bit off topic, but why don't more site owners just create their own unique anti-spam system? In my opinion, if they were simpler, yet all unique, there would be less bots that could mass spam and privacy would be improved.

Even something as simple as a question: "How many legs does a spider have?" ____

And then cycle through different types of free form questions of things that most people should know. Perhaps block the IP after {n} failed attempts for an hour.

Forum software like vBulletin and Invision often has this feature built in, and I've used it on a forum I help run. Unfortunately, after writing four or five custom questions, I soon found server logs showing spam bots blowing through the questions in seconds -- I suspect that since this is a common enough strategy, it's worth their time to pay someone $0.10 to pick the correct answer, then save the question and answer pair in a database somewhere for future use.

One possible reason: the site owners nowadays use the likes of Foursquare/wix/whatnot which means reCaptcha etc are just a checkbox item. Custom anti-spam may be beyond their technical capabilities or interest levels.

I think this would fail under any directed attack. It’s too hard to generate a database that’s large enough.

Most sites use reCAPTCHA to protect against bot registrations, sometimes targeted to their specific registration system. Any simple solution would defeat the purpose of a CAPTCHA.

I remember a site that had such questions, specific to the knowledge of the site in question. Imagine HN asking "The L in SQL stands for: _____"

Disabling browser API that adblockers/privacy protectors use. Fingerprinting users with adds at stackowerflow. Now collect information how user navigate webpage. This is a scary trend.

And I am not speaking here about how Android and Android apps (which is allowed by Google) track users.

https://hcaptcha.com/ seems to be a viable alternative. If you are a developer, please consider using something other than reCaptcha. Not only is it annoying, but a privacy nightmare as well.

> earns website owners money

> an open decentralized protocol for human review that runs on the Ethereum blockchain.

Is this basically a JS crypto miner?

thanks, I work on hCaptcha, we are hoping to provide a unbiased bot-detection system with different incentives from an advertising company. Let me know if you have any questions.

Google is trying to kill the competition by purposely introducing weird bugs here and there, taking advantage of the fact that they own the most visited sites on the web.

They've been doing it for a while now, Tech Altar even had a video about it the other day: https://www.youtube.com/watch?v=ELCq63652ig

Along with the censorship and privacy issues, I guess it's time for them to change their payoff, "don't be evil".

>I guess it's time for them to change their payoff, "don't be evil".

They dropped that years ago, literally and effectively.

I'm... actually struggling to see what this dark side is. The data is collected under a non-reuse agreement. It's specifically there to make a good captcha. There are other captcha vendors, and they don't make that promise (and I can think of at least one who admits they collect and resell data via captcha).

So the downside here is that no one has a credible way to compete with Google? Maybe because their Google cookie actually is a pretty good indicator of humanity?

That's nonsense. Tons of people do. There's LOADS of great research on captcha that isn't implemented by any vendor. The roadblock is that NO ONE WANTS TO, because it's a thankless, unprofitable task that puts you dead in the crosshairs of a ton of very organized people who will devote huge resources to circumventing or breaking your offering.

"A land grab," sure. Of a nuclear wasteland covered in small arms battles.

It's a land grab of the general web and browser market, not of the captcha market. They're using the captcha to disincentivize users from using browsers other than Chrome or from not having a Google account. And now with v3, it's supposed to happen on every page of the web? It shouldn't be too hard to see it's a disaster.

> The data is collected under a non-reuse agreement

Oh you sweet summer child. Would you by any chance be interested in buying a bridge?

Despite that, even assuming if it's true and we'll have a lovely accurate AI captcha system. The big down-side is that captcha is breaking programmable web. I maintain a lot of small software crawlers from simple notification applets to bigger analytic crawlers and the web in the past few years has been increasingly hostile towards this. API endpoints are disappearing and in general make distributing free apps very difficult. The web-crawlers are super simple to write and even maintain but services like cloudflare, distils, captcha break them and while there's always solutions to these systems they are very hard to distribute to users (you can't really pack in pupeteer, selenium or some other webengine automation stack with your app).

Public data should be public. These sort of idiotic measures are not compatible with web protocol. The web only know one thing - 1 IP address == 1 person and it should be encouraged not dismissed.

How can I complain? Where to go? How can we organize? I want to do something about this!

This is complete and utter bullying. Bullying on user privacy, bullying on Firefox.

Somebody please tell me where to go?

Apart from the privacy nightmare, couldn't this also result in discrimination?

> For instance, if a user with a high risk score attempts to log in, the website can set rules to ask them to enter additional verification information through two-factor authentication.

Seems to me, this could easily flag genuine users who access the site through a non-standard flow - e.g. because they use assistive technologies. In the worst case, this could result in impaired users being forced to jump through additional hoops - or being blocked completely.

Smells a lot like using Google's virtual monopoly on bot detection as a way to push users into using one of their other products. Likely not a wise idea when the government is itching for an excuse to bring an antitrust case against you.

Google's captcha system is overkill for most websites. If I want to filter out bad actors (on a simple straight-forward site), there are other more simpler and easier to solve captcha systems out there. They might not have the rigour of Google's system, but they do the job, and well.

I would however use Google's system if the site is massive and there is the possibility that someone is using a script or some program to algorithmically bypass the (simple) captcha, and register accounts en-masse and trying to create a psyop[0], or disinformation campaign, or even a sockpuppet army.

[0] https://en.wikipedia.org/wiki/Psychological_Operations_(Unit...

There are diminishing returns once a CAPTCHA gets past a certain point. Bad actors can (and do) just humans to fill out captchas all day. We get some spam submissions on our sites that I'm 99.9% certain are people in developing countries copy/pasting spam templates and filling out captchas by hand.

I disagree. Adding Google's captcha is a 15 minute exercise. If i remember correctly, you copy/paste a snippet then add a callback in your own code. Whereas rolling your own captcha implementation would take much longer and be worse.

Which Captcha systems would you recommend?

> trying to create a psyop[0], or disinformation campaign, or even a sockpuppet army

That's not a viable reason. Anyone doing so is going to have a budget and human reCAPTCHA solving is less than $0.01 per CAPTCHA. It costs very little for mass account creation, reCAPTCHA or not.

Stupid question: why do companies care so much about bots to the point of degrading the customer experience significantly? I can understand for things like public forums. But like why would an ecommerce website ever put a captcha between you and your order (or a news website)?

An example from another comment: bots checking stolen cc numbers which then results in high numbers of charge backs and the potential for getting blocked by visa/mastercard.

For example: - bots sign up with email addresses that are owned by other people that don't appreciate your welcome/activation/etc. mails. - all that automatically generated data can start to hurt performance. Especially on a smaller site, having millions of useless users in your database can slow things down significantly.

An attacker can use a botnet to try to login your site from a list of username/passwords from the latest big data breach.

They will get likely access of a small percentage of those accounts and you have to do damage control.

Entirely disregarding how it is browsing with Tor and finding ReCAPTCHA so often due to Cloudflare, it's a bother even on a website I regularly use over my normal connection.

Bandcamp is an online music store and I'm prompted for a Google ReCAPTCHA every time I try to log in, which really causes me to do it less often than I normally would, as I must permit Google JavaScript for it to succeed.

I've wanted to send a complaint about this to Bandcamp, but their email is hosted by gmail and none of my messages get to them because I host my own email. Adding reverse DNS and SPF is enough for many email servers, but not Google.

I find it a bad situation that my experience with a business is worse, due to Google, and I can't even contact them to let them know, due to Google.

> “Google is so deeply integrated with the internet,” Khormaee says. “We want to do anything we can to protect it.”

This is outright creepy.

I know people are (rightfully) worried about centralisation on the Internet, but I still wonder how come there's virtually no "competition" to reCaptcha. Even from one of the "centralised" players.

For example, even Cloudflare, which has its own "checking your browser" protection, still uses reCaptcha in some other cases... Why doesn't Cloudflare offer a reCaptcha alternative to their customers? (a transparent one, more like reCaptcha v3 rather than the intrusive 5-second one...).

> According to two security researchers who’ve studied reCaptcha, one of the ways that Google determines whether you’re a malicious user or not is whether you already have a Google cookie installed on your browser. It’s the same cookie that allows you to open new tabs in your browser and not have to re-log in to your Google account every time.

I try to never be logged into my google account as a matter of principle. Maybe I'm just fooling myself thinking this will make tracking me more difficult.

You don't need to log-in, to be tagged with a cookie and subsequently be identified. Sometimes referred to as "anonymous authentication".

I'm much more worried about ideological persecution than targeted advertising. It's very easy to think you are doing the right thing, everyone thinks that.

Next step: recapcha pro. $29 a year (by CC or Googlecoin of course!) to browse the web free of recapchas and be able to use your favourite sites again.

$29 to spam the web to my heart's content? I'll take infinity of them!

reCAPTCHA apparently doesn't stop bots well at all.

When I published a brand new site, I got thousands of bot sign-ups in the first couple weeks. reCAPTCHA apparently had no effect on stopping them. The bots signed-up with real user emails, causing my site to send unsolicited email to them, which affected my domain's email reputation significantly.

I rolled my own invisible CAPTCHA and immediately stopped ALL the bot traffic.

This is 100% accurate. There is no way to stop bots through reCAPTCHA, doesn't matter the version. It's honestly trivial and can be done with even the most basic web automation skillset.

Rolling your own CAPTCHA is a fantastic option, because folks like 2captcha are never going to take the time to integrate against a one-off solution. When you do something like that you drastically increase the barrier by introducing the need for a reverse engineering skillset to bypass your unique solution... and that skillset is expensive lemme tell ya ;)

I had to test a simple contact form implementation with reCAPTCHA yesterday on an office worker's PC that was running Chrome.

I spent all day clicking on sidewalks ans traffic lights! Or buses. No idea what they want the clicks on buses for.

I actually had problems upstream of the CAPTCHA. This was on a Wordpress site and I was patching up the Contact Form 7 implementation on there.

What shocked me was how naff Wordpress is. After however many years it does not come with a contact form built in. Comments yes, but a contact form, no. Then the fairly de-facto Contact Form 7 would not work with Google Captcha 3 and the latest V5 Wordpress. So there must be hundreds of sites out there with contact forms that do not work. Then there are people cussing ReCaptcha when there is this hideous mess of bloat going on.

The Contact Form 7 didn't even use HTML5 form validation and styling it was a nightmare.

I eventually went to CAPTCHA2 with the box you tick. Having the v3 box in the bottom right of the screen on every page was not what the client wanted. Plus it didn't work with this kludge known as Wordpress.

I think the issues raised in the article are not that big a deal. If you have logged in to Chrome and you are on your normal device and IP address then you can get a free pass. Why not?

I seriously advise anyone to test their implementations on a non-logged in PC, it is an eye opener. And a time consumer. But forms have to be made to work. You can't have people locked out.

There is a lot to be said for backend validation based on form data, I like to make forms unique with a hidden timestamp in it that is MD5 encoded. You can then see if someone has spent long enough on the form for it to be 'real'.

Any app should be clear and upfront about what data it collects and how it collects it, and what it does with it.

The platforms - web-browser or operating system - that run these apps - web app or native app - for the benefit of that user - should provide well-understood intuitive experience around what is allowed/possible to be collected and used from the user's device.

Now, technical mechanisms are one major part of the solution. In this regard, these mega corps should be held to a higher standards as they run the platforms as well as the biggest apps on those platforms.

But we also need legal protections that make both the application owners and the platforms owners responsible for any abuse of the user.

This particular case is eerily similar.

Credit card fraud prevention companies do the same thing - they say they need to know as much transaction data as possible in real-time for them to know which is a legitimate transaction and which is a fraud transaction. There is misdirection and fog around how they justify this with thinly veiled technical explanations about network effects and criticisms about monopolistic by design.

The reality is fraud can be prevent by designing the product differently in the first place - chip & pin - multi-factor authentication etc. technology is present to prevent theft and fraud without having to collect so much data centrally.

In this case, similarly, to prevent DDoS attacks, there are other anonymous non-data collection oriented solutions possible. More research and collaboration is needed to evolve the Internet architecture to react to DDoS attackers and other types of technical abusers of your app, catch them and prevent them from growing. Instead, we get these centralized monopolistic solutions.

>For instance, if a user with a high risk score attempts to log in, the website can set rules to ask them to enter additional verification information through two-factor authentication.

This defeats the purpose of using 2FA: to require a second factor every time you login. This completely negates the benefits of 2FA if a hacker has gotten my username/password through a keylogger. It's easy enough to get a good score if you just disable tracking protections and login to a Google account, then a hacker can easily break into your account. I was thinking it had to be the author not understanding how 2FA worked, but Google is actually advocating this ([0]):

> login With low scores, require 2-factor-authentication or email verification to prevent credential stuffing attacks.

You would think the people behind recaptcha would understand how 2FA is supposed to work.

[0]: https://developers.google.com/recaptcha/docs/v3#score

I think "real" 2fa isn't going to care about what ReCaptcha v3's trust score is, the case for this is "this user has a recaptcha score of 0.2, they don't have any cookies for this site, and [other system] also thinks they are suspicious. Let's require extra email verification and/or ask to answer a security question".

Recaptcha is only used on 25% of top 10k websites? Anyway, I’m very angry about the way the web is made to work, especially identity, and usually I would spew a bunch of anger and swear words describing how stupid it is and all the people who blindly support it but I don’t want this to be censored so instead I will behave myself!

This is hilarious because this is the worst, most needlessly complicated solution to identity that one could ever imagine. It’s funny how it apparently takes a PhD to tell you that google isn’t analyzing your behavior on the website. They track you across every webpage you visit that has their code running. And it goes way beyond cookies. Look at the filter bubble research that duck duck go did — they have an idea of who you are regardless of what cookies you have or whatever else. And this data has informed captcha results before this latest iteration. It’s complicated, needless and also gives a bunch of sensitive data to a private company that shouldn’t have it. Nobody cares.

Identity services are the alternative to this. Have a company that has multiple ways of verifying identity including operating physical locations where you can show up and prove beyond any doubt that you are person X. Once identity is established, something like a yubikey or whatever can be used to authenticate various things like making an account on a website or what have you. If you get hacked then you can rectify by engaging in one of the identity verifications tasks, up to and including coming in person and being biometrically verified with absolute certainty. The company would make money with modest fees to users and charging websites to use their service to verify their users.

It should be that the government has all this in place, and you can use secondary identification numbers for websites. But I’m the United States identity is broken, based on a shitty Ssn where if it’s stolen you are basically fucked.

This makes sense to me. The presence of cookies is a strong indicator of normal human browsing, and Google would only be able to see their own cookie.

Except a lot of people don't like Google having persistent cookies that track your web usage. Why should giving up that data be a prerequisite for accessing a website?

> Because reCaptcha v3 is likely to be on every page of a website, if you’re signed into your Google account there’s a chance Google is getting data about every single webpage you go to that is embedded with reCaptcha v3—and there many be no visual indication on the site that it’s happening, beyond a small reCaptcha logo hidden in the corner.

There’s a potentially bigger risk being overlooked. Google can execute first-party script. This means they get every user’s session credentials and can freely impersonate that user. So can all the other trackers in use.

I don’t understand how anyone thinks this is remotely okay.

I get score of .7 in Safari. .3 in Chrome if not logged in/paused, but a .9 if logged in. Always hate that in non-logged in chrome browsers I have to fill out those picture questions a 100 times seemingly endlessly.

> Google encouraging site admins to put reCaptcha all over their sites

hahah, wow. Put this tracking software suit on every page please - it's for your own good!

I used to kinda believe in Accelerationism[1] - philosophy where you encourage and accelerate flawed systems to promote a breaking point. However it turns out our society doesn't really have a breaking point.

1 - https://en.wikipedia.org/wiki/Accelerationism

Yet, I can't visit websites because I don't want be tracked. What's worse is this stupid thing even shows up on government, university websites ect...

I can't seem to find what rules for uBlock Origin and others will block reCAPTCHA v3.

I'm noticing that little blue bock in the bottom right corner of more sites now and I think I just want to block it entirely. If a site won't let me login because of it, guess I'll just stop using it. If it's something like my Bank .. well guess I gotta get a new bank.

Nothing really excuses this level of potential tracking.

Not sure how this is any worse than the Facebook "like" button that's on every website on the planet.

Sure, we hate that, but it's there, and plus, Google probably already has a cookie on your computer anyway.

Given all that, this seems like a very minor privacy loss to whine about compared to all the other crap that Google/FB/etc does.

Please help me if I'm missing something unique about this particular issue.

Same box, same physical location. Chrome I get a score .2 higher then firefox, despite the fact that I never use chrome for anything...

If it takes me longer than 5 seconds to access the content I'm looking for, I close the tab. Am I alone in this?

I doubt you're consistent with it. You'd probably wait 10+ seconds to post an HN comment for example.

Easy to say you'd bounce on a website you didn't care about. That's a bit of a tautology.

How else do you want to detect humans in a widely-used centralized service like reCaptcha? This is the result of laziness of website developers. There could be thousands of custom captcha implementations but instead, most devs just put recaptcha there and they're done.

Could anti-competitive suit be raised towards google regarding their reCaptcha? They aiming to have (if not already) a crawler blocking tool that obviously doesn't block their own crawler.

Doesn't that sound a bit dystopian?

You can block googles crawler with robots.txt

`It works best with context about how humans and bots interact with your website, so for best performance include reCAPTCHA in many places` O.o

_It works best with context about how humans and bots interact with your website, so for best performance include reCAPTCHA in many places_ O.o

My confidence in Google reCAPTCHA is diminished by their admin site.. can't edit/change "reCAPTCHA type:v3" settings.

Is it possible to inject code that will provide that kind of reCAPCHA fake but looking as legit data and bypass its check that way?

Time for a separate computer just for when i am forced to interact with websites using Googles recaptcha for paying bills etc

What are the open source alternatives to this?

Luckily Idon't need any of the sites that ues this obnoxious tool.

Just vote with your feet and tell the site to drop it or lose you.

Yet you're on a website that uses ReCaptcha.

Just tried to register via Tor and got this: https://i.imgur.com/svjfLqo.png

Kind of toothless to say "I'll NEVER use ReCaptcha (except for websites I want to use)!" In fact, I'd go a step further and assert that, while you complain about ReCaptcha, you're actively benefiting from HN using ReCaptcha since you see less spam day-to-day because of it. ;)

What about Google Analytics? They already have all my browsing history. reCAPTCHA data is not even as detailed as GA.

Difference is you can block Google Analytics and the websites continue to work.

Don't 'whatabout' us and change the subject, we're talking about reCAPTCHA now. If you must know, the key difference is that you can block Analytics and still use the site, but are denied access if you block CAPTCHAs.

I now leave any website that has google recaptcha unless it’s really necessary for the same reason

I just want shout out a previous article published here in HN that sparkle a quite interesting conversations.

https://news.ycombinator.com/item?id=20158386

Long history short, don't use a captcha if you don't need it. And most of the time your website don't need it.

Is it just me or is the site broken? I see it for a quarter second, then the page turns blank.

Wait until they make google-webassembly-blobs mandatory, it will get even worse.

add this to the list of how Google's open source engines work! ex how they treat captcha in other browsers ( easier captcha/validations for chrome users and beating the crap out of Firefox users)

Everything Google does has a dark side. They are a parasitic corporation.

“Google’s ... has a dark side” is valid for almost everything they do.

not sure how Google can keep making their product worst and keep getting more customers...

Every 3rd party service has a dark (or grey) side. This is a trade-off for offloading some functionality onto 3rd party.

you will identify yourself to google, or you will be denied the web.

There is a light side?

And the bright side?

Congratulations to the reporter who found reCAPTCHA after 10 years

Is this a surprise to anyone in this community?

It also doesn't block bots

there is a light side?

Remember every time you complained about China's citizen score system?

Now remember that every interaction with the government must happen online (from requesting a US visa to going to the DMV), and all those forms are behind a Google(R) Captcha(TM) censorship system, which ranks users based on how well Google(R) can monetize the current user browser session. Let that sink in.

This is probably good for proxy users, since it probably isnt just tracing a polluted IP anymore

But Im not sure, since the browser sessions for some proxy users like TOR exit nodes are so short

> one of the ways that Google determines whether you’re a malicious user or not is whether you already have a Google cookie installed on your browser.

... can we please get a serious antitrust investigation now?

So you are so afraid of being tracked? you don't wanna give any ounce of your data? but you still want to have full access to the web, and for free?!! The world doesn't work this way. Either pay for what you get, or be prepared to accept ads/tracking. It is that simple.

I pay money to plenty of businesses and most of them still embed loads of advertising/analysis/tracking scripts. Seems less simple than you make out.

Reply on news.ycombinator.com