Hacker News Reader

Comment by stickfigure | Hacker News Reader

They have no right to it, and I have every right to try to limit their visibility.

That's entirely fair! But also: You have no right to use my website, and I have every right to limit your access.

Recaptcha is simply part of this negotiation.

Is that so? What about the webmaster who simply wants to combat bots using his page, is the extent of data gathering on Google's behalf just part of the deal? What if selling user data is against the webmaster's ethics? "Don't use it I guess" Sure, except that no one in the exchange was told the extent to which this data is used, or what for. Users of Google's Captcha aren't told about this exchange. I disagree entirely that it's a matter of voluntarily opting in and out of Google's domain. Their business model depends on becoming inescapable, and they're not being honest about how their services collect our data.

> Their business model depends on becoming inescapable

What will happen with v3 if I block gstatic.com? Will I be given the highest threat score?

Wait, now you have me wondering: If this is just javascript from another domain, what's preventing bots from proxying requests, intercepting this one, and replacing it with a dummy function that returns a "no threat" score?

https://developers.google.com/recaptcha/docs/verify

So... the answer is, nothing prevents it?

When the API reports a failed verification, the webmaster knows that the response has been tampered with?

> You have no right to use my website

Of course.

> Recaptcha is simply part of this negotiation.

It is only a negotiation if I know it is there.

You’re commenting on HN, you know it’s there.

I do, and I can make an informed choice. Unless your website has a very eclectic audience, I’m not the only one using your services.

And what about the other 99.99999% of people that use the web? Do they also understand what is going on behind the scenes?

I didn't, but assume this is the case with everything. I mostly care about giving my data away for free (cut me in please), but none of my non-HN commenting roommates knew. Is their privacy less important than mine?

I'm commenting on HN. I've been developing for the web for 24 years. I don't know how and when my data is collected or shared most of the time.

The idea that FB and Google are openly making a trade with users is ludicrous. I'm horrified that you either sincerely believe that there's a fair negotiation happening or that you don't care (given your employment history).

I'm here, and struggle to follow many of the threads on HN. As a father, I don't really see how I can effectively prepare my kids for a surveillance internet.

I'm sure it will be mentioned in the 40 page privacy and cookie policy that pops up on every website asking you to agree before continuing.

Which is not compliant with GDPR.

And Im sure it wont be explicitly stated, but simply rolled up under some paragraph as a blanket statement, something to the effect of:

"We track all of your activities and provide third parties the ability to do so as well - to provide a better user experience - and we may or may not sell or distribute the collected data at our own discretion and continued use of this site grants us permission in perpetuity. Further, should you decide to sue us, you agree to binding arbitration at a venue chosen by us, conducted by an arbiter of our choosing, in which case you promise to lose regardless of outcome. If you disagree, please leave the site now but just know, by being here and reading this, you have already granted us this power and we've mostly already collected what we needed from you. Thank you. Stop wasting our bandwidth now. Fuck off!"

Privacy Badger will know it is there

> It is only a negotiation if I know it is there.

You're not going to get through a site with a properly implemented captcha just by blocking it.

The point is if you see a captcha you can actively decide not to use it. If the website has no such box then you can't decide not to use the captcha

That's not a sinister "land grab" by Google, that's a fundamental aspect of the web, predating the advent of JavaScript. You reveal your identity quite thoroughly to the individual hosting services.

And it's difficult to imagine legislating that away, as it's sort of fundamental to all network computing.

Except it happens on government-owned sites from the local to the national level where I have EVERY right to visit, especially as my tax dollars are paying for it and it’s for services that are available to the general public.

That's not totally true. If you provide access to your web site to people then in many places in the world you can't limit that access in a way that discriminates against protected classes.

In the US for example you can't set up your web site in a way that accessing it discriminates against people with disabilities.

That's what's great about GDPR. It makes privacy a fundamental right that can't be bargained away, much like you can't sign a contract binding you to slavery and you can't accept a bonus from your employer in exchange from losing your mandated breaks.

You don't have a legal right to limit access for the disabled, which is what services like reCAPTCHA3 are doing.

The bigger issue, for me, is for things like Facebook gathering data on third-party sites that I had no idea* were feeding the information back to Facebook.

An even bigger issue, for me, is having my face added to their facial recognition algorithms, despite never once tagging myself in a photo. Is there a way to opt out of this?

Recaptcha v3 is an invasion of privacy and a blatant violation of the GDPR.

It's as much of a negotiation as offering someone to pay through perpetually indentured servitude is: it's illegal and immoral.

Reply on news.ycombinator.com