Opinion: On Google’s ReCAPTCHA Privacy Nightmare | Hacker News Reader

Opinion: On Google’s ReCAPTCHA Privacy Nightmare

hfet.org

46 pointswikus21 comments

> Ever clicked I’m not a robot? In doing so, you agree to Google’s Terms of Service and Privacy Policy.

There is no way this is legally binding right? Please?

I seriously hope not.

I'm curious if ToS's have ever been legally useful. I've heard cases where they've been thrown out and disregarded by courts when they conflict with (the judge's interpretation of) the common law, but never the other way around.

Not sure. Just to be safe, by not clicking "disagree" they agree to my ToS, which include an invalidation of previous ToS to which I might have agreed.

> A good start to this would be making the code FOSS, and allowing webmasters to self host it, rather than relying on Google’s black box proprietary cloud services.

Clearly, this could never work. You'd be giving the bot makers a clear and testable recipe for bot detection.

Captcha has been easily defeated programmatically for years.

https://github.com/dessant/buster

>Google’s tracking code is on more websites than any other, including Facebook.

Bonus: recaptcha is explicitly whitelisted[1][2] by most filter lists, so even using "tracking protection"/ad blocker isn't going to save you.

[1] https://github.com/easylist/easylist/blob/1fe73f353dce3e3eae...

[2] https://github.com/AdguardTeam/AdguardFilters/blob/43146e949...

I switched to hCaptcha on my home-grown blog comments. It was a drop-in replacement — they obviously have an incentive to make switching as easy as possible

Yeah definitely. I'm glad there's a good alternative like that around.

I try to browse with JavaScript off by default and a lot of sites just don't load anymore - and I'm not speaking of SPAs here. Anything Cloudflare had a 50/50 chance of throwing me a "please enable JavaScript to continue" error, and when it doesn't happen, anything that looks like an email address is filtered out.

And even if I do enable JavaScript wholesale, website isolation means that reCaptcha thinks I'm an evil bot because I don't allow it to see my activities elsewhere.

I had set up disabled fingerprinting, disabled fingerprinting via WebGL, website containers, a whole bunch of other stuff I cannot remember the name of in the Firefox preference list (you'll see why) in an effort to maximise browsing privacy and the result was I spent probably 30 minutes a day filling in reCaptchas; probably 2 or 3 panels per form -- and the ultra annoying slowly-fade-out kind.

hCaptcha was a lot less annoying for websites that used it but the end result was still a grotesque addition of friction to my browsing experience. I ended up resetting Firefox back to the defaults to un-set all those options I made a list of.

That's not a comment on Firefox of course; the sad state of the web currently is that in order to prove we're not a bot we seemingly have to give up our privacy (via relentless fingerprinting) OR your time (through hugely wasteful reCaptcha, and to a lesser extent hCaptcha fills).

I don't understand this excuse - If you have tracking protection, you will look like a bot.

Are the bot makers that dumb? Don't they set user agent to Chrome, disable all forms of protection and stuff?

It's actually really hard to look exactly like Chrome... Did your bot-browser return exactly the same error message as Chrome does when compiling corrupted webassembly? Detected!

Presumably they could just use real Chrome and control it with Selenium.

Ain't that significantly slower?

Yes, but considering a recaptcha only takes ~1 second of computation time, I wouldn't think it's cost prohibitive... Botters could just spin up more workers.

Real chrome has telltale signs when selenium is connected. For example, garbage collections happen more frequently when requestAninationFrame is called. There is also an extra startup delay for service processes while selenium is given an opportunity to connect (service workers). Built in extensions (like Google Cast) also behave differently.

> ReCAPTCHA needs to be redesigned such that it doesn’t serve as tracking

Obviously.

> and free labour for image recognition

Why?

Agreed, I don't see anything wrong in monetizing a service and making it sustainable if it is respectful of their users' privacy.

One could make the case that because Google is the biggest player in this field that this is yet another way they leverage their power unfairly.

As a webmaster you have no choice but to optimize for Chrome and Google search and to use Google ads nowadays. But do you really have to integrate Google Captcha? I can see no reason why people can't use alternatives or implement their own (I hardly know much about the subject though - you are very welcome to reveal such a reason).

Reply on news.ycombinator.com