Hacker News Reader

Comment by three_seagrass | Hacker News Reader

Latest reCAPTCHA isn't even detectible. It runs in the background of the browser and gives predictions for bot traffic.

The days of reading images as validation are going to be one of those "remember when" moments on the internet.

It works well when you’re signed into the Google advertising ecosystem. But god forbid you try to use Tor to browse the web, you’re going to spend hours of time every week deciding whether the pole counts as part of the street light and waiting for pictures of fire hydrants to load.

I use VPN and Privacy Badger + UBlock origin in Firefox containers (I use google in it's own container). I swear Google hardcoded this particular setup to go to the shit-list. I'm sick of buses, bikes and traffic lights. Wrote a lot of angry emails about reCAPTCHA to local government agencies and services for which I'm a logged in and I'm a paying fucking customer.

My favorite is when they refuse to even deliver the audio challenge. Surely that’s a violation of some law (ADA?) if it happens on certain websites.

I still pick bikes and road signs and markets in the same frequency as before. Didn't notice anywhere before reading this comment. I use Firefox.

Same here. My SO teases me whenever she sees one on my laptop, because she thinks I’m getting punished for being “bad” at identifying crosswalks and boats. Of course she uses chrome and never sees them.

I swear the algorithm is:

    (if isFirefox and isUMatrixLoaded)

It makes me wonder, are bots really more likely to use FF and ad blockers? Whenever I write scrapers and want to come off as human, I always use headless chrome spoofing non-headless chrome, and I never get captchas...

I’m also vaguely aware of headless chrome botnets used to mine ads. They definitely don’t use uMatrix. :/

Is this anticompetitive in some way?

Headless browser scrapers might blacklist things they don't need, like ad domains and trackers, since all they do is slow down how long it takes for their desired content to load.

The algorithm simply checks to see how often you check in with Google and how "human" your actions are based on the data you send to them via things like Search, Maps Location History, YouTube, Gmail, probably Chrome Sync, etc.

If you're using a completely new Google Account and block all of Google's Trackers, choose to use FastMail for your actual email communications, and only occasionally watch YouTube, Google has every reason to believe your IP is a residential proxy that's being used by a bot or perhaps someone in a third world country working at a recaptcha farm. They can't completely prevent the latter from solving their Captchas but at that point all they need is for the farm worker to help Google tune its self driving dataset.

I don't think there's anything going on here explicitly targeting Firefox. Adblock/UMatrix/etc are doing their job, blocking cookies and other tracking and heuristics that allow sites to decide you are "likely human" and skip showing you a captcha. Using Chrome (and being logged in with your account connected to Chrome) is providing a heuristic that Firefox cannot, allowing you to skip captcha since you are being tracked by the browser itself. So it's more implicit than explicit.

They're talking about ReCaptcha v3[0], which is completely different in comparison to current ReCaptcha that requires you tick a checkbox. The new version analyzes your behavior across an entire website and, when the website requests your threat score, it returns 0.0-1.0 with 1.0 being considered human.

The problem with this new system is that it doesn't solve the problem developers wanted to solve before: preventing unauthorized signups. Most developers don't want to know how likely it is that a user is actually a bot, they just don't want bots signing up for user accounts. With the new system, Developers have to decide what to do with a threat score. Should 0.5 require some interstellar page with a v2 captcha? Does a 1 or 0.9 mean they should give them access to certain data that might be otherwise hidden from boys? It's something developers generally didn't need before.

We likely won't see the "i'm not a robot" checkbox (/invisible recaptcha[1]) go away anytime soon since v3 solves different problems, but it does mean websites might start sending you down different verification funnels depending on how human Google thinks you are with no way to solve a Captcha that proves Google otherwise.

0: https://developers.google.com/recaptcha/docs/v3

1: https://developers.google.com/recaptcha/docs/invisible

Firefox + VPN and I have to do that and I get pretty blatant fake failures and end up having to do it numerous times. It honestly feels like Google is trying to punish me.

It has been 2–3 years already since I heard of the new reCAPTCHA running in the background. However, that must be dependent on Chrome or on some JS that Firefox NoScript users may leave disabled, because privacy-aware internet users will still encounter image CAPTCHA hell doing many ordinary things on the web, and the situation only gets worse if you add Tor to the mix.

The worst are the sites that don't have a fallback. If the new CAPTCHA decides you are a bot because, for example, you are running a VPN or something there's absolutely nothing you can do. Has happened to me two or three times.

Except when you use a couple of privacy-related extensions in Firefox and every other website forces you to mark bicycles or buses.

Or do these websites use older versions?

So long as you're using Chrome. I encounter them all the time.

doubt this very much since google is currently getting waaaaay too much free ML training data from captcha, and most users are blissfully unaware and happy to continue filling out their puzzles.

https://developers.google.com/recaptcha/docs/v3

Reply on news.ycombinator.com