Why can’t a bot tick the 'I'm not a robot' box?

https://www.quora.com/Why-can-t-a-bot-tick-the-Im-not-a-robot-box/answer/Oliver-Emberton?share=1

by grzm • 7 years ago

1002 610 7 years ago

The box has made browsing using TOR insufferable! It fusses and makes me click storefronts and traffic lights until I run out of patience and close out of whatever webpage I was trying to visit. I assume it has to do with a lack of Google cookies on the browser, essentially punishing me for trying to protect my privacy.

teilo• 7 years ago

Those images are infuriating!

Click all boxes with traffic lights. Ok, well, this one box just barely contains the bottom right corner of the traffic light. Click. Nope, that little corner didn't count. Try again. Ok, well on this one, the right side of the traffic light is only barely over the line, so I won't click it. Nope, that sliver of the light mattered this time. MF!

jsgo• 7 years ago

this on so many levels.

Thankfully they'll eventually fall back to the "click the images of _object_ until there are no pictures left with a(n) _object_" in it, but those clicking block ones of a specific picture are super frustrating.

SilasX• 7 years ago

Heh, maybe one day they can show a bunch of pictures of sand, where each subsequent pic has a grain removed, with the instructions "click on all the heaps".

Spambots will solve the Sorites paradox!

menacingly• 7 years ago

I assumed the infuriating ambiguity is intentional, in order to train some algorithm they need to know what the prevailing human correct judgement is in dicey situations

mehrdadn2• 7 years ago

I'm convinced the ambiguity is intentional. What I don't get is what answer they expect in those scenarios.

nomel• 7 years ago

I actually have a few screenshots where the task was impossible since the data was mislabeled. The latest example was "click all of the buses". It wouldn't let me continue because I wouldn't select the fire truck.

My naive assumption is that you should click the "refresh" button in these cases.

unclebucknasty• 7 years ago

Those images are infuriating!

And, does the pole count?

The whole thing is way more stressful than it needs to be for what it is.

Kalium6• 7 years ago

This might surprise you, but it actually has to do with what traffic coming out of TOR looks like. Well in excess of 90% of traffic coming out of TOR is spam, bots, malicious, or some combination!

Google isn't going out of their way to punish you for trying to protect your privacy. They're trying to stop unwanted traffic. By unfortunate happenstance, you appear to be disguising yourself in the exact same way a shocking amount of bad traffic is.

xiphias25• 7 years ago

They could use a memory-hard hashing function, like ARGON2 for proof of work, it would make spamming much harder.

malvosenior• 7 years ago

Well in excess of 90% of traffic coming out of TOR is spam, bots, malicious, or some combination!

Do you have any data on this?

byte1918• 7 years ago

I think you are partially wrong. Maybe Google is not doing this intentionally but it also doesn't happen just because traffic is coming out of a tor node. I am using ff with some of the recommended extensions from https://www.privacytools.io/ and I get to fill in traffic signs all the time. And yes I am logged into Google.

skykooler• 7 years ago

Google seems to do the same even if you check the box while in an incognito window; I doubt the issue is TOR itself, but rather the lack of tracking data that Google has on that particular session.

nprateem• 7 years ago

I think they do exactly that. For example disabling browser fingerprinting in firefox and not being logged into Google causes the majority of sites to display the captcha, especially when using a VPN.

packetslave• 7 years ago

This. The reality is, Google (and Cloudflare, and everyone else trying to block scrapers and malicious traffic) use heuristics that boil down to "99% of our traffic behaves like this". If you go out of your way to fall into the 1%, e.g. using Tor, disabling Javascript, randomizing your user-agent, etc., you're going to get CAPTCHAed.

mattlondon• 7 years ago

Not just for Tor.

I use Firefox with a few basic extensions (Privacy badger, uBlock, Google Container) yet every time I am presented with having to pick out traffic lights over and over and over again. I usually have about 5 or 6 "challenges" before I give up and use another site.

My timezone has not changed, my IP address and rough location has not changed, my screensize has not changed, my broadband speed has not changed, and my general computer dexterity has not changed, yet I am relentlessly targeted. On chrome I never saw these challenges, but on firefox with the privacy plug-ins I am always always always challenged.

At this stage I think the only signal it is using is "is there a google cookie in this browser? and if so has the google cookie got some 'normal' looking activity logged against it?" I.e. they are checking their server-side logs for a given cookie ID and seeing if that looks normal or not (i.e. seen on google search, seen on youtube, seen ads from a variety of third parties on various different sites, mixed up with time of day and speed of viewing etc etc).

Since I have got Google in a container in Firefox, I am guessing that my google cookie is not present when the captcha loads (due to the containers and privacy badger et al) so there is no identity back in the mothership to compare me against.

duxup2• 7 years ago

Google used to HATE my VPN, couldn't do anything on Google through it without a dozen damn pics to choose from.

My VPN must have gotten white listed (or cracked down on some of their traffic patterns) because that stopped.

enriquto• 7 years ago

Google isn't going out of their way to punish you for trying to protect your privacy. They're trying to stop unwanted traffic. By unfortunate happenstance, (...)

This does not agree with my experience. I browse without cookies and severely limited javascript (using umatrix), and I also encounter the myriad of ridiculous inconveniences that the OP was referring to. On the good side, however, the web is much faster and generally less annoying.

fock• 7 years ago

I have exactly the same experience without using Tor, living in Germany...

I personally don't care too much about the hassle, but I really don't like the idea that I'm basically playing Artificial "Intelligence"/doing clickworking for the not so community oriented efforts of Google.

briandear• 7 years ago

If Google wants to do that, that’s their prerogative. What pisses me off is when a bank or similar “secure” type of service forces me to train Google’s ML models in order to access my stuff. I didn’t agree to provide unpaid labor to Google.

imtringued• 7 years ago

This might surprise you, but it actually has to do with what traffic coming out of TOR looks like.

That's a massive load of bullshit. Google has a captcha challenge that only humans can solve. That alone is already sufficient to prevent unwanted traffic. That is how every captcha system works. However google is an exception. If you're logged in to a google account or are using chrome then google can use that information to track your captcha history. Privacy minded people avoid google like the plague and therefore they cannot be tracked.

Google isn't going out of their way to punish you for trying to protect your privacy. Except this is exactly what happens. It's not "unfortunate". It works like this by design.

If google cannot track you then the captcha will force you to do something that no other captcha system does: give you even more challenges even if you have solved them correctly. You will spend the next 5 minutes solving captchas correctly and then at the end it will tell you you've failed. This again is unique to google: correct answers lead to failure. The problem immediately goes away if you let google track you, it doesn't matter how bot infested the network is. No other captcha system does it this way.

Google is clearly doing this to get free labour to label their datasets, force people to have a google account and encourage them to use chrome.

wl• 7 years ago

Running uBlock origin seems to trigger the same thing, even on a static IP. It feels an awful lot like punishment to me.

muzani2• 7 years ago

Have you used Captcha on TOR? It really does feels like they're trying to punish you. They give you about 4 pages of "identify the traffic light", all of which are difficult for humans, then reject and give you another 4 pages. Or that thing where it fades out for about 7 seconds before you click the next image, and then wait another 7 seconds.

sjwright5• 7 years ago

As a webmaster I can confirm that I hard block all TOR traffic for this exact reason. 90% of this traffic is malicious robotic junk of some form.

Also, I’m just not interested in the remaining 10% "legit" traffic from people who are aggressively paranoid about their privacy. Almost all of them ended up being dickheads who were using TOR to abuse other members of our community.

To the people who think every website should treat TOR users with respect, please understand that you are intentionally making yourself indistinguishable from the mountain of robotic junk, abuse and human dickheads. It's not my fault that you have chosen to do this, and it's not my job to provide you with tools to prove you're not a dickhead.

gnulinux• 7 years ago

This is a horrible argument. What gave Google the right to be the moral authority of the internet (we, we did)? Even if 99% of exits from tor nodes are malicious, Google should have absolutely no capability to throttle this traffic. Unless you claim most of the traffic in tor are from bots, your argument doesn't make any sense. Captchas serve 2 purposes: slowing down bots, annoying humans. By putting captcha to tor exits, Google not only slows down miniscule amount of bots, but also annoys human traffic (good or bad). It is by no means a "good" thing that Google is capable of this.

xiphias25• 7 years ago

The worst thing is that Cloudfare is using ReCaptcha, and it's everywhere. The internet is broken at this point.

StavrosK2• 7 years ago

CloudFlare at least is using a thing where you only have to solve a ReCaptcha once, and then you can cryptographically prove you did, without compromising anonymity.

kojackst• 7 years ago

It goes like this: "so you want to be anonymous and won't let us track every single thing you do? ok, then you'll help us train our AI so we can improve our self-driving cars and improve how Google Maps extracts information from Street View images"

etiam• 7 years ago

I always figured the main point was behavioral profiling on mouse and keystroke trajectories.

modzu3• 7 years ago

get this.

https://addons.mozilla.org/en-US/firefox/addon/buster-captch...

superkuh• 7 years ago

I guess Mozilla hasn't noticed that one yet. They've been removing captcha bypassing add-ons from their site. And because all Firefox versions that aren't buggy require add-ons to be signed by Moz it makes distributing them through other channels rather tedious.

michaelmrose• 7 years ago

Have you considered an out of country vpn? The privacy protection may be similar for most common browsing.

bluedino2• 7 years ago

Too bad more and more services block VPN’s.

mtgx• 7 years ago

It's insufferable even without using Tor. And it only gets more insufferable every few months, it seems.

buboard• 7 years ago

Well OK, for Tor it is understandable. But I got the same every time i launched GTA V

BoorishBears• 7 years ago

That’s because Rockstar had/has a huge problem with stolen accounts from bots using wordlists to brute force passwords.

The difficulty is probably cranked all the way up

gsich• 7 years ago

https://github.com/dessant/buster

A very good addon against the shit from Cloudflare and Google.

gcb07• 7 years ago

that's good. tor traffic should not leak on the open web. that just diminish tor network and cause headaches to node operators.

if you care about all that, run a node without internet exit, and also strive to make your sites available on tor (hate the "hidden service" nomenclature)

dtrailin• 7 years ago

I get the feeling that 90% of the check is if you are signed into a Google account, otherwise you're going to click some images. I've noticed this a lot of incognito mode where I will almost always have to do a captcha.

akvadrako• 7 years ago

I don't think so. When I was traveling in Malaysia a few months ago I was always signed into my Google account, but constantly needed to fill in captchas and even got suspended from Google Scholar for a few hours for "suspicious traffic".

sjwright5• 7 years ago

punishing me for trying to protect my privacy.

TOR doesn't protect your privacy, it just lumps you in with—and makes you indistinguishable from—the worst crap on the internet. If you don't want to be treated like crap, don't try to blend in with the crap.

ddebernardy• 7 years ago

When trying to detect ad fraud, one problematic scenario is that of replay attacks. It's basically when a scammer records human behavior on a site, and then replays a mix of actual their sessions to fraudulently click an ad.

The Quora answer is interesting but it's not clear to me whether the "I'm not a robot" box cannot be defeated in a similar manner.

manifestsilence• 7 years ago

It seems like they make that hard by mixing semi-random elements that are different each time, like user interaction data, with the user's browser fingerprint and location. This seems to be why they go to such lengths to obfuscate the algorithm they use to combine these elements. If the pseudorandom and the fixed elements were easy to separate it would make replay attacks much more feasible.

amirhirsch2• 7 years ago

I work on bot detection at hCaptcha.com. (Hiring: reach out if you want to apply machine learning to stop bots and help websites monetize their traffic without ads)

In order to successfully execute a replay attack you would also need to pass the Turing Test, i.e. click the correct images. If you design a bot that starts a combinatoric attacking by trying random guesses we can easily confuse it, so most attackers try to use a solver service.

We can also identify how you interact with semantic content in the images when you click on the image and characterize your mouse interaction as human or non-human. Since confidence increases as more results come in we can also run them after the initial pass and then shadow-ban bots. (And notify the targeted website that we have determined e.g. a particular signup is a bot.)

Ultimately, many techniques beyond simple correct/not-correct are required to defend against the main attack vector: humans hired to solve captchas en-masse and make thousands of fake accounts. Modern ML is pretty effective for these kinds of problems. Browser obfuscation does not add real security, and today's reCAPTCHA (all versions) is easily defeated in practice.

jammygit6• 7 years ago

This solution has more or less locked me out of certain accounts, except for when I want to spend a whole evening solving captchas in order to log in. I just don't use those services anymore, which means I've lost paid-for content that I'm practically locked out of.

CodeMage• 7 years ago

Is there any place where I can find a comprehensive list of countermeasures to stop Google from recording and analyzing all the stuff that the article lists? According to the article:

It turns out they record and analyse:

- Your computer’s timezone and time

- Your IP address and rough location

- Your screen size and resolution

- What browser you’re using

- What plugins you’re using

- How long the page took to display

- How many key presses, mouse clicks, and tap/scrolls were made

And ... some other stuff we don’t quite understand.

pixl97• 7 years ago

Turn off javascript, mostly. To hide your ip you need to use a VPN.

scrooched_moose• 7 years ago

Is noscript still the best for that? I haven't looked at other options in a long time.

anonu• 7 years ago

Turn off JavaScript... And almost any site you visit will be broken.

jiveturkey2• 7 years ago

ANY website can record and analyze all this. Not just google. There are only 2 countermeasures available:

1. turn off javascript (effective for all websites)

2. block access to google in your router/firewall. (effective only for google)

neolefty• 7 years ago

Nope, because it's a cat-and-mouse game with robots. It's not in Google's interest to publish it because it would give an advantage to the bot writers.

meritt• 7 years ago

A bot absolutely can, you just need to use a more sophisticated bot. This article [1] is from August 2017, so the arms race has escalated and techniques improve, but the gist is the same: You just do a better job of simulating the "human" characteristics they monitor. Gen 4 bots (bots that run on an infected user's machine) can circumvent these measures as well.

[1] https://intoli.com/blog/making-chrome-headless-undetectable/

wulfmann• 7 years ago

This has been done:

https://www.youtube.com/watch?v=fsF7enQY8uI

mnorton• 7 years ago

this should be at the top, dammit

_the_inflator• 7 years ago

Put another way: basically this is another Google tool to track user behaviour that validates the fingerprint Google already has. Sneaky!

scarejunba• 7 years ago

Honestly, if there were a web standard where I could opt-in to all of this tracking and it meant I would be ‘trusted’ I’d happily have my user agent send them almost anything they want. I trust Google not to fuck me.

jiveturkey2• 7 years ago

TFA is not very clear about what it's describing.

It is describing how the checkbox is collecting your browser's characteristics (eg they go to great length describing the webGL fingerprint) and your own characteristics (eg mouse behavior), such that when you click the box, you are determined to be a person or a bot. If they think you are a person, you don't have to do the CAPTCHA.

The whole bit about a double encrypted "VM" is overstating the case. The "VM" is "just" a bytecode interpreter, which at the end of the day can't do anything the browser's javascript engine can't do itself. Yes, it's some heavy obfuscation, and what's more interesting than the interpreter itself is the decision to spend what must have been lots of time/resources to develop it. It's security by obscurity, and in this case it is delivered to the client so obviously it's reversible. Maybe there's a deeper purpose.

EDIT: ah. the purpose is not to obfuscate. it is to fingerprint the CPU characteristics. by running their own interpreter, and changing the opcodes on the fly and such things, they can defeat JIT and learn something about the CPU itself. if they have user info (google cookie) they can know what CPU/CPUs that user typically uses and if "the checkbox" records something different it's a signal.

modzu3• 7 years ago

the answer is basically wrong. robots can and do. captcha has become an AI training tool and it now blocks humans as a consequence. the convenient side-effect being a nudge to those humans to change their behaviour in such a way as to never need captcha and thus support google's business: enable cookies, login to google, use unique identifiers (IP), etc

hexo• 7 years ago

Why can't I just run headless chrome of firefox and have my bot click it there? "Aha here it is, so I click using system 'fake' mouse click". where's the catch?

wmf• 7 years ago

The script can detect the difference between real Chrome and headless Chrome.

noir_lord3• 7 years ago

Point a webcam at the screen and wire a mouse to the computer controlling the webcam, you'd have to simulate the computer moving the mouse like a human would but I don't see why it wouldn't work.

eridius3• 7 years ago

Lately I've been getting reCAPTCHA prompts all the time even though I'm not browsing in incognito mode and haven't cleared cookies. All I'm doing is running a very basic ad blocker, using Safari (which blocks third-party tracking), and very rarely loading a Google site. The most interaction I have with Google is when I end up having to use my corporate Google account as SSO for some other site.

Given that I'm not doing anything unusual, it really feels to me like reCAPTCHA, for all its complexity, boils down to "what's your history using Google software? Oh you rarely use it? I'm gonna give you a captcha". It didn't used to be this aggressive, but it's really ramped up in the past few weeks.

kevin_thibedeau• 7 years ago

Randomized user agent also seems to trigger reCAPTCHA without real cause. Should be an ADA violation for doing that.

rtkwe7• 7 years ago

ADA? Americans with Disabilities Act? Why would that have any bearing on user agent randomization?

justtopost2• 7 years ago

It happens to me occasionally and I am basically blacklisted from the internet. I have to solve 5 in a row and if I screw up its idea of what a streetsign is, I have to start over. It has made me cut out usage of most sites that use this broken and abusive tech. Welcome to the digital ghetto.

RussianCow2• 7 years ago

Anecdotally, I've gotten way more reCAPTCHA prompts since disabling third-party cookies and installing Cookie AutoDelete, so I suspect you are correct.

tomaskafka• 7 years ago

Same here.

kccqzy• 7 years ago

Same here. I have an alternative browser with no ad blocker, no tracking blocker, and sometimes I just copy the website from Safari to that other browser to avoid CAPTCHA.

iheartpotatoes3• 7 years ago

I recently replaced a bunch of securimage captchas with reCAPTCHA v2. During testing I had to shut it off because it became increasingly more complicated every page reload. First it was just one page of traffic lights, but 20 minutes later I was having to click through 5-6 pages of images. This worries me that user's might get pissed off. I'd really like to know if I've made life harder for my users in an attempt to stop the spam from the horribly broken securimage captcha.

Anarch157a• 7 years ago

I cancelled and deleted my Spotify account because of that. Now any site that asks me to fill a Google recaptcha is met with a swift click on the Back button.

PaulHoule• 7 years ago

Technically it's a good strategy. It would be much more complex for bots to leave a trail consistent with that of a real user.

Some financial and government benefit web sites query web trackers as an extra factor in the enrollment process.

Liquix• 7 years ago

It'd be a good strategy if we were aiming for a totalitarian Google-sponsored police state..

Making (online or offline) life more difficult for people who don't want to use company X products could escalate to the point where you either accept the yoke and are admitted to the walled garden of "society" which company X has firmly cemented themselves under -- or you say no and find yourself unable to drive/fly/get a job/go to college/buy groceries in your town. It sounds like a big leap to make right now, but is a real possibility if Amazon/Google/FB don't get broken up soon.

eridius3• 7 years ago

Using a verified human Google history to allow people who would otherwise be flagged as potentially a bot to skip the CAPTCHA is justifiable. Setting up your reCAPTCHA such that the lack of a verified Google history is used as a "probably bot" signal is really quite awful.

elsurudo• 7 years ago

I use Safari on a Mac with a simple ad blocker, but I use a lot of Google products, and I also get a captcha most of the time.

So perhaps it's Safari and/or the ad blocker that are to blame? Hard to say, though.

xvector3• 7 years ago

This is likely due to the new canvas fingerprinting protections introduced in iOS 12 and Safari for Mojave. Google's NHT analyzers probably don't take well to these measures that attempt to defeat canvas fingerprinting.

blitmap• 7 years ago

I have noticed this too. I've switched to DuckDuckGo for everything and I haven't changed my habits. Started getting more captchas a couple weeks ago and I know I answered several of them correctly (I'd get tested 3 times in a row).

Possible fingerprinting?

wstuartcl2• 7 years ago

It is also plausible that because google analytics runs on so many sites that they could do something shady like put you in a pester segment if they see you coming from duckduckgo to other sites frequently. It is not hard to imaging using Recaptcha as a nuisance against other search traffic providers.

beatgammit• 7 years ago

This is why I love container tabs in Firefox. I like putting all of the recaptcha stuff in one container so it can't snoop on my other stuff (I'm too lazy to look into what it's doing with cookies and whatnot).

But honestly, I wish it would just die.

AlfeG• 7 years ago

Sometime ago we have a provider that give us everyday different IP. Some days we just were not able to do anything without captcha. It seems that some IP addresses were in some sort of spam base

rotrux2• 7 years ago

http://sikulix.com/

jammygit6• 7 years ago

Does that actually work? I found the images had to be a pretty close match for it to recognize something

rotrux2• 7 years ago

Probably not out of the box. It just seems like a more promising approach than a browser API.

bluedino2• 7 years ago

They encrypt it twice? Forget about it, then.

orblivion• 7 years ago

Triple distilled, with two scoops of raisins.

ryantgtg• 7 years ago

Totally anecdotal: Back when I was using a vpn and would see this recaptcha more often, I found that the recaptcha would often declare me a bot (and give me a second chance) if I clicked the boxes too quickly. Like, the storefronts would load and I'd immediately click+click+click+click then submit. But if I slowed down and staggered my clicks, it would realize I'm just another inefficient human who needs time to move a mouse and make decisions.

taftster5• 7 years ago

Right. I think I have seen similar behavior for mouse movement as well. Not sure, but I think moving your mouse around randomly helps as well. The timing of picking the images, as you say, helps. As does the order you pick them in.

Of course, I think the biggest thing is your browser's fingerprint. If you are using a lot of privacy blocking addons, etc. you are going to be spending a lot of time looking at captchas.

yalogin• 7 years ago

Can anyone point me to the virtual machine and encryption mechanisms used by Google, as was alluded in that link?

xirdstl2• 7 years ago

I feel a sense of dread whenever I see this box. Is it going to let me through, or am I going to spend the next few minutes futilely clicking signs and lights, only to give up and leave the site?

sk1pper• 7 years ago

Glad I’m not the only one. I thought something was wrong with my brain. Or that I might be a robot.

toxik• 7 years ago

Counter anecdote: I was actually never rejected though I’ve been subjected to the picture test multiple times. Most of the time I just get through, though it is hard not to sigh and roll your eyes when presented with one.

Annoying as they are, I don’t really see a better alternative. They’re also pretty easily circumvented with cheap labour like mechanical turk and similar services.

sgolestane• 7 years ago

01001000 01100101 01101100 01101100 01101111 00100000 01100110 01100101 01101100 01101100 01101111 01110111 00100000 01110010 01101111 01100010 01101111 01110100

benologist• 7 years ago

Someone is suing Apple for making 2FA too annoying, I only hope Google can be next for the significantly greater time being wasted on their stupid CAPTCHA. Why should any of us even care if someone accesses a website programmatically?

It's almost definitely not my problem, and it's not even necessarily a problem it's just a way to access pages, made easier by Google in fact because it's a perfectly legitimate way to navigate the internet and Google themselves depend on it. If anyone wants to discourage it just provide an official API to use instead of pages, which are a defacto API for humans.

https://github.com/GoogleChrome/puppeteer

https://www.trustedreviews.com/news/apple-hit-two-factor-law...

tracker12• 7 years ago

Apple's 2FA cannot be disabled, beyond that if you ever had two devices connected to your account, good luck getting them to use your verified phone instead... I was trying to get rid of a "your apple account... please sign in" via the app store, and the advice was to sign out then back in again... my only other apple device was in another city...

Phone calls to GF, to get her to login, similar issue, it was now signed out, and after another attempt, one of them showed the 2FA window, which got me in. At no point was I able to use the phone number also associated with my account, and it was a huge, long, pain in the ass. It's actually a huge part of why I won't buy an iPhone.

singularity2001• 7 years ago

The worst thing is that it prevents me from accessing my BANK account. Shame on you FIDOR for blocking my own access to my own finances!

MiddleEndian2• 7 years ago

Send them a message. Switch to another bank, close your account, and tell them why.

RussianCow2• 7 years ago

As superficial as it seems, this kind of stuff drives me away from businesses. I almost changed my mind about opening a retirement account with Charles Schwab purely because they block access to their site from the VPN that I used at the time. That said, for services from which I gain a lot of benefit, the annoyance is worth it, so it ultimately doesn't matter.

clairity2• 7 years ago

just preemtively say no and leave the site. this is just another tracking vector for google and it should be discouraged.

i'm generally against this type of gating, where the people doing the right thing get punished disproportionately (even small slices of time add up to wasting thousands of human-years over the population) just to combat the tiny number of bad actors. target the bad actors directly.

it's the same for tsa security theater. let's put all those humans to work training dogs of all sorts and filtering them through people at the airport. the money for those privacy invading scanners can be put toward training and housing the dogs. our collective time is not wasted on silliness and standing in line, and we'd probably save a lot of tax dollars that way.

EpicEng2• 7 years ago

Yeah... but I really want to buy that <whatever>, so meh, I'll put up with it. There are only so many hills I'm willing to die on.

xirdstl2• 7 years ago

I'm getting closer to doing that. Lately, I check the box, and if I'm presented with images, I leave.

I have also trained myself to wait a few seconds before clicking the box, which seems to help assert my humanity.

detritus2• 7 years ago

Sadly, the parcel tracking functionality of the Royal Mail's site here in the UK uses it, so I have little choice but to go through this rigmarole a few times a week.

On the one hand, fuck Google for wanting another vector with which to track me, on the other hand, why can't it remember that I proved to it that I'm human (allegedly) two days ago?

koonsolo2• 7 years ago

It's either that or getting your entire forum spammed with hundreds of spam posts.

I'm using that captcha on my website, and I can tell you, that one works 100% while the other ones don't.

justtopost2• 7 years ago

I do this after being blackholed by goolgles captcha a dozen times. If your site reli3s on google you are the problem at this point. I am not a data point. I am a free man.

flixic• 7 years ago

I hardly ever get to just check the box. I think uBlock Origin and Safari's intelligent cookie blocking removes a lot of identifying details, and ReCAPTCHA relies a lot on browsing history and cookies.

reaperducer• 7 years ago

Clicking the box tells Google that you're a human.

Identifying the lights and cars and bicycles is you training Waymo's self-driving AI.

sigotirandolas• 7 years ago

I use Firefox with containers (so ReCaptcha can’t see my Google cookies) and also uBlock Origin + a few more extensions. I don’t use NoScript or similar. I get the manual test for ReCaptcha pretty much 100% of the time.

warent• 7 years ago

I'm willing to bet if you record how long you spend clicking signs and lights on average, it's going to be more like several seconds than a few minutes. This must be hyperbole. There are the outlier cases where it gets fairly annoying but otherwise, I'm not sure I understand the hostility toward such a benign system that actually does thwart bots very effectively.

justusthane• 7 years ago

Effective or not, I wouldn't exactly call it benign when it's aggressively fingerprinting you based on every bit of data it can access.

I disable most scripts using uBlock, but I have to make an exception for reCaptcha if I want to interact with half the web. I'm pretty sure due to that alone Google is able to track where I go.

Bartweiss2• 7 years ago

I'm willing to bet if you record how long you spend clicking signs and lights on average, it's going to be more like several seconds than a few minutes.

How much, and at what odds?

The length of the average Google CATPCHA has been steadily going up for me. I haven't pulled out a stopwatch, but I do count how many image sets I go through. I basically never get through on the checkbox unless I've done one on another site shortly before. I sometimes succeed after one set, but if I don't it's consistently 3+. The worst case I've seen was 10 layers of slow-loading images without success, at which point I gave up and tried on another device. (If it had been a site I didn't need, I'd have given up after 5 - which I do fairly often, so I don't have an average count needed to succeed!)

I'm fully aware that average users don't have this much trouble, or people would be furious. But I also see that captcha ramps up to an extremely long process in the face of even modest privacy-protection efforts like not running Javascript or allowing third party trackers by default. (God forbid you're using a VPN for any reason.) It's not assessing your humanity but your familiarity, using the same fingerprinting tools as any site that wants to track you.

Spam is a real problem, and a hard one to solve, but I admit I'm hostile to Google's captcha. Partly because it really is a significant time sink for me. Partly because it lacks any progress indicator or fallback option so it's an indefinite hurdle to accessing sites I'm already committed to using. But largely because, despite what I really believe are good intentions, it's yet another force pushing people to give up privacy and even security if they want websites to work tolerably.

JohnFen13• 7 years ago

only to give up and leave the site?

Personally, I've reached the point where this is the first thing that I do. If a site is presenting a CAPTCHA (especially one run by Google) to me, then 90% of the time, that's a site I'm better off avoiding anyway.

That last 10% can be infuriating, though, and I certainly won't feel positively about it.

AnaniasAnanas• 7 years ago

And if you have a vision issue like me and you try to use the audio version you will often get "Your computer or network may be sending automated queries. To protect our users, we can't process your request right now. For more details visit our help page" and be unable to continue.

partiallypro• 7 years ago

Every time I fill one of these out I get the picture test, and I answer them correctly...but am asked 3-5 times to identify which blocks contain a school bus or stop light. It's very annoying.

ivanbakel• 7 years ago

I think it's speculated that you're recorded as being a useful classifier if you answer correctly on initial test captchas, so you get given Google's datasets for machine learning. It would explain why you get picture tests even after you should definitely pass the check.

kzzzznot• 7 years ago

If that is true that is a huge breach of trust. Are these practices ever audited?

manmal• 7 years ago

You mean, they still haven't managed to classify those storefronts correctly, after 3 years or so?

alexpetralia• 7 years ago

Yes - I feel at this point that our labor is simply being used to help provide training data for Google's algorithms.

teej• 7 years ago

I mean, this has been exactly the situation since recaptcha was invented.

Theodores• 7 years ago

This is not how it is supposed to be.

In a parallel universe of fluffy niceness we willingly provide our help and in that way we get all those old books converted to ASCII and available for us to read online. Our efforts are for the good of mankind. Similarly with the newer challenges, we help the maps be up to date and again this is for the good of mankind and those needing help getting around.

Clearly this doesn't work in an era where the 'don't be evil' mantra is long forgotten and people only see Google as some advertiser friendly capitalist monopolist beast.

Google need to work on their relationship with their customers, to be a benevolent dictatorship of sorts. They are lousy at customer service and there are other pain points that they are ignorant to. I don't see how this helps.

XCSme• 7 years ago

How to label your ML data for free.

pfortuny• 7 years ago

Using highly trusted users thinking that they are just proving their honesty.

hombre_fatal9• 7 years ago

By offering a free service to website operators that mitigates the ever-growing challenge of abuse on the internet that they and their users have to deal with.

Seems pretty bilateral.

RidingPegasus2• 7 years ago

The "hills" category is the worst.

Have come to the conclusion it really means any patch of grass.

judge20202• 7 years ago

If you often get this while using Tor - https://privacypass.github.io/

For firefox - https://github.com/dessant/buster

nixpulvis• 7 years ago

I feel like a "bot" with access to control your mouse and read the output from the graphics system (aka get an image of the screen in real-time) could have little trouble with these things.

brokenmachine2• 7 years ago

could have little trouble with these things

That's a bit of an ambiguous sentence - are you saying they would have little trouble, as in not much trouble, or the opposite?

quickthrower22• 7 years ago

Yes, but as a spammer, you would need access to lots of different people's mice and screens. A bot net would do it I guess.

bsamuels2• 7 years ago

Slightly related, but I have a fun conspiracy to share:

I'm convinced that part of the reason Google released headless Chrome is as a honeypot for bot authors to use. The idea is that instead of going through the effort of fingerprinting and identifying new bot software, release something that bot authors will use instead that you have a capability to detect.

Somewhere inside of headless Chrome, there's one or more subtle changes that make it so Google can detect whether you're using headless Chrome or normal Chrome. There's no limit to how subtle the indicator could be - maybe headless Chrome renders certain CSS elements slightly slower than normal Chrome, etc.

It sounds pretty crazy/complicated but I could definitely see it being worth it if it means detecting $X,000,000 worth of ad fraud every year

mpol• 7 years ago

Interesting idea :)

I don't think spambots are currently using Chromium or even running JavaScript. Using simple spamfilters in JavaScript still works fine on my setups.

bsamuels2• 7 years ago

Most modern credential stuffers use headless browsers with all the bells and whistles, html5, javascript, etc.

Login attempts are usually spread over a massive botnet of residential IPs as well, where they'll only use each IP for one or two login attempts before moving on to the next.

It's a very fascinating problem space

golergka• 7 years ago

Does it mean that you're breaking the experience for users who deliberately disable js by default? Can I ask you not to do that? Modern web is unusable if you let js on any webpage

nhf• 7 years ago

It's actually not that complicated. Most headless browser drivers have some global JavaScript functions in the `window` namespace that immediately identify themselves.

I once ran into a piece of code from the scammy advertising world that tried to redirect users to a phishing site. They cleverly tried to hide themselves from the automated quality checks some ad networks do, by checking for these functions and appearing benign if they saw them. One of the checks even created an exception and then inspected the stack trace for certain flags that apparently are only there on some type of headless browser. Clever!

ascii_only• 7 years ago

unCaptcha2 claims 90% accuracy at beating reCaptcha. http://github.com/ecthros/uncaptcha2/blob/master/README.md

executesorder662• 7 years ago

This addon also works in a similar way:

https://addons.mozilla.org/en-US/firefox/addon/buster-captch...

seotut22• 7 years ago

I think recaptcha and captcha in general are very overused today, as they cause way too much inconvenience for the user. Why discriminate against robots so much?

What's so wrong about crawling or using automated tools? With today's networks and hardware performance most websites shouldn't concern themselves with denial-of-service type of attacks, unless they're past a certain threshold of popularity.

taftster5• 7 years ago

One thing is account creation. It's usually a bad idea that user accounts are created by non-humans. In general, anything that writes to a database may have concerns about robot/automation/abuse.

I agree with you, for "read only" content, let the robots crawl.

benrbray• 7 years ago

Well, it's useful on places where genuine human interaction is important, like Craiglist or Reddit.

(in reality though reddit has a huge bot / astroturfing problem anyway, so perhaps the value of captchas really is overstated)

remus• 7 years ago

There's nothing inherently wrong with crawlers and automated tools, but there's a lot of poorly written scrapers out there that can easily generate a huge volume of traffic along with the associated maintenance.

Why waste time catering to people who are too lazy to write a decent scraper? Most people would prefer to spend their time working on things that will benefit the other 99% of their users.

learc833• 7 years ago

At work we have a scraper that likes to use a particularly expensive search query using hundreds of different ips dozens of times per second, all so that they can scrape data that is freely available from us as an XML feed at a different url.

Every time I found a way to fingerprint and block them, they'd change their bot to avoid detection. Captcha for rate limiting seemed like the least bad option.

However, eventually I decided that instead of blocking them, I'd return random results from the db. They weren't checking the data too thoroughly because to this day they haven't changed the bot to avoid my most recent pattern detection. They're still merrily scraping useless data.

seotut22• 7 years ago

Rate limiting can be achieved without actually inconveniencing regular users. Put a exponentially growing delay on the server's response for requests coming in too quick succession.

herpderp3dtwerp• 7 years ago

Awesome idea giving them crappy data. I do the same thing with loyalty programs. Someone has already registered XXX-555-1234 as a phone number in your area code. I like to think I'm adding a little bit of chaos to their data tracking.

robk2• 7 years ago

Why not add a "PLEASE USE THE XML DUMMY!" line to the returned results when you figure out it's them?

SquareWheel• 7 years ago

Because 99% of bots on the web are spam bots. Naked email addresses are skimmed and cataloged. Any unprotected contact form will receive dozens of spam messages per day. Forums constantly get new members that only post linkspam.

There's very few friendly bots like archive.org, and those respect meta robots tags anyway.

ThePhysicist• 7 years ago

So basically they do very advanced browser fingerprinting? I wonder if they keep that data around, as that would tell them who uses which third party services (not that they would have trouble working this out by other means) and would make a nice addition to their tracking efforts.

It’s quite depressing to see that almost all sites now require sending data to Google just to log in to them. Not to mention that they help to turn billions of users into clickworkers for annotating AI data. Tell me what you want but I’m pretty sure they show image captchas to users that they are absolutely sure are no bots. I use Chromium on Linux and I’m logged into a Google account, still I have to solve three or four image captures at times to use a login.

dudus2• 7 years ago

This is reCAPTCHA v2. There's even a v3 that does not have a checkbox at all. Is just a Javascript API that gives you a score between 1.0 and 0.0 on how likely a user is a bot or not. I suspect it uses the same ideas of this one, maybe more since the article is a bit outdated.

https://developers.google.com/identity/protocols/OAuth2#inst...

JohnFen13• 7 years ago

Is just a Javascript API that gives you a score

Yes, this is the worst of them all, as it will completely lock me out of websites that use it.

dudus2• 7 years ago

I don't think that's the goal. Nowhere they suggest locking people out though def it is possible. The idea is that the website can choose to be more cautious about that user, requiring 2FAuth, flagging for possible credit card fraud and comment moderation. I think these are all good use cases.

codeulike4• 7 years ago

Its getting weird when you have to fill that box in with pen and paper

Marci Robin was buying a Fiat 500X from a West Palm Beach, Florida dealership, and was in the final stages of signing all the paperwork, when she was presented with a strange but simple question: was she a robot?

This wasn’t online or anything, she was right there, in person, in front of the sales person, who wanted her to check a box, with a pen, on real paper, confirming that she was not, in fact, a robot. She claims she isn’t.

https://jalopnik.com/dealership-makes-woman-sitting-right-in...

edit: and the original tweet: https://twitter.com/MarciRobin/status/998030243981033472

rothron• 7 years ago

This would've made an awesome SciFi short story.

The twist at the end is that she's lying.

codeulike4• 7 years ago

I can't imagine that a car dealership would even care, as long as they got to sell a car.

"Oh dang, you ticked the 'not a robot' box but you are actually a robot ... Ah, no worries, I'll put a call in to head office, get the paperwork changed. Well, enjoy your car! ... And don't forget to come back in six months for your free oil change! ... for the car, I mean."

rzzzt2• 7 years ago

The salesman is a robot as well.

cortesoft3• 7 years ago

Isn't that basically 'Do Androids Dream of Electric Sheep'?

tzmudzin• 7 years ago

http://www.elib.pl/wp-content/uploads/2016/06/Lem.pdf

Definitely one of my favorite reads from my youth days...

zxcvbn4038• 7 years ago

I had roughly the same problem. My facebook career lasted for all of thirty seconds before they decided I was a robot and banned my account. I appealed and they asked me to send a photo. I sent them a photo and they said I was still a robot and there was no further appeal. Very helpful. So my choices from that point are to 1) shame them in the media and hope its an entertaining enough story that people like it or 2) do something better with my time then facebook. I chose the latter.

shawnz3• 7 years ago

Were you using an unusual user agent or a VPN or something?

muzani2• 7 years ago

You could have done both. I'd love to see an article on that.

quickthrower22• 7 years ago

My facebook career

Interesting interview process!

defertoreptar2• 7 years ago

Just throwing this out there. Have you considered that maybe you are a robot?

grigjd3• 7 years ago

If everyone keeps telling you you're a robot...

dzhiurgis2• 7 years ago

Not an outright ban, but I am unable to use Interactive Brokers client portal (or even signup form) using a regular internet connection. It keeps timing out, logging me out, etc.

Bizarre part is it works fine when I tether via my iPhone.

Also there seems to be growth of websites in NZ that use some sort of Cloudflare-like proxy that very often straight up blocks requests to some simple blogs. Unsure whether it's user agent, ad blocker or my IP is quite dirty, but try to open up www.pointhacks.co.nz and click thru older posts...

everdev• 7 years ago

I have received a "suspicious activity" warning on Twitter for any new account I've helped open up over the last year.

You can confirm your identity by entering your phone number and receiving a text.

I feel like it's more of a cheap ploy to get additional info after your first 25 tweets than it is any bot detection algorithm.

_pmf_• 7 years ago

I appealed and they asked me to send a photo. I sent them a photo and they said I was still a robot and there was no further appeal.

That's the plot of Blade Runner 2.

megous• 7 years ago

Telling them to fuck off (to the photo request) would have been more human. Following orders is very robot like, you know.

werid• 7 years ago

Signing up for facebook, after a short period, they'll lock your account due to suspicious activity, even if you have done nothing (maybe that's suspicous?), and demand a phone number or a photo.

If you sign up and provide a phone number, they'll just demand a photo. Twice. Giving them the same photo seems to work though, and leave your account in peace...

They never accused me of being a robot though.

smelendez• 7 years ago

Sounds like they're filling out an online form acting as the buyer, which might be in uncharted territory legally, and they want to dot every i.

Jill_the_Pill• 7 years ago

Dealership's just getting ready for autonomous vehicles that try to sneak out.

jarjar12• 7 years ago

May be They are preparing for the future.

We should start protesting to make sure robots can buy cars.

opportune• 7 years ago

this reminds me of a cargo cult or something. People following strange rituals they observed others perform for no reason

blihp• 7 years ago

Interesting. Not sure if it's a gag or for some sort of handwriting/stroke analysis. Or it could be a variation on the M&M contract clause (https://www.snopes.com/fact-check/brown-out/) to try to verify that they actually read the contract.

cardiffspaceman• 7 years ago

I'm left wondering, what if they said you were lying when you ticked the box? What would it mean for the transaction?

onetimemanytime• 7 years ago

>"...she was right there, in person, in front of the sales person, who wanted her to check a box, with a pen, on real paper, confirming that she was not, in fact, a robot. She claims she isn’t.

All robots claim not to be one, so we must be really careful.

probably printed app from website and the dealer took it literally

topmonk• 7 years ago

A better question might be "This sentence is false. True or false?"

peeters• 7 years ago

I'm the kind of guy that would be willing to walk away from a sale to test what would happen if I refused to check that box.

Sylamore• 7 years ago

I had to do this at CarMax on a recent purchase, it felt as silly as you think it is.

c3534l• 7 years ago

She claims she isn’t.

I wonder if the subtlety of that joke will be lost on future generations one day.

mcv9• 7 years ago

I think the entire story will be lost on some future generation, unless you add to the end: "but perfectly human-like robots didn't even exist back then!"

INTPenis• 7 years ago

It made for funny headlines but anyone with a little insight into corporate can guess that they simply printed a form from their computer. Likely from their website. A form normally designed to be used online was sent over paper mail and happened to include online elements like captcha.

If anything you should exclude such html elements from the print page with css.

codeulike4• 7 years ago

Well yes obviously they had printed out an online form. But they made her fill it in. Thats the funny bit. And yes its clearly to do with employees not quite knowing what to do with the paper version and so just shrugging and say yep you'd better fill it in anyway. Thats all pretty obvious. Its still interesting though, as a little slice of corporate anthropology.

peterwwillis• 7 years ago

Back in the late 90s, my teenage friends and I were writing Visual Basic programs to automatically click ad banners and surf webpages to generate money. I doubt it's significantly more difficult to do the same now with a captcha box.

anth_anm• 7 years ago

Bots that can defeat captcha easily are probably the AI development I'm most excited for.

The amount of time I've wasted clicking on crosswalks and store fronts is way too high.

taftster5• 7 years ago

I'm not convinced that picking the pictures has anything to do with actually convincing google if you're a bot or not. I mean sure, it's an indicator. But I _know_ that I can pick the right pictures of school buses and store fronts every freaking time, so that's only a very small indicator.

More likely, the majority of the algorithm is devoted to the "fingerprint" of your browser. If you have adblock running, you may not have a google ad cookie. If you have a randomizing user-agent addon, you're going to get blocked.

What we need, for captcha, is an addon that makes you look as human as possible. Mouse click timings become random. Javascript fingerprint becomes John Smith common. Third party cookies, temporarily enabled (and then pruned). VPN traffic routed through a common looking gateway that few bots use. etc. etc.

derefr• 7 years ago

You're assuming that the picking-of-pictures validation logic cares solely about what pictures you pick. What if it cares about your "mouse click timings" not being random, but rather looking like the mouse movements of a human who is using eye saccades to examine and classify images, and then moves their mouse only when they see and find one, and sloppily at that?

taftster5• 7 years ago

Right, that's what I'm saying. I was putting forth that humans are pretty random with their timings. But the truth is, they are probably not and that we all probably click in some uniform distribution.

But I am pretty sure, if you click on the images too quickly, you're going to get stopped. Slowing down your clicks, moving around a little like you're "thinking" seems to help. That's been my experience at least.

I'm personally rooting for the AI here. When the robots and crawlers become so smart to become too hard for Google to distinguish between them and humans, then we will all benefit. They are becoming smarter, which is why captchas are becoming more difficult for humans.

aboutruby• 7 years ago

My theory is that the challenges are actually just to slow down humans trying to do repetitive sensitive tasks (sign ups for instance).

miguelmota• 7 years ago

As a user who's constantly clicking on the crosswalk or storefront images you can't help but to think that you're essentially working for free training Google's machine learning models by providing them with supervised data points.

tracker12• 7 years ago

That's what ReCaptcha always was... it was originally a known and another unsure text blurb from scanned books/text documents. Now it's street signs etc.

rococode• 7 years ago

It's actually pretty interesting to see how the captchas have evolved as, presumably, Google decides "OK, we have enough data to consistently identify this thing" and moves on to the next challenge.

I recall the modern (non-text) captchas used to be cars pretty much every time. Then, the images started getting grainier as they apparently wanted to improve their recognition in different conditions. Then crosswalks and store fronts became quite common, eventually with the same kinds of noise distorting images. Now I've started seeing things like buses, bridges, motorcycles, bicycles, etc. It feels like they've finished getting enough data for improving Google Maps and have begun moving towards collecting data for their self-driving car projects.

gcb07• 7 years ago

they stopped using the text because some forum campaign that promoted typing cursewords instead of the unkown word. they probably started showing cursewords on the rendered search highligths on google books.

there was a decent write up from a whitehat showing the damage, but I can't find it

forgotmypw2• 7 years ago

Don't forget the bonus: all your forum accounts can be linked to your google account, just in case you didn't use your gmail as the email address.

rapnie• 7 years ago

Isn't there a good OSS alternative for ReCaptcha?

NeedMoreTea• 7 years ago

Helping scan all the world's books as part of a plan to make them freely available to all is much easier to get behind than tuning map objects for their self driving cars. Particularly when most books that were scanned never, ever showed up on Google books.

Larrikin• 7 years ago

Identifying text for public domain works that Google is making available online is much different than forcing the web to train their models for their profit.

littleweep• 7 years ago

I've been thinking about this a lot lately. Where is our compensation? It's our time and brain power training Google's AI that will one day be sold back to us. I'm really not into this.

lallinuo• 7 years ago

You might be interested what https://hcaptcha.com is doing.

mda• 7 years ago

So you want compensation because your data is used along with millions of others to train an algorithm to distinguish if a bot or a real human to provide a service to you? Nice.

human• 7 years ago

Are you kidding? Your compensation is all the free apps you get (Gmail, Maps, etc.) You’ll rarely see a Captcha for a paid product once they have your cc info.

whatshisface• 7 years ago

Your compensation is that you get to use the website, and the website's compensation for putting up a gate for their users is that they get to keep the bots out.

tyrust• 7 years ago

reCAPTCHA provides protections to site owners for free. By using reCAPTCHA, site owners pass the cost of said protection on to their users.

disclaimer: work for google, nothing related to reCAPTCHA though. opinions are my own, etc.

hamburga• 7 years ago

Gavin Newsom, the governor of CA, spoke about this in his State of the State yesterday: https://www.sacbee.com/news/politics-government/capitol-aler...

This book offers one set of proposals for "Data as Labor", inspired by Jaron Lanier: http://radicalmarkets.com/chapters/data-as-labor/

And there's going to be a lot of discussion of the idea at the RadicalxChange conference in March (https://radicalxchange.org/), including with Jaron himself as well as the book authors. (Disclosure: I do the conference website as a volunteer).

gingerbread-man• 7 years ago

Because Google can extract value from captchas, it makes world-class captchas and bot detection AI available to every webmaster for free. I don't know what that level of service would otherwise cost, but it almost certainly wouldn't be affordable for low-traffic blogs and the like, which would end up vulnerable using weaker captchas or trying to roll their own. Everywhere else the cost would just get passed on to users.

I don't love the compromise of paying for things with my data or by training Google's AI, but it's hard to say users aren't getting anything out of it. That said, I do miss the old reCaptcha.

davesque• 7 years ago

1e-10 cents.

amsvie• 7 years ago

20% of these companies could be considered public property because it is public which has been feeding the algorithms training data.

A dividend on this could probably provide for a basic income.

wwweston• 7 years ago

Google's services, of course.

Is it worth it?

dragonwriter2• 7 years ago

I've been thinking about this a lot lately. Where is our compensation?

You give Google training for ML models.

Google gives the site provider the service of excluding bots from submitting the form.

The site provider gives you whatever was provided by the form you were trying to submit.

No one is uncompensated.

bonestamp22• 7 years ago

Where is our compensation?

When you search for an address on google maps, that little tiny house number on the house was once a captcha image and now google knows that number so it can take you to the exact location on a map when you search for that number.

Everyone helps train the machine so when they want something from the machine then the machine is better at finding what they asked for. That seems pretty democratic to me.

charlietango92• 7 years ago

not trying to be facetious, isn't that (half of) the point?

paul7986• 7 years ago

One solution is to remove Google out of your life as best as possible.

Personally I now use...

- iCloud.com instead of Gmail

- DDG for search though I do have to !g like 20 to 30% of the time for things like driving directions (from X point to Y point), local movie times nearby and flights.

I still use

- YouTube

- Google Maps some as its great for getting distance between X and Y

- Google News (is there a better substitute)

- Google Photos (is there anything that compares)

Hoping in time to rely a ton less on Google products.

bo1024• 7 years ago

Not a solution in this case - the problem is that companies like Cloudflare use these captchas to slow down your visit if you are using Tor or a VPN. In fact being logged in to google probably helps you bypass these checks

pbhjpbhj5• 7 years ago

What is it in particular about GPhotos you find incomparable?

sekasi• 7 years ago

I'm in the same boat, friend. Expelling Google from my life.

Apple Maps works for me. I appreciate that's not the case for everyone, but it's come a LONG way. I sincerely use Apple news (on iOS) and have been loving it, but appreciate it's not for everyone's use case.

Google photos.. yeah wow. There really isn't much like it. I've resigned to storing my photos myself on a private server and slowly making albums/things come together. But I have to NOT use google photos. It's too scary.

Gmail was easy

Youtube I use a fake gmail account that's not linked to me in the slightest and only use it on 1 iPad, else not logged in.

It's a quest. But I'll get there. Someone really ought to make a Google Photos competitor though, there's nothing that has the same level of polish right now.

dawnerd• 7 years ago

For a while there they kept saying I was wrong and it would effectively lock me out of some accounts that required it. Recently it’s stopped but it’s super annoying how ambiguous it is.

Old_Thrashbarg• 7 years ago

Yes, especially when they show you about 15 sets of images in a row taking 2 minutes to complete, clearly going beyond demonstrating you're human.

chrischen• 7 years ago

I think they only do that if you get the first set wrong.

_jal• 7 years ago

More and more frequently when presented with a captcha, I've been deciding I don't care enough about whatever it was to want to exchange robot training for access. Especially if they pull that shit after I've spent effort on something (a comment, say) - I will absolutely walk away and not come back.

Manipulative user-hostile websites can rot.

steelframe• 7 years ago

The Cascade Bicycle Club in the Pacific Northwest threw me into one of these multi-minute Captchell vortexes when I tried to log in to my years-old account to renew my membership and register for one of their organized rides. I was already on the fence as to whether it would be worth paying to do these rides that I have already done several times over the years. That (ironically) dehumanizing experience pushed me over the edge. I didn't complete the Captchas, didn't log in, didn't renew my membership, and didn't register for anything this year.

snarkyturtle• 7 years ago

There's an xkcd for that https://xkcd.com/1897/

hedora• 7 years ago

I suspect you could replace the entire mess described in the post with: what's the logged in account's spaminess? followed by, what are the doubleclick cookies' spaminess?

You could further approximate that with: "How much does Google's AI think this human's time is worth in future revenue?"

I for one intentionally inject errors into their image classifier until it lets me in anyway.

mcv9• 7 years ago

I'm now wondering if the fact that I block third-party cookies is the reason I always have to identify cars and store fronts. Maybe I should just avoid sites that use recaptcha.

amelius• 7 years ago

Who says it's for training? ;)

richjdsmith• 7 years ago

I always try and click one or two extra boxes that are wrong. Sure I sometimes have to go through and confirm extra images, but you know what? I don't work for free and so I'm doing my small part to bugger up Google's data set.

pipelineist2• 7 years ago

I've recently made a discovery that pleases my petty side.

You know how they usually give you several questions to solve, even if you're quite convinced you solved a question correctly?

Turns out if you click randomly, they keep showing you new questions as well. If, after a handful of purposely wrong answers, you answer one correctly, they let you through.

I now purposely mess up the answers a few times. It seems neither slower nor faster than actually taking the time to do it right, but it takes less mental load, and it makes me not feel like doing slave labour for a machine.

taftster5• 7 years ago

Google runs a very profitable ad network. People who use adblockers don't directly help support their revenue. I have a conspiracy theory that google is making it hard for people running adblock to get through captchas. I want all the code that is used by the captcha to think I'm running a pristine ad displaying browser.

I wonder if recaptcha seeing your ad cookies (and other dark tracking indicators) would be enough to help get through. Like we need a "recaptcha profile" in your browser that would have just enough fingerprint to get you through.

Robots don't watch the ads. Adblock blocks the ads. Google's revenue is mostly ad revenue. I don't think it's coincidence.

not_a_cop• 7 years ago

Oddly, they don't answer the harder question.

How you can prove that a human genuinely wanting the information in the page is filling that information out? Imprisoned humans are great CAPTCHA defeat bots.

wolco2• 7 years ago

The bigger question. Why do we treat bot visits differently. Automated submissions or manual have the same rate limiting controls that prevent more submissions than expected. The content of a form shouldn't be acceptable or not based on who sent it (human or machine) there needs to be another verification process against the data submitted to expected/acceptable values.

Why couldn't a bot purchase a droplet or shoes. As a saler I would be happy to sell to them. Purchases would be quicker and less wasted resources with humans browsing the same product pages for months before buying.

dragonwriter2• 7 years ago

Why do we treat bot visits differently.

Because bots are used in multitarget and multisource spam attacks that humans can’t do efficiently; rate limiting on any particular target site, particularly for submissions from a particular source, cannot prevent such attacks.

tptacek• 7 years ago

I believe this is related to anti-spam work that Mike Hearn did, and described at a high level on the ModernCrypto lists:

https://moderncrypto.org/mail-archive/messaging/2014/000780....

(search "Javascripts").

dazhbog2• 7 years ago

Every time that thing asks

Select all images with traffic lights, I'm like, does the pole also count?

Select all images with cars, what about that car that is two pixes in the next tile?

Do I click based on absolute truth, or how they expect an average user to?

seanwilson• 7 years ago

The linked post doesn't give any concrete answers in my opinion. Can't a bot use a real browser to pass the CSS tests? Can't the behaviour of a human be recorded and mixed in with the behaviour of the bot to seem more human like? Why can't the encryption used be decoded?

bhntr32• 7 years ago

I haven't seen any mention of keystroke (or mouse) biometrics (https://en.m.wikipedia.org/wiki/Keystroke_dynamics) When the checkbox appeared I assumed that was what it was.

Keep a history of the biometrics of the devices either on the account or in a cookie. Use a sufficiently secure and obfuscated language to capture and upload the data (maybe using steganography in an image, explaining the weird image uploads.) Prompt when the biometrics don't match a known user of the device/account (according to ml). Or if the tracking data didn't exist (incognito) then prompt using a backup model trained in the difference between the biometrics of known bots and known humans. Keep a very loose threshold here.

That's how I'd do it if I were Google (and no one else because only Google can afford that.) All the browser fingerprinting stuff mentioned is great but doesn't really work as much as you'd hope in practice.

phire• 7 years ago

The basic theory behind that checkbox is to attach an unmovable cookie to your browser.

The majority the client side reCAPTCHA is fingerprinting to make it impossible for spammers to steal cookies from legitimate users.

Once you have the immovable cookie, is easy to do regular reCAPTCHA challenges until you are sure that browser is being used by a regular human.

You will notice that if you ever move to fresh OS install, or a different browser that reCAPTCHA suddenly starts showing you image challenges again, which last for several weeks.

Keyboard/mouse biometics is a nice theory. But that's all it is. It doesn't work as a general CAPTCHA solution because it's so easy for bots to fake human looking input.

bhntr32• 7 years ago

Great points. I agree the critical and biggest innovation is building a secure environment inside the browser. When I explored keyboard/mouse biometrics it was for detecting account theft which is a bit different.

If they have a way to create a secure, immovable cookie across browser sessions even in incognito mode then they don't need biometrics. In the absence of persistence, biometrics could serve as the cookie. Even with a naive approach in a hackathon, a member of my team was able to get very high precision identifying users based on a small sample of keyboard and mouse movements. I'm sure Google can do better.

So it's not really about attackers being able to look like any human. It's about being able to look like a specific human. Which is much harder.

But maybe you have more experience? We abandoned it seemed intrusive and because we knew we couldn't invest in the secure environment. Without that it doesn't matter. And with it maybe there's an easier solution. But I figured that given Google made it that they would be using keyboard/mouse movements for user identification.

aasasd• 7 years ago

Could anyone please translate this part to a normal technical description?:

Google’s invented language is decoded with a key that is changed by the process of reading the language, and the language also changes as it is read.

I feel like that's either some everyday cryptothing that I'm too tired to realize right now (ahem hashing cough?), or some clever stuff that I want to know quite a lot. Or Google cracked the secret of writing Malbolge.

_cs2017_• 7 years ago

Why wouldn't a bot just use a proper browser (not headless), detect the "not a robot" box at the pixel level, and click on it using browser automation or some mouse movement script? At today's level of bot sophistication this seems almost trivial. Sure it might cost more in resources, but I doubt it's economically prohibitive when you're making at least a cent per fraudulent ad click?

judge20202• 7 years ago

I believe the Quora answer is putting a little too much faith in Google using "fair" factors when determining if a client is a robot.

I'm sure it plays a part in determining "hijacked extension" activity vs human activity, but it's likely that the majority of the decision is how much recent activity your signed-in Google account has, whether or not you're signed in on Chrome (Firefox has a lot more stories of recaptcha challenges), and maybe even if you have Google WiFi or Google Home linked to your account. I wouldn't be surprised if they purely whitelist accounts that subscribe to Google Fiber or Fi.

jtth• 7 years ago

I think less of whatever entity puts it in front of me.

dazhbog2• 7 years ago

The other day I noticed that if you leave the tab open long enough the images become grainy..

I wonder if they also overlay another image that to humans looks like noise, but its a neural network attack[1][2]

[1] https://youtu.be/SA4YEAWVpbk?t=34

[2] https://medium.com/datadriveninvestor/8b966793dfe1

kumarvvr• 7 years ago

Wait, what is stopping me from using something like selenium, and mouse automation tools like in python and simply do what a human does?

ezioamf• 7 years ago

https://github.com/ecthros/uncaptcha

mnm1• 7 years ago

This explains everything except why Google itself won't let humans through even when they've selected the right things a million times. All this sophistication and it's still too stupid to do its basic job of knowing the right answer which couldn't be more than a few equality checks away.

1stranger• 7 years ago

Protip: if you click on the headphone icon on recaptcha you get an audio challenge which I find much simpler and less annoying.

executesorder662• 7 years ago

And this addon makes it even easier:

https://addons.mozilla.org/en-US/firefox/addon/buster-captch...

smadurange• 7 years ago

"the language also changes as it is read" Lol. Quora and its nonsense.

thowmeaway• 7 years ago

It only catches obvious bots. I write stuff that gets past ReCaptcha all the time. I'm just one guy and I am not even that good at this.

Plenty of other people get past it too: https://medium.com/@jsoverson/bypassing-captchas-with-headle...

I am pretty sure Google is just doing an 80/20 rule here, or even a 99/1 rule since there are so many simple bots that are easy to detect.

danschumann• 7 years ago

I'm sure it could.. if you had the minimum hardware and a smart enough bot. It's always going to be an arms race.

avodonosov• 7 years ago

So how does it really work? In the article a lot of words about obfuscated code reading browser fingerprint, but that's just a fingerprint, a bot can run a browser as well and fingerprint will not reveal him.

How clicking the checkbox helps? Do they measure the delay it takes me to read the captcha request and react by clicking?

walrus01• 7 years ago

Turns out that the low cost way to bypass this is to hire a click farm of 25 people in Bangladesh, each running remote desktop sessions to about a dozen virtual machines.

klyrs• 7 years ago

Okay how about a button that says "I'm a robot" and you only serve to sessions that don't click it. "Sorry you said you were a robot. If you clicked it by mistake, clear your cookies and uninstall at least 50% of your fonts"

michaco33• 7 years ago

I wish they finally could so I could stop being held hostage through multiple rounds of visual recognition tests -- how long is it going to take me to prove I'm human when I'm senile?

fabioborellini• 7 years ago

Isn't this a typical Quora answer? Full of filler and shitty hard-to-verify details that provide no value to the answer ("the language is encrypted twice", what the hell), and very little effort on answering the actual question (what is the purpose of CAPTCHA).

And the community rules try to block people from writing firm "you're full of shit"-like answers, even though every other answer of Quora is full of lies like "Linux is fast, because it was designed for 16-bit computers".

jaabe• 7 years ago

I had my “wow” this place might not be that good experience with Quora yesterday when I was trying to google evaluate AWS workmail.

Quite a lot of the “extremely good looking” answers on Quora straight up said that you couldn’t do e-mail in AWS. These were answers from after workmail was a thing by the way.

So I started looking at other Quora answers on stuff I wouldn’t normally need an answer for, and it’s frighteningly how often completely wrong answers look correct.

Don’t get me wrong, there is a lot of truly amazing answers as well, and it’s entirely possible that I just suck at it, but I don’t think I can always tell the amazing answer from the completely wrong one.

adventured• 7 years ago

My experience with Quora has been that more often than not the older the answer, the better it is. I find that answers in history, are often better than in tech. It always seems like the community that initially built Quora, stopped building it further several years ago and now it's floating out in space Wile E. Coyote style.

pure-awesome• 7 years ago

Sounds like a form of the Gell-Mann Amnesia Effect:

https://en.wikipedia.org/wiki/Gell-Mann_amnesia_effect

KajMagnus• 7 years ago

The answer is not just fluff. It for example links to https://github.com/neuroradiology/InsideReCaptcha where you can read more.

hmottestad• 7 years ago

I looked at that and it’s pretty nifty. It actually looks like google did encrypt the client side code and implement their own JavaScript VM and that the decryption key for the source is based on variables inside the VM during execution (some kind of state) in some way and other properties from the webpage (css is mentioned). It all falls into the realm of obfuscation.

ebg132• 7 years ago

the actual question (what is the purpose of CAPTCHA)

This assessment isn't quite right. The actual question is about how the captcha differentiates between a human and a bot at the box checking stage.

You're right, though, that it is both full of filler and also doesn't address the question as posed at all.

Why can’t a bot tick the 'I'm not a robot' box?

It can, by taking over the mouse...except...

LUCKILY, the top answer (on my screen at least it's https://www.quora.com/Why-can-t-a-bot-tick-the-Im-not-a-robo...) does actually try to answer the question.

I feel like the OP submission might have just been some sort of submarine self-promotion for the "CEO of <redacted>".

thatoneuser2• 7 years ago

That answer talks about mouse movements. Most captchas I do these days are mobile. So I don't trust this as a very solid answer.

blazespin• 7 years ago

I never got this. Why not just run the browser in a VM, capture the screen and do a mouse click. I mean, why bother with all the headless nonsense which is an arms race. How could google possible ever defeat something that never ever even goes near the operating environment and just appears as a simple human mouse click?

I suppose you’d have to simulate the human movement of the mouse over to make it look like a human actually did it, but how hard can that be? Just train it with a few 100 Turks moving mouse pointers to click on links.

Though an interesting counter measure might be to inject cpu spikes and measure the impact in the mouse movements and the robot controlling it.

Must be a fun job, both sides.

untangle• 7 years ago

I see a lot of conjecture and theory and not a lot of evidence. AI models? Maybe for ad behavior but not for this. Google has you and your machine ID'ed and fingerprinted. That's the core of the authentication. The rest is subterfuge and obfuscation.

Is there any evidence that I'm wrong?

sascha_sl• 7 years ago

Yes.

You get punished for blocking Google tracking.

I love it. Totally not evil(tm).

Very tempted to cancel/stop using anything that uses this crap, but it's a bit too ubiquitous.

fubaron• 7 years ago

Well, that's not completely true:

https://www.youtube.com/watch?v=fsF7enQY8uI

doubletgl• 7 years ago

Doesn't that particular Captcha also work in an incognito browser? I don't see where all this complexity comes in. You simulate the mouse movement and the click. Your browser pretends to not be able to run webgl, so no ghost image. Forcing the user to have a history with google services would lock everyone out who's new. The user agent and other browser metadata is easy to fake.

mrccc• 7 years ago

The captcha always reminds me of The Stanley Parable:

Employee #427's job was simple: he sat at his desk in room 427 and he pushed buttons on a keyboard.
Orders came to him through a monitor on his desk, telling him what buttons to push, how long to push them, and in what order.

arendtio• 7 years ago

Sometimes I get really angry about that captcha. For example, when I am trying to buy something, having an account on the store with 100+ orders, and still having to play 6 rounds or so of 'find the car' at the speed of the very slow fading images.

So sophisticated and still such a pain in the a for the user.

ddtaylor• 7 years ago

You certainly can click that box using chrome headless or a simple VNC setup. It's insanely easy. Google has replaced the idea of a CAPTCHA (completely automated public Turing test to tell computers and humans apart) with a basic rate limiting heuristic.

jonathanstrange• 7 years ago

I don't understand this. When I get the "I am not a Robot" box, in 95% percent of all cases I only have to click the checkmark. That's it. A robot certainly can do that, too.

In the remaining 5% I get a Captcha that is impossible to solve, e.g. it states "Please mark all cars" and once I've marked all cars it states "Please also mark all traffic signs" and when I've marked all traffic signs it states "Please also mark the following traffic signs" and so on, for as long as I bother to try.

I have never encountered a Google Chaptcha that worked in any other way, either it works trivially with one click or never.

My conclusion has always been that Google Captcha are simply broken for anyone who runs an ad-blocker, and I don't don't bother with services for which it doesn't work. Problem solved.

superlupo• 7 years ago

I hate it because I always have to solve lots of storefront or traffic sign images as I have disabled third party cookies because I do not want to be tracked by Google all over the web.

speedplane3• 7 years ago

There a many services that can get around a Google Recaptcha. They are not free, but cost roughly $2 for 1000 recaptchas. This means is that recaptcha makes things more expensive, but still surmountable.

Services that use recaptcha should consider why they are using them. Preventing spam, stealing proprietary data, and preventing actual harm are legitimate reasons. On the other hand, stopping free information from becoming truly free is bad. For example, numerous U.S. government agencies use captchas to prevent scraping or analyzing of public documents. These government organizations provide "public access" in the narrowest possible sense, making it difficult to search for a specific record or analyze data in bulk. If they can't do it, they should allow others to try.

robk2• 7 years ago

Our national mail carrier added this to their tracking page! Makes tracking a parcel absolutely maddening and prevents third parties from doing simple (non abusive) aggregation of tracking data.

ainiriand• 7 years ago

That answer is not an answer. It is just a way to look smart while not helping at all. I've seen this behavior a few times, mostly at work.

wifirouterlogin• 7 years ago

Interesting

pluma• 7 years ago

tl;dr: because Google massively invades your privacy to know whether you're a bot or not before you tick the box, also the CAPTCHA is a bit more sophisticated than just showing a checkbox to click on.

alt_f4• 7 years ago

Judging by the amount of spam i receive from a reCaptcha v2 protected contact form, I'm positive bots can tick the box or circumvent it.

yeutterg• 7 years ago

After reading this thread yesterday, I had a nightmare in which I called 911 but was required to answer an endless stream of personal verification questions, never able to report the problem.

squarefoot• 7 years ago

This already happens with many automated service call centers: endless key tapping before an actual carbon based lifeform who can understand the problem picks up.

sudshekhar• 7 years ago

I faced this recently when my card was skimmed and I saw some fraud transactions. After blocking the card, I tried reaching customer support, but my bank's IVR refused to recognize the card number (mandatory to talk to fraud folks apparently) and thus, didn't let me through.

Had to reach out to them on twitter to get things moving. Horrible stuff.

hartator• 7 years ago

At SerpApi.com, we built a bot to check these boxes and an AI to solve the actual CAPTCHA.

Checking the box is actually not that hard. There is no advanced measurements of your mouse and touch speed. This is an Internet myth. It's more a game of cookies, making them age well, and having an organic set of headers.

SheinhardtWigCo• 7 years ago

Aren’t you afraid of being sued by Google for selling their search results?

wstuartcl2• 7 years ago

My first thought as well, looks like the business is 100% based on breaking TOS.

From their site: Is scraping legal? In the United States, scraping public resources falls under the Fair Use doctrine, and is protected by the First Amendment. See the LinkedIn Vs. hiQ scraper ruling for more information. This does not constitute legal advice, and you should seek the counsel of an attorney on your specific matter to comply with the laws in your jurisdiction.

ROFL, I guess if you are able to ignore the layers of other issues TOS, breaking of technology to specifically exclude your use case, etc and are only willing to apply some very tangential case law against your reasoning it is "legal".

mlb_hn• 7 years ago

The misconceptions about nonhuman/invalid traffic (NHT) seem like a problem brewing. There's an arms race between the NHT guys (e.g. ad fraud networks) and the guys trying to detect it (e.g. ad providers). Meanwhile, a lot of people are using analytics to inform decision making assuming most traffic is legitimate (e.g. news organizations, anyone doing A/B testing). The guys naively using analytics with weak feature detection may be totally unprepared to deal with nonhuman traffic from repurposed networks which have been optimized to defeat the more advanced countermeasures =/

renlo• 7 years ago

I’ve had a number of reCAPTCHA incidents where I could not pass the test for tens of images, it was a very frustrating experience. Please do not use reCAPTCHA.

The items one is supposed to select often overlap the grids, so it becomes a kind of Keynesian Beauty Contest[1] at that point; I assume they validate based on how much in alignment you are with previous answers, so it becomes a problem of “What nearby grids would a person reasonably select when there’s overlap”, or, you’re tasked at selecting <some_item> and you see <some_item> in the distant background of the image you’re supposed to classify and you need to determine “How visible would <some_item> need to be for a reasonable person to classify <some_item> as being in this image”.

On top of this, when you’re clicking through image after image after image, the additional frustrating thing is that you’re helping train their algorithms; you’re doing work because their service isn’t smart enough to know you’re human, or, you’re seen as a marginal customer they can piss off by forcing you to work for them for free.

It’s a frustrating experience when it fails, and my current strategy is to leave the website when the ‘I’m not a robot’ checkbox fails.

[1]https://en.m.wikipedia.org/wiki/Keynesian_beauty_contest

retro642• 7 years ago

You’re overthinking it. I have had a similar experience. The worst were the “stop light” questions. Does it mean the pole, the light, the tiny corner overlapping another square? I used to try to include everything as it was technically true. Very frustrating – until I finally started to not care. Click on the most obvious pictures. Click click click. Done. Get it wrong? Click click click on the next one. Way faster with a much better success rate doing so. It usually only takes a couple of tries now.

JoshTko• 7 years ago

Just a suggestion to not say "You're overthinking it" it can be considered pretty dismissive.

Legogris4• 7 years ago

"Store front" always makes me squint at garages, driveways, sidewalks and front doors.

thatoneuser2• 7 years ago

Hell I try to figure out what wrong answers to give to fuck up their training data.

sl1ck731• 7 years ago

Are reCAPTCHA images used to train or classify data like Mechanical Turk? I thought at one point the word ones were used that way and was a major incentive for their usage.

xvector3• 7 years ago

They are almost certainly being used to train Google's self-driving/Maps/etc recognition.

JonathonW• 7 years ago

Original reCAPTCHA images were used to transcribe text for Google Books, and later to transcribe house numbers for Google Street View.

I don't think Google's publicly said what they do with any data derived from the new "I'm not a robot" reCAPTCHA, but, given the content it usually uses, it seems likely that they're still using it for image classification in Street View, or for their self-driving car projects.

xvector3• 7 years ago

reCAPTCHA is horrible. I am almost certain that some tests are intentionally marked as failed even if they are correct, simply so they can get more training in. And if you take any anonymizing measures, reCAPTCHA makes much of the web nigh impossible to use.

It's easily the worst UX I encounter online. I can't describe the relief I feel when I come across a "normal" CAPTCHA. It's coming to the point that if I could pay a few cents to outsource every reCAPTCHA, I gladly would simply to avoid this atrocity.

ConceptJunkie• 7 years ago

The tests are often poorly defined. I've been caught in reCAPTCHA hell a few times (but not recently), and it's often the case that I'm guessing... is this a bus? I'm not sure.

It's interesting to find out that this might have nothing to do with my ability or inability to recognize objects in blurry photos.

darkhorn• 7 years ago

You probably share your IP with others like Tor or a single IP for a big company.

ValleyOfTheMtns• 7 years ago

I feel somewhat vindicated by this story. I was talking to a couple of work colleagues about the "I'm not a robot" box and they were convinced it worked purely as a time delay, to slow bots down. I had a feeling that there was far more to it than that, but I didn't know how/where to get that information at the time.

tyteen4a03• 7 years ago

Is there an easy-to-implement, simple-to-use alternative solution out there that delivers better UX, does not require i18n treatments and stops spambots just as well?

I'm not seeing any except asking questions about the site, and even that takes effort to translate. Numerical math questions I assume can be easily bypassed.

IncandescentGas• 7 years ago

It is difficult to prevent being tracked by google, when a website forces you to expose your visit to a google property just to log in

Why can’t a bot tick the 'I'm not a robot' box?

Related Stories