Hacker News Reader

Comment by cJ0th | Hacker News Reader

It says that they do take mouse movement into account but the cookie part makes me feel a little uneasy:

> IP addresses and cookies provide evidence that the user is the same friendly human Google remembers from elsewhere on the Web.

If this becomes a trend then major commercial websites will become unusable for people who are not accepting (third-party) cookies. "Because those damn bots" is a straw man argument to make people trackable by assuming that there are no other useability improving methods that don't track the user (which I think is highly unlikely).

View on HN

It's only used to generate a confidence level.

"In cases when the risk analysis engine can't confidently predict whether a user is a human or an abusive agent, it will prompt a CAPTCHA to elicit more cues"

So if you have cookies disabled, you'll probably just get a regular captcha

that is the bait part of the bait&switch strategy.

Just ask anyone older enough to have worked with Microsoft et all in the past.

yeah, the company is nice now, but nobody can say anything about tomorrow. So do you their sane offerings, but be aware that you may have to be on the line to change it at a moments notice. and try to not depend on it too much. (i.e. always have a 1% bucket with an alternative solution, least you find yourself locked in when you 'thought' you had an alternative if you 'needed')

Sorry, can you expand on their long game here? They've just made it easier, is that the bait? Captcha was already everywhere so it doesn't seem they needed bait to popularise it? It's also used by non Google companies who will presumably stop including it if Google decide to make it an impassable lock - which would I guess be the switch? Making it harder would just be back to before, so an actual effective switch would just be a lock? Which doesn't make sense for the obvious reason that Google make more money in their services are accessible. What are you getting at here?

if they drive all other are you a human solution out of market (they already own captcha which most sites can't exist with without being drowned in spam) and then start to charge/show intrusive ads on it, then you have no option other than accept it.

The regular CAPTCHA is already approaching the point of being unsolvable for mere humans. If the only people who have to use it are cutting into Google's profit margins by blocking tracking, that gives them even more incentive to make life miserable for those users.

okay, that's reasonable.

But then a bot need only copy a human's mouse movements and disable cookies and we're back to the status quo.

Sure, for the bot. Captchas are pretty effective against bots, what's wrong with presenting the status quo to a bot? This is meant to improve things for the real people. I will appreciate not having to decipher some strange text.

I'm just not convinced from what's been shown that they'll have a long-term ability to distinguish between human mouse movements and those of a bot. So I'm curious as to really how one can keep this in place before it's overrun by spam and you need to make it more difficult anyway. More power to them if it works, but they're pretty light on details that inspire confidence, IMO.

i'm sure no one at google thought about that

There's no call for sarcasm. Do you have more insight into what data could allow them to distinguish between bots and people? If you do please share, because the Wired article and Google's own marketing video don't provide much information - it's obviously more focused on marketing than the technology.

why would google voluntarily give up that information?

That's not reasonable, its yet another way google is monitoring everything I do online.

well yes and no. In a way it is a win-win situation: It is reasonable in that it doesn't aggravate the situation for those who block cookies. (yet) And those that allow cookies get at least some convenience in return for that.

However, looking from a different perspective you can say that they're taking advantage of people blind with greed who want maximum convenience when using the web.

What makes you think they weren't already monitoring?

I'm using a tablet device, thus no mouse, and it gives me a captcha whenever I'm not logged in..

Really is this the breakthrough of bot detection? They are just leveraging cookies --which is nice improv UX-- but why do I need to click? delay loading to relax servers?

Well, it's probably that most sites you get a captcha on, give one to everyone... this will only reduce that for real users.

On the flip side, there are other events to hook into... onfocus/onblur, keydown, etc, etc... which can all go into bot detection... if you fill out a form and didn't focus on anything, click on anything, or press any keys.. you're probably a bot... If you have JS disabled, you deserve what you get.

For now I'm you'll just get a captcha if you don't match the standard behaviour. But it's that little bit easier to just use Chrome and stay signed in to Google all the time now. That's good enough for now surely.

It also makes your cookies valuable to spammers.

Reply on news.ycombinator.com