Google significantly reduces recaptcha free tier, introduces new pricing models | Hacker News Reader

Google significantly reduces recaptcha free tier, introduces new pricing models

bytepursuits.com

76 pointsthunderbong94 comments

For the number I fill out in a week, Google should be paying me for the labor. Please, spike that price as high as you like. In fact go ahead and reduce the free allocation to zero while you’re at it.

I'm tired of picking motorcycles, busses, stairs and bicycles. Someone please clarify if you are supposed to pick the squares next to the object if they only have a tiny bit of the object there.

And the actual process often fails to load some part of the picture, so then you have to refresh and start over. You can never just refresh the current 'test image'. I had captchas, because I figure the spammers have worked around them, and they constantly waste my time.

>Someone please clarify if you are supposed to pick the squares next to the object if they only have a tiny bit of the object there.

I dunno, I intentionally pick the wrong items in the second Captcha challenge to poison their ML dataset, as Google's not paying me to be their forced-labor mechanical Turk, and I hope everyone does the same. Suck it Google, you trillion dollar cheapskate, pay for your damn labor.

Back when they were using the two word ones, a common meme on the internet was to put a swear or epithet as the second word.

Awesome! I'm doing that also but I was thinking that I was kind of an exception. I'm happy to know that others are doing the same!

I do as well. If anything looks remotely similar to what I'm providing the free labor for classifying, I make sure to click that in the tiniest of hopes it does mess up their training.

I find that intentionally selecting a wrong square or two increases my chance of "succeeding" in solving the captcha.

AND they try to push terms like “crosswalk” on us? Click on a “crosswalk”? No idea what that js, all I see is a zebra crossing. I already have to correct my son every time he says “on accident” and it will be a cold day in hell before I accept “crosswalk”.

> have to correct my son every time he says “on accident”

This used to bother me as well. But it is actually reasonable, since we have no objection to the opposite evocation of "on purpose". The language is just mutating normally.

I was mostly being facetious but “on accident” is a hill I’ll die on. It’s like nails on a chalkboard.

It's funny that you choose to die on a hill that I can't even see.

What is wrong withg the phrase? Seems normal and correct to me.

Its an Americanism. “By accident” is more acceptable in the UK

Ha, as an American I struggled and failed to think of the "correct" wording that was alluded to.

"by accident" sounds correct and I wouldn't second guess hearing it, but yep, "on accident" is what comes to me naturally when speaking.

Is crosswalk a NA regional term for pedestrian-crossing?

It is a term, the term I’ve always known that is synonymous with a pedestrian crossing, and I guess it’s regional?

Is your Accept-Language header set to en_US?

Not sure to be honest, I’ll have a check tomorrow. I’m not genuinely bothered by it, hopefully my rant came across in the playful tone I meant it.

I do normally set the language in places, otherwise all my s’s end up as z’s (pronounced zed).

No, they just don’t care. Mine is definitely set to British English and I still get crosswalk all the time.

The ML dataset is so badly poisoned that I've switched to doing the audio version. Otherwise I get it wrong a couple times and it gets locked for an hour. This is rough when I'm trying to scan PortableApps.com releases before posting.

I like to think I helped poison it over the years just a little to always selecting a wrong object with all the right ones over thousands of uses.

Google continuing to forge ahead with the drug-dealer business model...

Seriously Google, are you trying to convince even yourselves that you are just IBM with slightly better food? I mean, this change just reeks of "we're out of ideas but the bean counters told us we need to find change in the couch somewhere".

Their motto was "don't be evil," which translated to "don't take profits too early." Now they're in the profit-taking stage.

Sundar is doing to Google what Steve Ballmer did to MSFT.

Joke's on him. Steve Blamer has an estimated net worth of 120 billion while Sundar is estimate "only" at 1.6 billion. He could afford to hire Sundar as his pool boy.

He probably also has car who's doors open like this, not like this.

He’ll be a quatro comas member before too long. Not tres, quatro…

That comparison doesn't make much sense, since Ballmer made his money by holding on to Microsoft stock after he left.

As a visual aid for readers, car who's doors open like \|/, not like [|]

https://youtu.be/0oV4IVy8tvE?t=66

Hey, he's got my car. It doesn't make that beeping sound when you open it, though.

I think the open doors 'bong' sound is a feature to US/NA models only. Never hear it in Europe.

Guess they carried the European way to the US. The US-model Maserati Quattroporte V doesn't have a "bong" sound. I don't think they gave us any extra cup-holders either.

I'm too young to remember much about Ballmer, I just know his "developers developers developers" speech that was far more candid and meaningful than Pichai's speeches. And it was on point, provide stable tooling and APIs to Windows devs.

Oh you mean this?

https://m.youtube.com/watch?v=dB1SvnzLs8c

> with the drug-dealer business model

Except there's another dealer selling at the old price and a third one giving even more away for free. hCaptcha is a pretty easy switch, and Turnstile has a reCAPTCHA compatibility mode.

Firebase Auth is pretty common and widely used. Any sort of phone number auth, like SMS second factor, requires reCAPTCHA. (And people can complain about how much SMS 2FA is bad, and I don't really disagree, but it is still pretty much a "lowest common denominator" method and many, many web users can't easily use TOTP or hardware keys).

Switching out Firebase Auth is a much, much more difficult deal than just switching out reCAPTCHA.

Firebase is Google, so this is to be expected. Maybe they don't charge for those captchas though?

You can’t hate the player OR the game in this case because it works. It’s more like “fool me 100 times, shame on me”

It’s funny to me how often the “first one’s free (or cheap) “ playbook gets used on Amazon, AirBNB, Uber, Netflix, Google, Facebook (with FB API), Datadog , Splunk – and still continues to work.

Create a service and run it at a loss subsidized by investor funding. Customers & Partners naturally adopt it because it’s cheap in the short term and they lack long term thinking. Kill all competition.

Once the customers/partners are hooked, and the competition is gone, jack up the prices .

Even massive businesses & consultants with actuaries fall prey to this, including hotels, movie studios, fortune 500s.

Just remember there’s no free lunch. If something is free or cheap then they are getting you hooked.

Seems like the lesson is to take advantage of free stuff (or low prices) while you can? Nothing lasts forever, but they got some good years out of it.

(Looks like reCaptcha started in 2007.)

Not always best, but in this case, yeah getting several years of free captchas would be worth. And it's not too hard to switch elsewhere if needed.

Been exceptionally wary of Atlassian's free beta products recently because of this.

I think there is a very different dynamic from what Google is doing and what some of those other companies are doing. For example, I'm not aware that AirBNB significantly changed their commission rates at all. I know originally lots of hosts weren't requiring taxes, for example, but that's really a very different thing. Similarly, I don't have as much of a problem if a company charges X per instance of something and then over time raises rates to, say, 1.25 * X.

What Google does, though, is charge 0 for X instances of something, and then say "we're providing additional pricing options" by now charging 0 for only 0.01 * X, but then everything else has a much higher per-instance cost. They also do this with products where the switching costs are relatively high. That's much different than just saying "Oh well, I'll cancel my Netflix subscription because they raised the rates by 25%".

It's dismissive to say that these customers all lack long-term thinking. Even if you can accurately predict that the free one is going to kill off the competition, where's the long-term thinking in using the competitor? Besides, upfront costs have long-term ramifications too.

Here are a few subject areas exhibiting short term thinking

* music producers and iTunes

* movie studios & Netflix

* retailers (e.g. Toys R Us) and amazon

* Zynga & FB

* Taxi drivers & Uber

* short-term-rental buyers (taking massive risk) & AirBNB

There are hundreds of these cases. Within 2-5 years the risk will change.

The solution isn’t “use the competitor”. The proposal I’m making is “don’t fund the business that is out to destroy you”

In most of these cases, the individual couldn't make a difference, especially taxi drivers.

Since switching from Chrom{e|ium} to Firefox, I'm noticing I'm having to fill in a _lot_ more captchas - is this just me, a coincidence, or is Google treating Firefox as less trustworthy?

iirc many bots use Firefox UA string as their own.

Why would they do that? Chrome is far more popular and therefore a better spoofing target

Google? Using its market position and suite of products to undermine competitors?

How dare you imply they would partake in such unbecoming behavior.

That's the punishment for ad-blocking and/or tracking mitigations.

I was running ublock origin on Chrome previously (as I am now on FF), but getting many more captchas on FF.

Get the requests all the time in Safari, but when using Chrome almost never. But most likely since in Safari, have all the anti tracking enabled as well.

Chrome is spyware to begin with; they know if you’re a bot out of the gate.

Captcha is redundant to the deeper spying Google does at this point.

Likewise captcha is useless against multimodal LLM available to anybody, many of which can be run locally.

I see this as a tacit admission captcha is a dead technology more than anything.

> Likewise captcha is useless against multimodal LLM available to anybody, many of which can be run locally

You have a fundamental misunderstanding of why captcha exists. If the attacker has to deploy a multimodal LLM to solve captcha, the service provider using captcha has already effectively achieved its goal - since the goal is to raise the cost (in terms of any combination of complexity, computing power, and dollar amount) of sending bulk traffic and ultimately to reduce, not eliminate, the overall attack rate. 0 bulk traffic is never the goal.

I very much do understand the goal and work in the field. Captcha is currently a bigger impediment to legitimate use than it is to malicious use.

The world has shifted and the underlying assumptions of the captcha design (computers are bad at vision tasks relative to humans) is no longer true.

We are also on the backend of a rapidly depreciating cost curve, and this will accelerate. People were already using mturk at scale anyway, and it was cost efficient.

In five years captcha won’t exist, and the entire “are you a human” paradigm is cooked.

I used Firefox full time years ago (5+) and absolutely had to fill in more captchas. I remember thinking it all the time. I also remember seeing a lot of "Must be opened in chrome," sort of things google related.

Chrome has your google auth SSO built in so I think chrome skips that skip, whether it's malevolent or necessary I wouldn't know.

It's not just Google, Humble has configured their cloudflare anti bot stuff so it randomly locks me out for days at a time for using Firefox on Linux.

Support refuses to go beyond "have you tried clearing your cookies" when I raise this with them.

Cloudflare is the largest, unnecessary, impediment on the internet nowadays.

I get a lot in Brave also. A friend runs a startup whose platform I use, and he was surprised to hear I get 8-9 in a row sometimes, even though I’m in a browser that I’ve logged in with hundreds of times. Crazy.

If you are logged into your Goolge account, you almost never have to do reCaptcha, and if you use any of the cloud features on Chrome, it requires sign-in to your Google account.

On FF, the Cloudflare bot protection has been by far the worst for me. I'm often locked out of sites for hours or days at a time. I'm assuming it's because I'm not running their JS?

Good, let it die. ReCAPTCHA is probably the worst captcha service available, anyway. God forbid if you're on a VPN.

I see 70 comments but I don't see anyone saying the obvious yet.

Google provided captcha as a service. Previously, the service was paid for by the user providing training for AI. This is equivalent to Google charging the website a few cents per X captcha, and the site providing a Google Opinions or similar where the user gets a simple task/question that is solved for a few cents credit. The user solves the task/question and pays a few cents to the site so the site can pay for the captcha service. The arrangement was strictly a win-win because the user would have to solve the captcha anyway.

recaptcha hasn't provided value in terms of training data for a long time now, years/decades before the most recent LLM boom AFAIU, so Google was providing the captcha service at a loss. Now they're asking to actually be paid.

Likely, Google is buckling down on its financials, like many other tech companies (and the layoffs are a similar symptom)

After doing the same for Google maps few years they just did it again. It's beyond me that anyone would use Google/GCP for anything serious. Services killed all the time (check Google graveyard), sdk and APIs constantly deprecated, prices increases, ... It seems google is doing everything wrong since at least a decade now.

I think it is a good reminder that with these services you can design your own usage around making it easy to switch providers. With maps it was a rude awakening, but there were so many other providers by the time they did the rug pull that at least there were places you could go. The ride might not last forever but you can take the API savings now while building and testing backup sources.

I just type the wrong thing in the audio captcha option. Works like a charm.

“politicians say that the industry” == “stalled morticians pay for the mystery”

And yet people still try to convince me that google's reputation is unwarranted and that relying on Google Cloud is perfectly fine since somehow it's "Different".

It never ceases to amaze me how often google shoots themselves in the foot and just ruins their reputation.

I cannot imagine relying on anything from google as a business. It just isn't worth the risk.

Google is more and more useless by the day. I use a VPN and I get a captcha challenge with every search, but that’s not all, I still get blocked with a message saying something to the effect of “we’ve noticed unusual traffic so we’re blocking you anyway” and I just can’t use Google at all.

Looks like reCAPTCHA Enterprise is increasing in price for orgs up to 1.02475m impressions per month, but decreasing for everyone above that. Reducing the sticker price from $40 to $1 per thousand could be transformational for some businesses. For big users, this seems great.

For medium sized users – 10k to 1m impressions – this sucks, but for many will only suck to the tune of $8/m. Users between 100k and 1m who haven't been paying the $40/k this is tricky, but I wonder how many are in that category.

The email seems confusing on this point. As far as I can tell, most Recaptcha features already cost $1 per thousand uses. The $40/k -> $1/k reduction applies only to the "transaction protection" feature.

Ah! Thank you, that does make sense. In that case this sounds like it won't be cheaper for anyone, but that in absolute terms there's a cap of $990/m for users right at the top end of the previously free allowance, and the $8/m plan for 100k impressions will probably account for many users.

Going from free to $990 is a huge price hike.

Sure, but going from $5000 to $5990 isn't that interesting a price hike. Without knowing the distribution of customers it's really hard to say how impactful this really is.

I'd guess that the majority of users fall into the <10k bucket, that there's a group of SMEs in the 10k-1m bucket that the $8/m pricing is intended to support, and that for enterprises the price reduction of the premium product will often entirely offset the loss of the 1m free impressions.

Cloudflare Turnstile is a free alternative, and there's also hCaptcha as a freemium alternative.

ReCAPTCHA is not effective if your users are any way motivated.

Also reCAPTCHA’s error rate is through the roof now. My nephew was unable to open a Steam account because it was erroneously rejecting correct responses and, of course, there’s no way to report this which won’t be ignored unless you can raise a fuss on social media or know someone who works at Google.

As AI models continue to progress, I have a hard time seeing how captchas will stick around. GPT-4 can surely already answer which squares have traffic lights in them faster and more accurately than I can.

What is the future of captchas? Reverse captchas - where only a human could do such a crappy job?

Doesn't look like the reCAPTCHA pricing page (https://cloud.google.com/recaptcha-enterprise/pricing) has been updated to reflect this.

Wait, Google wants to be paid for having other people train their AI?

So now that Google has extracted all that free labor to train their algorithms, they begin to close the spigot.

I don't care, really. reCAPTCHA and the like can't die fast enough.

Is there an official source for this yet?

I got an email with exactly the content they described, didn't have a link to any page about this.

The text of the email I received (I assume you got something similar):

Dear -snip-,

Starting April 1, 2024, we will be expanding existing features and providing additional pricing options for Google reCAPTCHA product tiers.

What do you need to know?

Starting April 1, 2024, the following price changes will be available with Google reCAPTCHA:

Inclusion of transaction protection in reCAPTCHA Enterprise and a price reduction from $40 to $1 per 1,000 assessments. reCAPTCHA Enterprise will also include 10,000 no-cost assessments per month instead of 1 million. Addition of reCAPTCHA Standard for bot protection at $8/month for up to 100,000 assessments per month. Renaming of the reCAPTCHA no-cost product to reCAPTCHA Lite, providing protection for up to 10,000 instead of 1 million assessments per month. We will continue to provide 1 million no-cost reCAPTCHA Enterprise assessments per month to eligible Nonprofits, Charities, and Libraries.

What do you need to do?

Please complete the following actions based on your Google reCAPTCHA product tier:

Existing reCAPTCHA Enterprise customers on a subscription contract:

Nothing changes until your next renewal date. If your renewal date is after April 1, 2024, you will have the option to renew into the new reCAPTCHA Enterprise product.

Existing reCAPTCHA Enterprise customers on a pay-as-you-go model:

You will be automatically upgraded to the new reCAPTCHA Enterprise product after April 1, 2024.

Please monitor your usage and make sure your new monthly bill is as expected at the end of April 2024.

reCAPTCHA Classic (Non-Enterprise) customers:

No action is required from you.

You can upgrade to reCAPTCHA Standard or reCAPTCHA Enterprise to use the additional features.

Eligible Nonprofits:

Your affected projects are below: -snip- Thank you for choosing Google reCAPTCHA.

—The Google reCAPTCHA Team

Yes, that's the same email.

Happily using Cloudflare Turnstile! Works like a charm.

Does google reCAPTCHA have anything that other captcha solutions dont?

Or what will stop people from using cheaper/free alternatives?

If you use anything other than their offering, and the Google bot gets hit with a captcha, Google won't crawl the page. They give themselves an exception with their own offering.

In pretty sure that most major CAPTCHA services exclude the Google bot.

Tangential, has anybody switched to the proof of work open source captchas and happy with it?

Question: reCAPTCHA prevents automated browsing but does it allow Google through?

According to the Google video linked on this page: https://www.searchenginejournal.com/google-cant-see-content-... , "Googlebot doesn’t fill out any captchas. Even if they are Google-based captchas we don’t fill them out." That's from 2021, no idea if they changed it since then, and it probably works okay with reCAPTCHA v3.

That seems specially worded. Would it need to fill them out to be allowed through? reCAPTCHA is served from Google servers and the Googlebot is on Google servers so couldn't they just report the Googlebot as human?

I'm surprised they didn't just kill it outright if the data is no longer worth providing a reasonable price (hCaptcha seems to offer 1 million free still, Cloudflare claims unlimited use).

Google uses it internally, so they probably can't kill it outright. Might as well make some money from clueless enterprises while they're sunsetting it.

At what point do they start charging for all Gmail?

That's exactly what I was thinking. If they started charging $5 per gigabyte of gmail storage with 10MB of free storage they would instantly rake in a lot of money while simultaneously pissing off 20% of the world (total guess at gmail's market share).

Reply on news.ycombinator.com