The Dark Side of ReCAPTCHA3 | Hacker News Reader

The Dark Side of ReCAPTCHA3

blog.edned.net

Pure fearmongering. Apparently if a buyshoesxyz.com shares with Google the fact that you bought shoes, and Google later uses that information to let you through ReCAPTCHA v3, that's "not safe". Not safe from what, exactly, is not explained. You're just supposed to take the author's word for it that something, anything, bad could come of it.

Also, the author gets something else that's very important, very wrong: ReCAPTCHA does not silently block people because they're afraid of "legal risk", but because studies show that silently blocking people after they sign up is much more effective at stopping bots.

Seriously, authors should do some research before making a blog post based on their first impressions and assumptions.

> Apparently if a buyshoesxyz.com shares with Google the fact that you bought shoes, and Google later uses that information to let you through ReCAPTCHA v3, that's "not safe"

It's not safe when the third-party the data is shared with has a global view of the internet, spyware in the vast majority of websites and even some mobile apps, and has a business incentive to use this data to stalk you for ad-targeting purposes.

The author seems to be quite clear as to what kinds of data are sent to Google:

> Since reCAPTCHA v3 scripts must be loaded on every page of a site, you must send Google your browsing history and detailed data about how you interact with sites in order to access basic services on the internet, such as paying your bills, or accessing healthcare services.

> It's needless to say that the kind of data that is collected by reCAPTCHA v3 is extremely sensitive. Those requests contain data about your motor skills, health issues, and your interests and desires based on how you interact with content. Everything about you that can be inferred or extracted from a website visit is collected and sent to Google.

Maybe that's a thing some users like you would be fine with, but in this case it should be laid out explicitly and (at least as per the EU GDPR) it should be opt-in. Buying shoes on a shoe retailer's website shouldn't require being stalked by a multinational spyware operator, and especially not without disclosure.

> It's not safe when the third-party the data is shared with has a global view of the internet, spyware in the vast majority of websites and even some mobile apps, and has a business incentive to use this data to stalk you for ad-targeting purposes

So the danger I face by using these services is... targeted ads.

> Maybe that's a thing some users like you would be fine with

So the "danger" is actually a good thing, maybe, for some people?

I'm just as confused as before, please clarify.

It's less the targeted ads and more the collection & concentration of all this personal data in a single place. There are lots of ways it can be misused if a malicious actor (or the government) gets their hands on it.

So it's not that "targeted ads" are bad by themselves, it's that they justify an industrial-scale spyware operation, which other malicious attackers could potentially co-opt to do their bidding.

Okay so, the chances that someone will suffer as a result of targeted ads is INCREDIBLY small, and yet it's somehow become completely acceptable to use the word "unsafe" as a shorthand for this extremely slim possibility.

Well it's incredibly small until there's a breach. The problem with security is that as a defender you need to win all the time, while the attackers only need to win once. So it's just a matter of time before something happens.

If the "matter of time" is a billion years, then I think we're fine. So my guess is that it's a billion years. Do you have evidence to the contrary?

It's only a "matter of time" before every human on earth is simultaneously struck by lightning while being eaten by a shark. But the odds are so astronomically low that it's probably never happened.

Since this thread is getting very long, I'll go ahead and say that the icloud hack of 2014 was targeted at celebrities (normal users didn't have their data leaked), and things like the equifax hack were things that a normal user has no way to opt out of anyway.

> Pure fearmongering

It frightened you?

No, but I guess it is you?

Not me, no. Only a tenuous connection to the writer.

Genuinely surprised by your use of the word "fear" and how that fits into our little battle pro, and anti Big Tech.

You see, if you're not frightened yourself, then isn't it a vicarious comment on what you project onto other people (those helpless little people who aren't intelligent enough to make up their own minds or reason about complicated things like the internet)? On the other hand if you found it genuinely unsettling then I couldn't understand your apparent support of it. That's all.

Wow, so NO one can ever use the word "fearmongering" because they couldn't possibly guess what effect a headline will have on people? Is that the argument you're making?

Yes. It's generally not okay to speculate about other people's states of mind to make your arguments. One ought to let them speak for themselves. Indeed you agree with me, that you "couldn't possibly guess what effect a headline will have on people?"

   "Whereof one cannot speak thereof one must remain silent"
    -- Wittgenstein: Tractatus Logico-Philosophicus

Well, please continue taking that line of logic to it's obvious conclusion, that we're all just souls living in Plato's cave, and we cannot know anything about other people, they may mot even exist. So why do anything at all? I'm sorry, I need to step outside of your philosophical bubble, and go do things in the real world. Rest assured that I will continue to make assumptions about the mental state of other beings, for it is the way that modern civilization operates.

Reply on news.ycombinator.com