Hacker News Reader

Tor/VPN/proxy users are legit users, for fucks sake.

They can't be distinguished from bots with tracking, and tracking is pretty much all v3 does. Google doesn't seem to care about collateral damage, I suppose it's the "why use VPNs/proxies if you have nothing to hide" mindset.

Maybe because not all countries function like yours.

Maybe they are studying security in a country where that is considered illegal hacking.

Maybe not everyone wants their data sold to parties that sell the ability to manipulate them to the highest bidder.

Honestly people that even think about blocking Tor reek of privilege and an assumption that they are above being manipulated by well trained AI fed a lot of their data.

Personally I use Tor on most devices and refuse to use sites that block it.

ReCAPTCHA demonstrates exactly what we all have to hide - being pervasively tracked by surveillance companies such as Google.

My only browsing activity that exits from my direct ISP's IP is my online banking VM, and that's only because one site got insistent about hard blocking everything else. These companies don't understand that they're screwing over real customers with this crap.

It's especially galling when my long lived static IP VPS exit [0] gets hassled. It's clear there isn't abusive usage from this IP, since I control it. I've had it for years, so it doesn't have a bad reputation. Yet these sites still want to fuck with me for their snake oil.

[0] Which doesn't win any awards for nym rotation, but at least hides my location and disassociates activity from my direct ISP IP.

>why use VPNs/proxies if you have nothing to hide

https://www.bbc.com/news/technology-50150981

Here's a pretty decent list that I usually use when demonstrating to people that the "deep web" isn't as nefarious as it is made out to be.

https://github.com/alecmuffett/real-world-onion-sites

> no sites with an "onion-only" presence

> no sites for tech with less than (arbitrary) 10,000 users

> no nudity, exploitation, drugs, copyright infringement or sketchy-content sites

Keep trying however you think best to convince people, but I don't see why this list would be very persuasive. With these rules, it's impossible to find anything that would make someone go "oh, that's something I want to use TOR for" if you're only considering sites that can be easily reached without TOR. In fact, I'd argue that sites on such a list are not really part of the "dark web" at all.

If you can't access them, then they are dark web, but if you access them, who knows what you access, maybe you're sending bombs somewhere.

Yes but we're a business. They're not profitable users.

edit: Downvote and be mad if you want, but payments made through known tor/vpn services are not getting through fraud review.

> Honestly, I feel like everyone would be better off if instead of reCAPTCHA, websites just used some service that automatically blocks proxies.

That's even worse than reCAPTCHA. At least as a human using Tor you have some shot at solving a captcha, even though you usually have to try 5 times or move to a different end node.

I've been caught in captcha loops before. It will flat out refuse to let me in and I will solve captcha after captcha after captcha. This has happened to me when using Tor, being prompted by that annoying Cloudflare "Attention Required!" page both when they were using reCaptcha AND when they more recently switched to hCaptcha.

It would have saved me quite a lot of time if those sites had just flat out said "403 Forbidden".

> Cloudflare

I'm starting to think that Cloudflare is even worse than the GAFAMs, due to its impact on so many of the other websites :

https://www.gigablast.com/blog.html

(If it can even be separated from them, considering that Cloudflare has received up to $110M from Microsoft, Google and Baidu !!

https://techcrunch.com/2015/09/22/cloudflare-locks-down-110m...

I also can't get through Google recaptcha. Proxy services rotate their up blocks so you can't simply block them all.

Captchas are in their infancy. We need to move beyond something that involves simply clicking to identify images - we're providing free training for AI, not to mention the fact that it's incredibly inconvenient for blind people.

I think a measure of uniqueness is required based answers to questions that don't necessarily have correct answers. The distance between the question and answer would be the measure. Identifying questions that provide consistent distances for individuals would be the hard thing.

Captcha have audio versions for the blind, no?

They're usually inaccessible if the system already suspects you of being a bot.

Yes, and it's absolutely solvable by bots (there's even a browser plugin for it[1]) so it isn't available if Google decides you are one. But it does work if you aren't that suspicious, so most of the time it should let blind users through. Well it's a bit more complicated because there are scores and such, but from an end-user perspective that's how it usually works.

Though if you aren't considered suspicious, image captchas are way less ridiculous, too. The scoring system goes all the way from .1 to .9, but usually you're either in one or the other category based on who knows what (probably mostly ip addresses, but Google doesn't tell us so who knows?).

So in the end the service is mostly just something that arbitrarily classifies users as one or the other, bots can absolutely solve them when classified as "probably human" and they're impossible for humans when classified as "probably bot".

If you want to actually present users a challenge to verify they're human, you're even better off giving them something like captchouli[2], or just a good old scrambled letters on a picture thing (which is what Google uses for their login as well, BTW). hCaptcha is also a great alternative (anything is, really) since it's still mostly about classifying users by making suspicious ones solve challenges. reCAPTCHA is absolutely not, it judges you before the challenge.

And that's fine, some websites want that. It's their choice, I'm not mad if they ban me for not wanting to be tracked, it's probably for the better. What does make me angry is that reCAPTCHA is advertised falsely, that the challenge is a joke and a crime against humanity at once, and that despite that, people seem to believe that it's the challenge that is magically blocking the bots without realizing they're also blocking legitimate users.

[1]: https://github.com/dessant/buster

[2]: https://github.com/bakape/captchouli

I like the idea of captchouli as it plays on the weaknesses of ML in differentiating between similar images. However, I still think advances in AI will force us to go further and use philosophical/psychological based captchas instead of pattern matching.

I wouldn't be able to solve the example captcha. I've liked a few anime. GITS, Death Note, I believe that's about it. I would need to search for the solution. Now, you may argue that is no problem for visitors of an anime board, but I believe its going to scare new visitors away. Due to this, websites would be less inclusive.

My guess about the future path is as follows: your government ID allows you to authenticate to generate a keypair you can use online for services such as Google and Facebook. It would include things such as a nickname, and an e-mail address as a derived public/private keypair you are able to use, including a scope (domain). Then, only such authenticated logins get full access (they are not going to phase this in like a wrecking ball, it would be slowly). Its perhaps a tad dystopian, but it has its pros and cons, and websites like GAB will continue to exist on darknet.

I had assumed in the anime captcha you were given an example of the character and told to identify all pictures of said character. Otherwise I couldn't do it.

A centralised ID system is one solution for authentication online but it's far from ideal.

No, it's a well known character.

That's probably a generous use of the term well known

"Broadly known in narrow circles" to be precise.

> A centralised ID system is one solution for authentication online but it's far from ideal.

A much better system is a decentralized pseudonymous ID system where getting an ID is in some way expensive but still anonymous, e.g. proof of work equivalent to $5 in cloud CPU time. Then legit users can create an ID once and use it indefinitely, but also create as many as they like and replace them as often as they like for a relatively low price.

Meanwhile spammers pay $5 for an ID that only lasts ten seconds before it gets banned and has all its messages retroactively deleted, so they go out of business.

Attaching monetary value is one method but you always disenfranchise some people with systems like this. Cory Doctorow explores reputation based identity in his book "down and out in the magic Kingdom" but it seems this also has downsides (tribalism, manipulation of rep).

It's a tough nut to crack. It goes under the term proof of individuality in terms of Blockchain.

> Attaching monetary value is one method but you always disenfranchise some people with systems like this.

This is always the claim but I don't really see it. Obviously if you put something on the internet then you disenfranchise anybody without a computer and an internet connection. But who is it that can afford a $50 device and a $10/month internet connection but not a one-time cost of $5 worth of CPU time?

I guess CPU time is different to actually asking for money. But it would probably just skew so that CPU was incredibly cheap as spammers/bots mobilised to have as much CPU time on separate IPs as possible... Or something like that.

There's always a way around incentive based methods.

> But it would probably just skew so that CPU was incredibly cheap as spammers/bots mobilised to have as much CPU time on separate IPs as possible... Or something like that.

If they had that amount of CPU time they would have the opportunity cost of using it to mine cryptocurrency instead, so it's still costing them $5 per ID.

So if you are blind and privacy concious enough to use Tor... No internet for you.

It's not so much different from the sighted reCAPTCHA+Tor experience, it just wastes less of your time by straight up telling you you're a bot. Also, for some reason, if you press the audio challenge button through Tor, it immediately bans you from the image selection one as well.

Yes, and that's a serious problem. For a while, I had to use networks that I knew were monitored, so I automatically reached for TOR for some stuff, but no luck. Cloduflare beat me.

for the english-speaking and not hard-of-hearing part of the blind population, yes. And the english speaking part is a pretty small one.

Their accessibility mode is "Give us your email and we'll probably think you're a human for a while... until we don't and make you use privacy pass... until we take away your tokens because yeah you're absolutely a bot.". yeah... no. Absolutely not. Also that thing doesn't work with incognito, nor vpn's/tor/whatever. I've stopped trying to bother with numerous sites, all running behind Cloudflare, for exactly this reason.