Google's Captcha in Firefox vs. in Chrome

https://grumpy.website/post/0RzW4elEN

by kojoru • 7 years ago

1343 483 7 years ago

grumpy.website

ziddoap• 7 years ago

The fire hydrant example... I deal with this every day. It takes soooo looooong to load, it's really ridiculous.

kbumsik3• 7 years ago

I face that example everyday too. I'm really curious this does not appear in Chrome.

Mirioron• 7 years ago

It does. I've run into it plenty of times with chrome.

theandrewbailey2• 7 years ago

I'd be cool with it if it didn't fade out the selection and load new images. Fine, you want to do that, Google? I think some of these other images are hydrants, too!

Aunche• 7 years ago

The point of the challenge isn't really to get the "correct" answer. It's for the captcha to be sufficiently confident that you're a human.

AdmiralAsshat• 7 years ago

There have literally been times where I debated whether or not I wanted to purchase something because of the knowledge that I would have to solve Google's captcha. Humble Bundle, in particular--the login process for me (due to uBlock+uMatrix installed) is like this:

1) Try to login

2) Login doesn't show up--go to uMatrix and whitelist some crap.

3) Try to login again.

4) First phase of login completes, now blank when site tries to load Google captcha.

5) Whitelist Google captcha frames in uMatrix and reload again.

6) Login for the third time, Google captcha now displays properly.

7) Spend 10 minutes solving captchas. If I'm lucky, the first "Verify/Submit" will work. If not, I probably need to whitelist cookies for it within uMatrix and reload/try again.

8) Get notification from HumbleBundle that "You have not logged in from this browser before" and wait for a Verification email to hit my inbox.

9) Enter verification code. Site usually then logs me out for some reason, even though it was successful.

10) Login again. Solve Google Captchas again. Finally allowed to login.

11) Finally buy the goddamn thing I was there to buy.

12) Search Amazon for wig.

luckylion2• 7 years ago

It always amazes me that companies, especially those that know their audience is tech savvy, don't test their sites/shops/systems with common things like ad blockers or privacy plugins. I often run into hidden problems on sites that go away after I allow some third party domain.

I wonder if it's just incompetence at the developer stage or a management decision to annoy users that have ad block etc. Neither really makes sense, I'm a paying customers, they shouldn't take it personally that I don't care for ads, and they are multi-million (or even multi-billion) companies, surely somebody there knows that ad blockers exist.

worble• 7 years ago

Humble Bundle, in particular

Funny you should mention that, I actually wrote an email to support asking them to have frickin mercy with the google captchas. The response was as you expect "we do this for safety and protection, yada yada" which to be fair, I obviously didn't expect them to change anything, although I hope it did help raise some awareness.

The interesting thing I got out of it was that they mentioned that google captcha for logging in is disabled so long as you have 2FA activated on your account, which certainly helped, at least a little bit. You do still have to use the captcha to buy anything from the bundle (at least if you're using something like paypal, anyway).

user7647432• 7 years ago

I tried sending an email on their support page to complain about it as they are likely losing customers like me but it was behind a captchas and I gave up.

stordoff• 7 years ago

I _have_ multiple times walked away from a purchase due to reCAPTCHA at the login form (Sony - PSN). It makes me think "You know what, this isn't worth it", and I don't want to help Google out anyway.

baggy_trough• 7 years ago

The Google captcha enrages me. Why should I train their stupid AI?

y4mi• 7 years ago

Because you're not providing advertising revenue as a non-chrome user ;)

woodrowbarlow2• 7 years ago

there are updates coming that will make it much more tied to your google account. i fear that it will mean anybody not currently logged in is assumed to be a robot. (even more so than now, i mean.)

darkpuma• 7 years ago

ReCAPTCHAv3. It will differ from ReCAPTCHAv2 in one important respect: it will no longer ask you any questions, meaning it will no longer give you the opportunity to appeal it's snap judgement of you.

https://developers.google.com/recaptcha/docs/v3

bduerst3• 7 years ago

According to the recent Planet Money podcast on Captcha, the upcoming changes will only use the signal of whether or not you have an account, and not any account-based data, since it will be domain based on the website or something.

Also, they're doing away with the questionnaire. It works by using a scoring system or something similar since it loads on the pages leading up to form fills.

Edit: Source for you disbelievers - https://developers.google.com/recaptcha/docs/v3

reCAPTCHA v3 returns a score for each request without user friction. The score is based on interactions with your site and enables you to take an appropriate action for your site.

partiallypro• 7 years ago

What's funny is that the AI needs to be trained...yet it already knows which choices are correct and incorrect. So, is it really necessary?

Edit: This is a joke, I am joking.

wybiral• 7 years ago

If they do it the way that the OCR recaptcha works, it allows some new ones to go through and uses consensus to classify them.

So most of them will have already been classified and those are used to test your integrity (and verify you) but an occasional new one will be presented that won't count towards your verification and if enough people agree on it it'll be classified.

SubiculumCode• 7 years ago

This is the natural question to ask. I finally decided that they probably compare your answers to several other humans to validate training data.

MarkMc• 7 years ago

I suspect it knows the correct choices for some of the little pictures it shows you, but for others you are training it.

ljcn• 7 years ago

I don't know how the image captchas work but the old-fashioned type-the-words captchas asked you one it knew the answer to and one it didn't. By giving unknown words to multiple users and finding a consensus they could move words from the unknown to known set.

ben509• 7 years ago

Edit: This is a joke, I am joking.

The voters seem to have formed a consensus that it was not a joke, unfortunately, so your humor has failed the test.

(This was a meta-joke, and I too am joking.)

morrbo• 7 years ago

I use https://github.com/dessant/buster to avoid captchas and swear by it. It uses google's speech to text to transcribe the captcha audio element, and posts it back as an answer so you don't have to do the annoying images.

nomel• 7 years ago

To provide compensation for the websites use of their free, and effective, service designed to combat bots?

eeeeeeeeeeeee• 7 years ago

This is especially prevalent in the Google mobile site tester in Firefox. In FF you have to do the Captcha almost every damn time. Switch to Chrome and it stopped immediately for me.

athorax• 7 years ago

I can't tell for sure, but it looks like middle row, first image might have a fire hydrant

entropea3• 7 years ago

Is this ISO52600 image thick with grain at 200% crop a car?

exakoustos2• 7 years ago

This is why once I switched to FF I also switched to DuckDuckGo

talonx• 7 years ago

The captcha has nothing to do with Google the search engine. Google's catpcha is used on a lot of websites which are not connected with Google.

On a different note, this also makes it difficult to use such websites if you block google domains in your adblocker for non-Google sites.

exakoustos2• 7 years ago

You would think that they wouldn't block search. But Google kept throwing me at captcha when I was in FF and not signed in. The biggest pain so far has been the lack of map integration.

swebs2• 7 years ago

They actually block you from search if you're connecting from a VPN and have uMatrix enabled.

fernandotakai• 7 years ago

now that's weird. firefox is my main browser (developer edition on linux, windows and macos) and i never get captchas.

maybe it's because i don't use umatrix (i only use ublock origin)? maybe because i'm always logged-in in at least one google account?

kbumsik3• 7 years ago

I use a plain FF and I'm always logged in the Google account but I face this annoying captcha everyday.

Wowfunhappy• 7 years ago

maybe because i'm always logged-in in at least one google account?

That's likely a primary reason.

theandrewbailey2• 7 years ago

It's easy to configure umatrix to let Recaptcha through.

entropea3• 7 years ago

I use ublock but stock Firefox otherwise. I am also logged into a Google account most of the time, but still get impossible captchas unless I switch to Chrome.

damnyou• 7 years ago

This could either be some of Firefox's privacy features genuinely making it look more bot-like to Google, Google accidentally or deliberately sabotaging Firefox, or some combination of the two. It's not really possible to tell from the outside, but it's clear that Google's incentives are for Google's products to work better with each other.

This is why Google should be broken up -- it should be forced to spin off Chrome into a separate company with a business model similar to what Firefox has.

Algent• 7 years ago

Are you using Canvas Blocker or similar extensions ? As a FF user I also have to go thru 3-4 captcha everywhere and I'm pretty sure it's because the system is having trouble giving me a stable fingerprint.

stanski• 7 years ago

This reminds me of ticketmaster.

Site owners can choose not to use google's recaptcha2 but it has become the de facto standard now so no one cares.

tomduncalf• 7 years ago

Google Captcha is a complete mess at this point and I often leave websites that use it if it's not essential to what I am doing

entropea3• 7 years ago

I will cancel services that use it too. I am not wasting 5 literal minutes to solve impossible captchas because I don't use Chrome.

bduerst3• 7 years ago

The newest version is going to be invisible - i.e. it just "works" without a questionnaire. It's based on a scoring system that doesn't prompt users unless the website owner wants to prompt them below a specific score. You've likely already used it but don't remember it because it was invisible.

bscphil3• 7 years ago

That was supposed to be what this version was (reCaptcha v3). As a matter of fact, however, quite a few of us get extremely long or unsolvable captchas every time.

addicted2• 7 years ago

I don't log in to Google Captcha sites anymore, unless I absolutely have to.

Their discrimination against FF users has been fairly evident over the past year or so.

It's amazing how my identification abilities improve exponentially by using Chrome instead of Firefox.

nishmastime• 7 years ago

Reading these types of comments on HN, you'd think HN doesn't use Recaptcha for login/register. ;)

Easy to hate on Recaptcha while reaping the rewards of participating in a community that deals with less automated spam because of it. :)

sickmate• 7 years ago

My power company (the sole government-run provider in my area) now has reCAPTCHA on their payment form.

briandear3• 7 years ago

Which was my point from my earlier downvoted comment. The idea that training Google AI is a condition of use is ridiculous. You have to provide free labor to Google as a condition of paying your electric bill. You also have to share your data with Google — even if you decide not to complete the Captcha.

DavideNL• 7 years ago

Same... so frustrating. If it's Google's goal to create frustration for non-Chrome users that would be evil :'(

mikro2nd2• 7 years ago

Even more annoying are those sites that insist on using it, even though they know I'm human -- for reasons like I've paid them some money or jumped through their KYC hoops. At that point it's just being rude and exploitive, and, personally, I've reached the point where I'll simply take my business elsewhere if a site chooses to treat me with so little basic respect.

emiliobumachar2• 7 years ago

There's a case for preventing bot action even if the bot is willing to pay. Though putting a captcha right after a payment step is borderline fraud.

What's KYC?

dawnerd3• 7 years ago

Oh you mean like Mongodb Atlas? (Although looks like they've gotten rid of it or toned it down). There were days where I couldn't log in because recaptcha just refused to let me.

jackewiehose• 7 years ago

The slow animation is the worst. You really want to punch someone responsible in the face.

And I never figure out how to solve the traffic light riddle.

bad_user3• 7 years ago

You're not supposed to figure out the traffic light riddle, you're not a human if you do.

sonnyblarney2• 7 years ago

Yes, it's the most obvious internet rage trigger.

But I can't figure out why they make a 'delay'? Why not just show the next dam image?

bad_user3• 7 years ago

To make it more expensive for bots to try this at scale, obviously. Unfortunately it's making it more expensive for humans too.

lowdose• 7 years ago

Include the traffic light poles.

sp332• 7 years ago

I've never included the traffic light poles.

pbhjpbhj2• 7 years ago

I don't include the poles, how about wires? What about pedestrian lights, are they "traffic lights"?

GordonS2• 7 years ago

I've never understood why they don't just say what you're supposed to select - it it just the lights, or the poles too? What if part only enters a box by a few pixels? Just tell me what you want, dammit!

AgentME• 7 years ago

The worst part about the slow animation is that when an image you've clicked is fading out, you might think you've completed everything and then click the "Verify" button at the bottom. But then that causes you to have to restart if that wasn't the last image. This is the part that convinces me that ReCAPTCHA was made to fuck with people.

Ocha• 7 years ago

FYI. Title is misleading. This experience has nothing to do Firefox vs Chrome. Result is because of 3rd party cookie and tracker blocking. I had same and even worse (I was not able to get through captcha) experience on chrome itself because I have 3rd party cookies disabled and couple privacy oriented extensions running.

hartator2• 7 years ago

The user is complaining about the slow CSS animations. It's definitely a bug though not something they did on purpose. I remember having the same issue on Chrome as well.

gsnedders• 7 years ago

IIRC, it is something they do on purpose, to make it clear to the user something is happening while rate-limiting challenges given to the user.

floatingatoll2• 7 years ago

They’re slow because it’s live-challenging two or more recaptcha users at once with an unknown image, right?

shakna• 7 years ago

It's not a bug. Its part of a patent Google holds designed at frustrating access for bots.

kbumsik3• 7 years ago

But I never touch cookies in FF and never install any privacy features. I have been facing the same for years.

yumraj4• 7 years ago

No, I believe it is because the Chrome as a browser works in conjunction with Gmail and other google properties' logins to kinda figure out that you're a human.

One of the things, if it ever gets there, would be for the anti-trust probe, if any, to look at how Google shares data between its browser, Chrome, and it's other services.

ehsankia4• 7 years ago

How would the website code communicate with the browser, unless it was some open API you can refer to. As for "in conjunction with Gmail", yes that's called cookies.

codedokode• 7 years ago

Probably you are right. I use tracker and 3rd party cookies blocking in FF and I often spend 30-60 seconds solving captchas. Often Google says that I solved it wrong (although I try to be careful) so I have to solve it 3-4 times, sometimes with those slowly appearing images. Upgraded my skills of recognising bridges, buses and fire hydrants but still struggle with searching storefronts.

sulkie• 7 years ago

This cannot be entirely correct as I use Chrome and Firefox with as close as possible configuration, with uBlock Origin with exact same settings, and the behaviour I've encountered is very similar to the one shown here. I'm logged in to my google account in both browsers as well.

agotterer• 7 years ago

This! I have a Chrome development profile which I primarily use for testing. When I encounter a captcha it's the same painful experience as the OP's FF video. I don't have restrictions around cookies or tracking either. My best guess is that I just don't have as much "usage history" on that profile for Google to just declare me clearly human. Alternatively, on my main profile that I use for normal browsing captcha (which it still sucks) is never as painful.

mevile• 7 years ago

Your comment is correct, Firefox now blocks trackers and it's probably, and hopefully, blocking whatever recaptcha uses to determine you're not a robot. So using firefox you get the harder recaptcha because it's blocking Google from spying on you.

NelsonMinar2• 7 years ago

reCAPTCHA needs to be re-engineered to work even in the face of privacy measures in browsers. Otherwise it will be better at distinguishing expert humans from ordinary humans than at distinguishing bots from humans.

themacguffinman3• 7 years ago

I'm sure there's room for improvement but at some point this is paradoxical. Users who want data privacy want their presence and behavior obfuscated, which is fundamentally opposed to anti-fraud systems which are designed to analyze the presence and behavior of users to determine if they are fraudulent.

llao4• 7 years ago

While relatable, this is just a low effort post more suited for Twitter or Reddit.

For a fair comparison OP would need to use clean browser profiles on fresh IPs. Like this it is just fan-service for Google Captcha victims (like me).

SquareWheel2• 7 years ago

I kept looking for the article. Surprised to see such a low-effort post submitted to HN.

thinkingemote• 7 years ago

Users have the option to flag submissions

a012• 7 years ago

How can you have a fresh IP which isn't in your control?

Someone1234• 7 years ago

Many of us have control of our IP Address within a certain range. In fact I have to specially request a static IP and pay money for it. A dynamic IP that changes when I refresh DHCP on the edge router is free.

ssivark2• 7 years ago

FWIW I encountered the same problem this weekend. On a fresh Firefox profile (no prior browsing activity), reCAPTCHA just wouldn't let me log in to a website! Out of curiosity, I wanted to see how long they deny me -- well over ten minutes before I gave up in shock and horror.

It felt like staring into the soul of evil.

driverdan3• 7 years ago

This is a common problem with FF if you have any privacy settings enabled. ReCAPTCHA does deep fingerprinting. If you block that fingerprinting it punishes you.

llao4• 7 years ago

Surely the same is true if you block these things in Chrome?

ehsankia4• 7 years ago

If you come up with another way that is as effective in an ever growing world of bots trying to break anything in their way, I would love to use it.

I've had to pay 100x bills on my monthly quota once too often, and as a hobby developer, I just can't afford trying to fight off people abusing my website every day.

Yes, resorting to fingerprinting is not ideal, but what's better, asking everyone to solve that hard captcha, or only some users?

nfRfqX5n• 7 years ago

being logged into gmail and the status of that account affects captcha as well

ehsankia4• 7 years ago

Not only that, you need to run multiple trials and average them. The post obviously picks the slowest most painful instance of a reloading captcha, where they got really unlucky. I've had those slow captcha's on Chrome too, they are not inherent to the browser.

ineedasername• 7 years ago

I disagree about the more appropriate for Twitter/Reddit than HN. But that's because my immediate interpretation, while not spelled out in the "article", was within the context of anti-competitive behavior by Google in making non-Chrome browser perform more poorly with google-created content.

llao4• 7 years ago

The topic itself is definitely super interesting and relevant. But the submitted post is pretty much a meme.

ginko• 7 years ago

The slow reloading of images is just intentional harassment. There's no other explanation I can think of.

Aissen• 7 years ago

That's a good idea for a research paper. Not something I'd OP though :-)

Kwpolska• 7 years ago

If you can, skip the visual CAPTCHA and just go for the audio version. You’ll help train Google’s speech recognition bots, but you’ll get through the CAPTCHA faster.

dessant3• 7 years ago

I was going through the same ordeal as a Firefox user, so I've made Buster to solve challenges and reclaim some of that lost time: https://github.com/dessant/buster

If you're a developer, please consider replacing reCAPTCHA on your site with an alternative. reCAPTCHA discriminates against people with disabilities and those who seek privacy, and it gaslights you into thinking you did not solve the challenge correctly, which is plain cruel.

Here are some reCAPTCHA alternatives: https://www.w3.org/TR/turingtest/

victorheld• 7 years ago

I've recently had issues with buster where Google detects it, giving me this error:

"Your computer or network may be sending automated queries. To protect our users, we can't process your request right now".

Is there a solution for this?

nprateem2• 7 years ago

It may not be buster causing that. I see that sometimes on a VPN, but also when not on a VPN but using Firefox with ghostery/ublock origin, etc.

dessant3• 7 years ago

It may help if you go to the extension's settings and enable user input simulation and install the client app.

Though Google may block your access to the audio challenge regardless of the browser or extensions you use, see more details here: https://github.com/w3c/apa/issues/25

megous• 7 years ago

I also get this sometimes, not even using buster. Once I was not able to access package tracking information, because Google blocked me completely via recaptcha from that.

I actually do a lot of automated queries from my computer.

I like to scrape and save content that may disappear. Just recently one psychology website I liked years ago where I put a lot of effort to comment on, silently deleted all 60k user comments, including 100s I wrote, and started putting old articles behind a paywall. My activity is perfectly legal, as I'm doing all this for my own personal use.

Thankfully I have all the content locally in the database.

Does it mean I should be prevented from accessing third party services that use recaptcha?

bongobongo• 7 years ago

If you're a developer, please consider replacing reCAPTCHA on your site with an alternative

I second this (for the same reasons that you cite), and it's fresh in my mind as I just recently began reimplementing authentication for my personal CMS. reCAPTCHA is not a nice thing to do to your users. And I also don't want to feed The Beast.

fasthandle7• 7 years ago

reCAPTCHA also just doesn't work in the most populous country in the world. translate.google.cn does, but Google's reCAPTCHA does not. This is a big pain point. Thanks for the link to turingtest, I will certainly test it.

shawnz3• 7 years ago

I thought recaptcha provided alternate domains/hosts not linked to Google so that you can use it in China. Is that not the case anymore?

granshaw• 7 years ago

To be fair, lots of things on the internet don’t work in the most populous country in the world.

baybal2• 7 years ago

I find it ironic that out of all things google, it was translate.google.cn to be given an exemption. There is a meme going around that this was country's chief censor's personal decision.

dmitrygr• 7 years ago

reCaptcha works just fine in India. It does have some troubles in the world's second most populous country.

judge20203• 7 years ago

The problem with recaptcha alternatives is that they either are insecure or require time and money to continue to be ahead of bots.

All of the "interactive stand-alone approaches" from that page can be beaten with run-of-the-mill OCR (other than perhaps the 3d challenge) and with almost any mobile phone speech recognition engine (and, if the attacker has the money, can send it off to Google's cloud speech-to-text).

All of the non-interactive approaches from the page require this constant tuning and upkeep to make sure bots aren't able to sign up/abuse systems. There's also not \that\ secure if your website is targeted and scripts are made specifically to avoid your anti-abuse methods.

briandear3• 7 years ago

Sending my data to Google as a condition of using someone else’s site also isn’t secure. Training Google AI also isn’t something I signed up for.

dessant3• 7 years ago

Hobby sites may be in a more difficult position, but businesses may decide between developer convenience and low cost, or excluding some of their users and tormenting them.

There are also ways to reduce the damage reCAPTCHA causes, such as keeping it out of the default UX path. Discord for example will show a reCAPTCHA challenge on the login page only if you are signing in from a new location.

reCAPTCHA cannot effectively defend sites against targeted attacks either.

pmontra• 7 years ago

I implemented simple question / answer antibot filters on registration forms for a few sites. Nobosy ever made the effort to customize their bot to answer to those very few questions. I guess it doesn't make sense economically. However if a big site would go that way, it would be filled with bots in a day.

benologist2• 7 years ago

The problem with CAPTCHA and the like are they seek to stop programmatic-browsing of websites, that both Firefox and Chrome support out of the box. If companies are concerned about non-human access they should make an official API instead of their website being a de-facto unofficial API. If they are concerned about fraud they will be woefully defended by CAPTCHA, it makes no judgement on the validity of transactions at all and doesn't prevent frauds signing in manually.

Ironically, Google has committed at least $75 million and likely hundreds more of fraud, via stolen refunds and stolen banned-account balances!

https://www.businessinsider.com/google-emails-adtrader-lawsu...

https://www.searchenginejournal.com/adsense-lawsuit/248135/

capsha• 7 years ago

Yeah, but then again, so many times that I run into Captcha issues, it's on a site that really doesn't need Captcha to begin with.

Why make me solve a Captcha to see static content?

Why make me solve a Captcha to log in when I've already completed one to register?

Why make me solve a Captcha to pay utility bills? Is there some underground group of deviants going around surreptitiously paying other people's utility bills? The monsters.

mitchty• 7 years ago

The problem with recaptcha alternatives is that they either are insecure or require time and money to continue to be ahead of bots.

Sure great, but when I see behavior like the above, I just hit back and add the site to my routers firewall black list. If its this much of a PITA to "solve" a captcha, CORRECTLY but I keep getting the middle finger I don't give a crap anymore. Your site isn't worth going to if I have to spend literally minutes "solving" captchas for googles stupid ai which is treating me like prove i'm a bot even when I prove i'm not.

Just realize by using recaptcha this is what you're forcing some users to deal with. And I deal with it by making sure I never come back to your site ever again when you've wasted minutes of my time just to try to get to your page. Even if its googles fault for being jerks, I don't care. You choose to implement it.

Ok rant mode off and stepping off my personal soap box.

zrm2• 7 years ago

How hard would it be to create an alternative using GPT-2 or the like?

Create a dozen models based on different things. Street signs, cats, houses, cars, etc. Then show the user a random selection of images generated from different models and say "select all the cats" and they get it right if they choose the images generated from the cat model.

modzu5• 7 years ago

wrong. captcha blocks bots and humans alike. so why bother with the fake puzzle at all? just replace whatever triggers your captcha with a straight up block. or else please consider a responsible alternative.

Semaphor• 7 years ago

and with almost any mobile phone speech recognition engine

My only problem with recaptcha is when audio doesn't work (google decides I'm spamming their network… sure…). Because their audio validation seems to use only one rule that says "letters where typed". So I'm not sure how being able to beat it with voice recognition makes it worse.

achingtooth• 7 years ago

I don't doubt that it's far easier to abuse traditional captcha systems, but I wonder how wide spread that is. A while ago I did a test with securimage and tensorflow/python/opencv/keras after I read a Medium post. While it could solve captchas with a little distortion when I added squiggles, dots, and more distortion it was unable to solve the captchas. I'm sure you could spend more time and create a system that can solve these captchas, I wonder how much effort some random spammer will put in to attack your blog. Yandex uses traditional captchas, and they don't seem to have any issues.

mcv3• 7 years ago

The problem with recaptcha alternatives is that they either are insecure or require time and money to continue to be ahead of bots.

You're posting this in response to an automated recaptcha solver. Clearly recaptcha also has trouble staying ahead of bots.

It seems to me that any simple automated test at the entrance is inevitably going to be easy to solve by bots, especially when it's a one-size-fits-all test like recaptcha, so bots have only a single target to aim at. A small-scale unique test will be more successful simply for that reason.

But it seems to me that the better way than to ban bots together with humans who fail to pass your Turing test, is to check for the behaviour you want. If you don't want spam, have a system to recognise spamming behaviour, rather than traffic lights.

mtgx• 7 years ago

and it gaslights you into thinking you did not solve the challenge correctly, which is plain cruel.

It's good to see some confirmation that you're not insane. Google's ReCAPTCHA is plain EVIL.

x3sphere2• 7 years ago

reCaptcha v3 works well for me. There are no challenges anymore and it just gives you a score based on whether it thinks the user is a bot/spammer, then you can do whatever with that. Personally if the score is low enough I just place the user in a restricted user group that needs approval on certain site actions.

netcraft• 7 years ago

Was just looking into using v3 today. Can you share what you consider to be low enough? I haven't seen any guidance on thresholds

avip• 7 years ago

Without taking any moral stance, it should be noted that accessibility was (and is) the most successful attack surface of anti-bots measures.

lern_too_spel• 7 years ago

Thanks for this. Extensions like this one make Firefox for Android worth it despite all the quirks.

swebs2• 7 years ago

Honest question: can we start a class action lawsuit for psychological damages due to this? I've experienced this firsthand when trying to use a service through a VPN. I spent legitimately 5 minutes trying to get through only to get "Please try again" every time even though I selected them meticulously. It is infuriating. I thought I was going crazy

beefhash• 7 years ago

In fact, Google has a patent on blocking users by means of CAPTCHAs that always return failure[1].

[1] https://patents.google.com/patent/US9407661

Avamander• 7 years ago

I just click randomly on Chrome and get trough .-.

m4632• 7 years ago

You cannot make an appointment on the california dmv website without using google services, in particular recaptcha. Also, just browsing the website, it tries to log you in.

https://dmv.ca.gov

additionally, lots of schools now require their students to use google services.

I hope there is a privacy lawsuit in the future to stop this sort of nonsense.

tootahe453• 7 years ago

Audio is not offered if you have non-default privacy settings, so this doesn't work when you're getting the most time-consuming captchas. So your extension is good for the captchas which take 15-20secs but not the 1minute+ ones, unfortunately.

kbenson• 7 years ago

If you want a good look at the state of the art in this field, look at Ticketmaster.

Ticketmaster uses both recaptcha and a pre-filtering solution they supply based on their own heuristics, as well as a complex user activity tracking system to determine whether you're a bot or not based on the activity you present and traffic you pass, so even if you pass all CAPTCHAs, they still might tell you to pound sand if you try to reserve something.

In the last few weeks, for select sales, they've even required unique phone numbers which they will SMS a number to or call and relay a code to which you need to enter just to get a single place in line for a sale.

I'm not sure of any company more actively on the forefront of prevented automated access than Ticketmaster (which makes it kind of funny when everyone chimes in about how Ticketmaster doesn't do anything to prevent brokers from getting all the tickets).

The problem is that what Ticketmaster is up against is people running specialized software that's able to emulate a browser, which ties into services that are specifically designed to beat CAPTCHAs in an automated manner using mechanical turk type solutions, but at a very low cost.[1] I have reliable testimony that some people spin up the largest AWS instance for an hour or so as needed, run this software, use a proxying service, and make 8k connections to queue up for tickets on a sale. Each AWS machine is another 8k positions in the queue. Every new layer Ticketmaster throws into the verification process knocks these people out for a couple weeks, until the company providing the software (which I believe charges a small percentage for every ticket purchased, so they fix problems fast) works around it. The arms race metaphor is very apt.

That's just one of the companies trying to circumvent Ticketmaster's road blacks for brokers. There are others that try to automate their purchasing to varying degrees. I myself work for a broker that takes a very different approach, where we use (relatively) very minimal automation, and have a person in front of a browser for every purchase (and we don't have many people at all), and instead try to make select purchases based of complex analysis and lots of data. Even that's gotten much harder in the last few years as venues and promoters have learned to play with the allocations of tickets, and hold large chunks of the inventory back to be released later at higher cost. I don't really see anything wrong with that, it's a market response to supply and demand, but it is unfortunately hidden in a purposeful manner, which affects not only brokers but the the end consumer, as market information is purposefully obfuscated (which makes the markets less efficient).

I've written on this multiple times before, so if anyone finds this interesting, just do an HN search for my username and Ticketmaster together.

1: https://anti-captcha.com/ (Scroll down and read their animated infographic for what is possibly the most amazing graphical metaphor of this I can imagine at step 4. It's so disturbing it's funny).

modzu5• 7 years ago

just adding another thank you. it has made the internet accesible to me and other humans again. cheers!

rodw2• 7 years ago

it gaslights you into thinking you did not solve the challenge correctly, which is plain cruel

That's interesting. Unless you are talking about having to click on more than one "page" of tiles (as illustrated in the video in the OP) guess I don't run into reCAPTCHA often enough to have noticed this phenomenon. Can you elaborate on what you mean by that?

pixelrevision• 7 years ago

Recapcha is absolutely heinous on an iPhone SE. The pictures are way too small and blurry to figure out what they are looking for half the time and it’s really not built well for zooming.

kabacha• 7 years ago

reCAPTCHA discriminates against people with disabilities

It discriminates against people who value their time. Who in the right mind thinks that spending several minutes on captcha is ok?

dbbk2• 7 years ago

None of your complaints are applicable with reCAPTCHA V3.

BuckRogers• 7 years ago

I just wanted to say thanks for posting this. I installed your addon when I first read the HN comments yesterday, and looking forward to testing out your work. It looked great!

pgug• 7 years ago

I there any anti reCaptcha or anti Google, that I can donate to? I want to donate a small amount every time Google forces me to solve their problems.

nprateem2• 7 years ago

Get a disabled person to take them to court for discrimination.

penagwin3• 7 years ago

Get a disabled person to take them to court for discrimination.

I was thinking something more along the lines of sponsoring them to take Google to court ;)

izacus3• 7 years ago

Pay the website owner to remove reCaptcha from the sites you use?

yumraj4• 7 years ago

Turbo Tax uses Google Captcha when trying to import information from financial institutions.

While filing taxes, on several occasions I had to just give up and try again after several hours because the Captcha won't let me pass through and after several attempts Turbo Tax will throw an error - to come back later.

It was literally a Nightmare

buildzr• 7 years ago

Interesting, I wonder if this is something TurboTax itself is doing or if it's something the banks are going and TurboTax is making you bypass it in order to scrape it.

yumraj4• 7 years ago

Not really sure, it was shown after the credentials for the financial institution were entered.

However, it was shown for each financial institution. So it is possible that the financial institutions (or the API provider) were doing it, though it is equally likely that turbo tax just has a bad implementation. Because TT can make an assumption that I'm a human, I wonder if there is a regulatory requirement or the API provider is doing that.

akeck• 7 years ago

It's a bit more expensive, but for this type of thing and other reasons, I now use a CPA.

muzika• 7 years ago

... who then use an Intuit product to file your taxes

rdiddly• 7 years ago

TurboTax itself is a dumpster fire, too. I recommend doing taxes on paper just to avoid touching Intuit or Google in any way.

yumraj4• 7 years ago

I don't think that's an option for anything other than 1040-EZ. I get lost filing with turbo tax, I can't even imagine how it'll be on paper.

sergiotapia• 7 years ago

I see a website with google captcha I just close it. Not going to waste time and also train this huge monopoly's AI further for free.

gosseyn• 7 years ago

Omg I knew I wasn't imagining things...I reached the point when I don't bother anymore...captcha means no !

navidfarhadi• 7 years ago

I have experienced the same behavior when trying to complete Captchas in Tor Browser. However the vast majority of the time it just says "Your computer or network may be sending automated queries. To protect our users, we can't process your request right now." so I cannot even attempt to complete the Captcha.

Yetanfou2• 7 years ago

When confronted with reCAPTCHA I always switch to the audio-version as that:

- is generally easier to solve (download the sound clip using curl or wget, type in the nonsense it says, done)

- does not turn me into a mechanical Turk training Google's AI

- works in 'any browser' by circumventing the browser (by using wget/curl), thereby not allowing Google to punish me for not using their dragnet/browser.

epanchin• 7 years ago

While you find this convenient, others may find it imperative.

Somewhat akin to labelling your pet dog a support animal or using a disabled bathroom.

yathern2• 7 years ago

More like walking up the handicapped ramp because the stairs are covered in oil and slippery.

zuppy• 7 years ago

I'm using the audio too. The image captcha is simply broken, it often doesn't let me pass even though I've provided the only valid answer.

atomwaffel• 7 years ago

does not turn me into a mechanical Turk training Google's AI

I’ve been wondering about that. Are you sure you’re not training their speech recognition AI?

Yetanfou2• 7 years ago

No, I'm not sure. It deem it unlikely though as those sound snippets are rather short and uncomplicated, something which I'd think any reasonable STT-system should be able to handle - which makes it vulnerable to those systems as well.

amedvednikov• 7 years ago

Every website that uses this fingerprinting abomination, should be ashamed.

prima-facie• 7 years ago

This also happens in Chrome when 3rd party cookies are turned off.

cptskippy• 7 years ago

So basically Google is abusing it's monopoly as a captcha provider to inconvenience users into enabling enhanced tracking in their browsers under the guise of "security"?

truth_seeker• 7 years ago

As a Brave browser user, I go through this partial behaviour every single time.

yegortimoshenko• 7 years ago

I saw both variants in both browsers.

SamWhited2• 7 years ago

I thought this was just me and their stupid caption being impossible for even humans to solve; turns out I was just being gaslighted this entire time and they're just discriminating against Firefox users? How does the EU or someone not shut down this sort of anti-competative monopolostic nosense? I didn't think I could get more furious about having to struggle with these captions all day, but somehow I am. Please everyone stop using recaptcha on your sites, it's not worth the pain it costs your users.

sniperjzp• 7 years ago

In Chrome Incognito mode, I saw it a few years back, but less frequently recently, it also happened to me with other browsers like Edge, Chrome in iOS, etc.

michaelt• 7 years ago

  they're just discriminating
  against Firefox users?

At least part of the behaviour shown in the video depends on factors like cookies, IP address, and whether you have features like anti-fingerprinting protection turned on. [1]

Recaptcha is frustrating and I dislike it, especially the slow fade-ins and multiple challenges, but if you repeat the test shown in the video you won't find it 100% repeatable just because you're using Firefox.

[1] https://github.com/google/recaptcha/issues/268#issuecomment-...

SamWhited2• 7 years ago

As far as I can tell it's 100% repeatable, every now and then one works the first time on Firefox, but it almost never does. If I use it in Chrome on the same sites, it works. Then I go back to Firefox, and sure enough it doesn't work again. Maybe there's something else making it work for you? I don't know what other factor there could be; some privacy settings in Firefox maybe?

AJ007• 7 years ago

If it can be statistically proven that this is occurring more on Firefox than Chrome then Google has a really, really big problem. The burden to make sure it isn’t is on them, most especially in the EU. Google is facing a very real future where they will have no web browser and possibly no operating system.

reitanqild• 7 years ago

After a a couple of minutes they sure should have an idea that I am a human, right?

Especially when I'm logged in with my 12+ year old paid account?

Won't say anything bad about googlers but in between this and the deeply irrelevant ads I get despite all yheir metrics the company seems deeply dysfunctional these days.

dmix2• 7 years ago

The website author seems to be Russian which might be an indicator. But not a good enough excuse for such terrible UX.

Using Firefox shouldn't be an indicator of anything malicious.

grinsekatze• 7 years ago

I just wasted ~15 minutes on doing the disqus login captcha under different conditions .. turns out that as soon as uMatrix is enabled (and blocks 18 cookies from google.com and 5 more from www.google.com), it starts to act up and get annoying..at least for me.

It then takes between 1 minute and 1 minute 30 to get past the recaptcha when blocking those cookies - and I was certain to be 100% correct in most cases and it kept asking me to solve more and more ..

most of the time spent solving the captchas is from the countless '4s fade ins' via inline style when cookies are blocked (as opposed to 1s fade ins via css, when cookies are set).

I'm curious why they would add 3s to the fade in if their cookies are blocked .. does that help to fight off bots, or does google just want to punish me for blocking their cookies?

threezero2• 7 years ago

EU may end up dealing with it, they need complaints first. You’d be amazed how few people fill out complaints with the government. I just filed a complaint about this with the US department of justice antitrust division, feel free to do so as well so they realize how abusive this is!

hosteur2• 7 years ago

Care to share your complaint?

vageli3• 7 years ago

EU may end up dealing with it, they need complaints first. You’d be amazed how few people fill out complaints with the government. I just filed a complaint about this with the US department of justice antitrust division, feel free to do so as well so they realize how abusive this is!

How do you go about filing this complaint? I'm sure many others (myself included) are interested

FerretFred• 7 years ago

Ha! Been there, done that. I registered with Patreon (using Firefox), then tried to login (using Firefox) after verifying my email address. Nineteen (19) Captcha screens later and I gave up. Seriously. Bastards (and apologies to the Creatives I was trying to contribute to).

OJFord2• 7 years ago

reCaptcha's not all bad guys, it's actually educational.

It's thanks to reCaptcha that I know what a 'crosswalk' is.

r721• 7 years ago

Also how storefronts around the world look like.

S_A_P• 7 years ago

It looks like the user missed one fire hydrant in the middle left square. If you look closely there is a tiny fire hydrant in that picture.

ferdek• 7 years ago

I laughed when mouse hovered over it like the user was deliberately looking for fire hydrant on this one and then just moved on with rage, waiting for other images to load :D.

I honestly think this was the reason why Captcha's bot was so passive-aggressive :D

helper• 7 years ago

I've seen that behavior using chrome on linux when using public wifi networks.

finchisko• 7 years ago

This doesn't make sense to me. Making reCaptcha work worse in FF without telling user that if he/she used Chrome it would be better. Only few tech savvy people (hn readers), will eventually realize that. And it doesn't make them to switch to Chrome (or does it?). They'll just be angry.

And btw I hate reCaptcha. Is it really only option to fight with spam? When I see it on sites, like dhl parcel tracking, I get mad. I always ask why? Can they just block suspicious traffic, or at least not display captcha on first attempt.

parrellel• 7 years ago

If you increase user friction enough, subtly, eventually the affected user is going to look for something else, and now there's only one real something else - especially for non-techie users.

darkhorn• 7 years ago

Dear developers, if you want to avoid most of the bots use only HTTP/2 and only TLS v1.3. Don't support lower protocols than these ones and your bot problem will decrease greatly. Even GoogleBot won't be able to crawl your web site.

netwanderer3• 7 years ago

This is exactly what you would encounter if you access Google services using TOR. It's actually even more frustrating than this.

peteretep3• 7 years ago

Would it be possible to build a Firefox plugin that creates and isolates the requisite cookies to allow reputation to be built, but at least partially maintains privacy?

I was thinking maybe something that has 10 difference Google sessions, and shards them depending on the website, deciding which to send to the Captcha. You'd build reputation at 1/10th the speed, but you'd still potentially build it. Or, one that allows you to create a random Gmail account and then use that as your identity across the different sites. Perfect privacy would be hard, but improved privacy should be doable.

Alternatively, getting something like blinded identity tokens widely used would be good.

dvfjsdhgfv• 7 years ago

I doubt it's easy, so I prepared such a setup myself, i.e. I keep a separate browser with a Google account and use it only when I really need to. Helps in cases like this one, but of course you give up some privacy - hopefully just the minimal bit.

ssivark2• 7 years ago

Sounds like Firefox containers should support this kind of usage.

Sean1708• 7 years ago

I'm fairly sure (but admittedly not certain) that captcha uses non-cookie and non-account based methods for identifying users, so I don't those methods would work.

peteretep3• 7 years ago

I suspect it falls back to the other methods, but if there are Google cookies, I'd have thought it starts with them cookies.

iicc• 7 years ago

https://github.com/privacypass/challenge-bypass-extension

peteretep3• 7 years ago

I'd love Apple to throw their weight behind this. Maybe this + bundle it seamlessly into iOS Safari.

SCHiM• 7 years ago

Big rant, there are few things I hate more than filling out their endless useless CAPTCHA's when browsing websites that have nothing to do with Google.

Google is a hypocritical pile of burning . They use bots right? They scrape websites, they infest everything from my banking website to console emulators with their tracking, and yet we little people are not allowed to scrape or interface with the web programmatically.

I want them to burn so badly, I hope the EU breaks them up. Screw captcha, screw AWP, screw them.

guelo• 7 years ago

It's the web developer that doesn't want you to interact with their site programmatically.

calibas• 7 years ago

Google and Facebook tend to do it as a matter of policy, and while they say it's to protect privacy and prevent abuse, it also furthers the "walled garden" effect.

mschuster91• 7 years ago

It's the web developer that doesn't want you to interact with their site programmatically.

Yeah because too many people abuse any hint of such functionality to peddle fake Viagra, pennystock scams, MLMs, ICOs or the good old SEO link spam.

Bakary• 7 years ago

They're not hypocritical but cynical. There is an appreciable difference.

fjsolwmv3• 7 years ago

Google respects robots.txt

saltminer• 7 years ago

I thought you could disallow Googlebot in your robots.txt file?

kalleboo• 7 years ago

Big rant, there are few things I hate more than filling out their endless useless CAPTCHA's when browsing websites that have nothing to do with Google

In some cases, the blame should be put on the site runners. I get a ReCAPTCHA when logging into my Patreon account. I've been paying then $10+/month for years now, they should know by now I'm not a spammer

klodolph• 7 years ago

This looks suspiciously like slowbanning.

deforciant• 7 years ago

I have noticed that Google often signs me off from my multiple Google accounts on FF too :/ While Chrome (which I use only for Hangouts) remains logged in. A bit annoying! :D

Also, good to see that it's a more widespread issue with these captchas too, I somehow thought that I am just bad at solving them :)

dredmorbius2• 7 years ago

My present Recaptcha policy:

https://mastodon.cloud/@dredmorbius/102054627041751386

turrini• 7 years ago

For Google Recaptcha, I use GreaseMonkey with an user script:

"Speed Up Google Captcha"

"Makes Google Captcha works faster by removing slow visual transitions and unnecessary delays."

https://greasyfork.org/en/scripts/382039-speed-up-google-cap...

pbhjpbhj2• 7 years ago

I'm really surprised that works, as I assumed the delay was random and it was looking for bots who were completing the image processing before the image has actually faded in. Huh.

matteopey• 7 years ago

This is the experience with the `privacy.resistFingerprinting` flag set to true. A while back I made a few try to see how the behavior change with different settings and extensions, you can see the result here: https://github.com/google/recaptcha/issues/268#issuecomment-...

I solved the problem by using an extension that toggle that flag: https://addons.mozilla.org/en-US/firefox/addon/toggle-resist...

unixfox• 7 years ago

The worst part is that fading effect is completely useless because a bot can wait too if it doesn't detect a proper image. When I tried to exploit Google recaptcha for fun it was an easy task for me to implement a timer that will wait for the image to appears correctly.

paradox1234• 7 years ago

I barely use Edge in Windows 10, but whenever I do and I go to any google site I get constantly badgered about 'downloading chrome' even though, a) I've already downloaded Chrome and have it installed, b) I've click such notices away 1000 times. More than mildly annoying and aggressive.

stcredzero• 7 years ago

1. Big company browser attains majority market share. 2. Big company browser's quality starts to slip, but they are not so powerful, they don't have to care. 3. Big company browser starts to work against the common good.

We've seen this before. We'll probably see it again.

neilv3• 7 years ago

Those storefront photos were remarkably clear/unambiguous, compared to some I've gotten.

When logging into an account I needed to log into, maybe a couple years ago, they'd jerk me around in the manner of this grumpy.website example, but more. One time, it went on for several topics, for what seemed around 10 minutes. I pay money for that account.

This obnoxious annoyance is in addition to the offense of some company letting third-party code from a mass-surveillance company not only into their pages (which almost every company with a Web site does, sadly) but also into their authentication page. Much more important services on the Web do not need captchas for login to accounts that were paid for. Now, every time I get a hassle to log in to my account I pay for, plus directly leak that info to a surveillance company. It makes me regret paying money for the account, like the company are oblivious or don't care, and I won't have much loyalty when the right competitor appears.

war10252• 7 years ago

I've never run into these image captcha things before. Where do they get used at?

Raphmedia• 7 years ago

It's the same widget as the checkbox but it throws the images at you if it has doubts.

war10252• 7 years ago

I guess maybe because I don't have all the privacy extensions installed that some people use?

bluehatbrit2• 7 years ago

I'm from the UK and often get very American questions. Such as "select all the images with cross-walks". This isn't really a phrase we have over here, so when I first got this I had no idea what I was meant to be looking for in the array of random pictures and actually had to look it up to get past it. If you're going to force me to do a captcha, at least localise the damn questions.

Do other non-American's get this as well?

GordonS2• 7 years ago

Another Brit here, and yes this does annoy me a bit.

bouke• 7 years ago

Or fire hydrants, which don’t exist in the NL. I only recognize those from US movies. Or taxi’s which can be any brand, model or color here. Sigh.

izacus3• 7 years ago

American storefronts are always an interesting guesswork for me. "Is this a rundown shack or an actual store?"

josefresco2• 7 years ago

American here: I when given the challenge of "select all the images with storefronts", typically they are not US based. I almost never speak/understand the language, but if there's a big sign on the building, I select it because it's most likely a storefront.

_emacsomancer_• 7 years ago

They're zebra crossings, but I suppose you know that by now.

The captchas are completely non-localised as far as I can tell; as others have pointed out the 'store-fronts' tend to be non-American.

bluehatbrit2• 7 years ago

Generally it's not too hard to find something in a picture that is from another country, but the actual request text should really be localised. I usually go for the audio ones now though rather than the visual ones.

eanzenberg• 7 years ago

Why are we labeling images for free for google?

krispbyte• 7 years ago

Not for free. It's a service the owners of the website give to Google in exchange for letting you post. You are the product here.

cyphar2• 7 years ago

I find it incredible that modern reCAPTCHA exists and is legal.

Aside from the the obviously concerning censorship that happens if you try to access reCAPTCHA-locked sites over Tor, it is literally forcing internet users to do free labour for Google so that can train their AI for whatever project they're doing.

So not only is it a tax on using the internet (paid in seconds to minutes of human existence each time -- I bet reCAPTCHA has collectively cost humanity thousands of lifetimes of wasted effort solving stupid puzzles) and it creates censorship, it also is an act of charity on our part that we provide Google free work with no benefit for ourselves. Given that they literally pay people to do (something similar to) what we are doing for free, I wonder it there are labour law arguments to be made (we aren't paid anything for this work which Google clearly is willing to employ people to do).

cameronbrown3• 7 years ago

You're barking up the wrong tree here. reCAPTCHA is a free service that developers implement. If you don't like that, complain to them. Companies aren't compelled to use Google services - they have no choice because the bot issue is untenable without it.

cyphar2• 7 years ago

Yes it's a free service which developers choose to use (though many sites use it without knowing through CloudFlare), but that doesn't change the fact that Google has decided to use it as a method of getting free labour out of internet users.

reCAPTCHA used to be far more reasonable and ethical when it was being used to digitise books. And when you got reCAPTCHA'd constantly as a Tor user, it wasn't so bad. These days I have to spend several minutes of my life giving training data to Google on every site which uses reCAPTCHA, with nothing in return except for the privilege to be able to access the internet.

snek• 7 years ago

I've had this a lot, thought this was a bug in firefox's rendering or something. Glad to know it isn't, but now I'm somewhat more annoyed to know the real issue.

jedberg• 7 years ago

I think what most people don't realize is that you don't need a good captcha to stop most abuse. Even the crappiest of captchas will stop 95% of the bots out there. Unless your site is a high value target, you don't really need a great captcha.

dawnerd3• 7 years ago

Happens to me in chrome every single day. I think it's a bug in how they're detecting potential bots. Of course no one at Google will listen when you submit reports. Especially the one about selecting street lights/stop lights/crosswalks.

tsjq2• 7 years ago

the concern here is about super-slow loading and more tiles to verify when you use Firefox than when you use Google Chrome browser

dawnerd3• 7 years ago

All of which I see in Chrome as well. Literally the same experience in the linked post.

user7647432• 7 years ago

Sometimes it's stairs, and they ask you to click all the stairs, but there's an inch of stairs overlapping one window, so you aren't sure if you should click that window because of the pixel or not.

This whole captcha joke and firefox made me hate Google more than anything else.

LeoNatan25• 7 years ago

It's simple; any shitty website that uses this garbage—don't use it. If there is a "contact us" page or email, tell them why you will no longer use it.

If it's your bank's site, move a bank. You say "oh, it's a lot of work just for some captcha"; yes it is, but this is the only way this clowns will learn. When 1000 people leave a bank for a competing one and say "I left because your site employs captcha", it will magically disappear. I've seen it happen.

yathern2• 7 years ago

Are you against all captcha then? How do you suggest websites deal with automated spam or other attacks?

crazygringo• 7 years ago

I've never understood what happened to reCAPTCHA, it was originally so great and is now just so, so toxic.

Originally it was an awesome solution based on OCR'ing books that usually worked quickly on the first try, and almost never took more than two.

Then it turned into a single checkbox (analyzing mouse movement) so it was even faster... and I remember some simple image-based like "select the images of cats" that were also easy to get right. So even better.

But THEN... in the past couple of years, the image-matching started asking exclusively for analysis of street images, that has two huge problems:

1) The images are so blurry and ambiguous it's really hard to get right, it feels like a test designed to make you fail

2) You never know how far you have to go -- you keep clicking items, they keep replacing them with new ones, and there's zero indication of if you're almost done or if you're getting better or worse.

Once I did one for three minutes straight, neither passing nor failing, until I just gave up and left the page... if it's a bug, that should never happen. If that's supposed to be able to happen, that's the apex of asshole design. Either way, it's a failure in every way.

fimdomeio• 7 years ago

Originaly it didn't belong to google, it was an aquisition. I remember seeing a ted talk about it.

To me it constantly feels like I'm working for google for free for their AI projects which is very annoying comparing to help a smaller company OCR books.

fjsolwmv3• 7 years ago

You aren't working for free. You get access to a website and the publisher gets bot protection. It's a 3 way win-win-win transaction.

rhino369• 7 years ago

Trying to convince a robot that you aren’t a robot by teaching a robot how to look at pictures is a pretty absurd state of the world.

When they reboot the Matrix, instead of being used as batteries, the machines will keep humans around for machine learning test sets.

mikro2nd2• 7 years ago

There's a third problem: quite a bit of the stuff they present is (almost) uniquely American and presents a recognition challenge in other cultural contexts. That yellow vehicle? Looks nothing like a bus in most other parts of the world. And so the rest of the world gets to learn what an American Bus looks like... Not, I think, what was intended.

jandrese2• 7 years ago

Or it tells you to pick out pictures of cars and shows you a pickup truck. Now you have to figure out if people would call that a car or not. How about a delivery truck? A motorcycle?

Or it will ask for pictures of crosswalks, and you have to decide if 3 pixels of a crosswalk in the corner of one of the pictures counts.

squidi• 7 years ago

E.g “Spot the fire hydrant” - oh, it’s those things that cops drive over in Hollywood movies. I don’t know if other counties have them too but it seems distinctly American and this capatcha is oddly common

simongr3dal• 7 years ago

I often get asked to identify store fronts. They are the worst.

The pictures are blurry and positioned at weird angles. There are lots of signs with east-asian letters (I'm not informed enough to guess what kind of alphabet they belong to) and I have no idea wether they are store fronts or not.

Is a sign to a dentist's office a store front? Generally it seems like anything with a sign above some sort of door or window qualifies as a store front.

josefresco2• 7 years ago

That hasn't been my experience. Most of the "storefronts" are (from what I can tell) based on Asia. I almost never see English signs. I'm still able to complete these challenges with only a little bit of difficulty.

Nition• 7 years ago

Fourth problem: How vague the instructions are. When I'm asked to click the boxes that contain signs, do I include the poles?

tomxor• 7 years ago

Totally this, I'm British and am probably more exposed to american culture than other nationalities on average, and yet recaptcha still sometimes leaves me clueless on some americanism, that is when it's not driving me crazy with it's infinite loop. For other nationalities it must be straight up discrimination.

I sometimes wonder if these projects are actually internal astroturfing, someone trying to make people hate Google from the inside, it's so bad it must be intentional right?

Izkata• 7 years ago

1) The images are so blurry and ambiguous it's really hard to get right, it feels like a test designed to make you fail

On top of that, I think some of the training sets are wrong. Multiple times I've been asked to find traffic signs, but it would only let me pass when including street signs.

jandrese2• 7 years ago

You have to answer the way most people would answer, not what is the most technically correct.

I guess if your adversary is a dogmatic AI then that might be by design.

ChrisSD• 7 years ago

There's also the issue that it will lie to you if the alogrithm decides it simply doesn't like you. Which means you'll end up doing at least a couple of rounds before it decides to let you through.

tootahe453• 7 years ago

If you use Chrome or Brave you can get multiple boxes wrong and still get through i've found, even on a cheap VPN IP.

jonas21• 7 years ago

I think two things happened:

1) Computer vision got a lot better over the past few years. It's also become way easier for the average Joe bot operator to run cutting-edge stuff. OCR tasks don't cut it for distinguishing people from machines any more. Every time I see a blog post about a new computer vision architecture or how some random developer trained a neural network to get an X% result on benchmark Y, I think to myself CAPTCHAs are going to get more annoying.

2) The frequency at which most people have to solve a CAPTCHA has gone way down. In the beginning, I remember having to solve a CAPTCHA every single time I did anything on some sites. Now, I can't even remember the last time I had to do more than just check the checkbox. So, the amount of annoyance is amortized over a larger number of sessions, and Google probably feels like they can ask the user to complete more tasks as a result.

MrMember• 7 years ago

I've noticed the opposite on #2, especially in the last year or so. I've been solving a lot more captchas than I used to. I run Firefox with a lot of privacy focused add ons and I don't stay logged in to Google, I wonder if those have something to do with it.

mleonhard• 7 years ago

The frequency goes down as Google identifies you with stronger confidence. Try browsing from a VPN and you will spend half your time solving CAPTCHAs.

baby• 7 years ago

2) isn't true at all for me. I've always loved captcha and it has become a huuuuuge annoyance as soon as I'm using a vpn, tor, a weird wifi, a non-typical device, etc.

It is so freaking slow. I sometimes lose 60s to complete a captcha.

nonamechicken2• 7 years ago

I am also getting way more captchas at least since the last 6 months. Exclusively using Firefox with clear everything on exit, multiple profiles, fingerprint flag on, some addons etc. No VPN. I get captcha almost all the time, even for Google searches from Firefox address bar (one out of 10 searches I think). But never gets a captcha for Google websites (gmail, youtube etc).

psadauskas• 7 years ago

I keep expecting it to eventually ask me to "click on the pictures of terrorists" and them using it to train automatic drone targeting software.

izacus3• 7 years ago

What happened? The spambot algorithms have gotten better and can now defeat the simple tasks. It's a perpetual arms race of you vs. the spambot developers.

burtonator• 7 years ago

They also changed it so that if you've seemed human in the past, they're able to determine if you're probabilistically a human now.

This data is a few years old but I imagine it's the same based on my experience.

They're using your cookie + IP + your account data to determine if you're probably a human.

A LOT of reCAPTCHA sites never prompt you. You only know if it's there because you're on Tor or something.

kccqzy• 7 years ago

A LOT of reCAPTCHA sites never prompt you.

That has only happened to me in Chrome, not Firefox or Safari. Which is the subject of this article.

djsumdog• 7 years ago

Yea it was much better when it was run by Carnegie Mellon. I guess selling it to Google seemed like a good idea at the time.

Today I feel like Google uses it mostly for their self-driving-car computer vision projects.

neilv3• 7 years ago

An insightful remark about ReCaptcha on HN recently (I don't have a link) was that it went from being "are you human" to "which human are you".

amenod• 7 years ago

Ha, ha, very accurate observation.

And if Google keeps the pressure and nothing hits them back, soon the answer will be "Number 17 of 312 still using Firefox".

I still can't believe how Google has changed their tune - from "dont be evil" to being worse than MS ever was, which is quite an achievement in itself.

mehrdadn• 7 years ago

It sounds funny but I don't get it. ReCaptcha doesn't identify you does it?

luxuryballs• 7 years ago

they’re using the service to train self-driving cars to recognize traffic lights, bicyclists, etc

xxxpupugo• 7 years ago

Because it is an adversarial system, the busters are getting better, so reCaptcha needs to catchup.

vasili111• 7 years ago

It is made by google to train their neural networks. Neural networks are evolving and need harder examples for training.

distant_hat• 7 years ago

Sometimes it is straight up wrong too. I once got a picture of a sign with a traffic light on it asking me to identify the traffic light. If you selected nothing it wouldn't let you go ahead. So I clicked the squares with the sign and it let me proceed. I don't even think it should be that difficult to see that it wasn't a traffic light since all colors were bright. A typical in use light will only show one color at a time.

Macross8299• 7 years ago

I believe even worse than showing you new sets of images is when the reCAPTCHA system gives you a "low trust score" and intentionally fades out the selected images, but very slowly, and replaces them with new images of the same type. Just downright feels abusive to the end user. Good luck if if you have tweaked any browser settings to be more amenable to privacy!

I wish more sites would implement a Jigsaw-puzzle-style similar to the Binance login captcha, but I can't speak to the efficiency of that in defeating bots.

antisemiotic• 7 years ago

Originally it was an awesome solution based on OCR'ing books that usually worked quickly on the first try, and almost never took more than two.

People kept trolling it by typing the test word correctly, and random garbage instead of the OCR word. It was easy to spot which one was which. Source: I was one of these people.

AshleysBrain• 7 years ago

This fits the pattern of Google consistently going "oops we broke Firefox" (or otherwise made it worse than Chrome) to the extent it raises suspicion of a deliberate strategy, as described by this former Mozillian: https://twitter.com/johnath/status/1116871246510264320

willtim• 7 years ago

My company proxy kept triggering endless Google captcha games. I switched to DuckDuckGo.

tsjq2• 7 years ago

i shifted from Chrome to Firefox a few months ago. been facing this super-slow Captchas. I simply assumed this is due to some network slow / server slow / browser slow. I didn't even bother to go back to Chrome to compare this.

After reading comments in this thread, now I realize this is intentional thing against Firefox.

Damn Google. what happened to your "Don't be evil" beginnings ?

TheKarateKid• 7 years ago

I get this all the time with Safari.

It’s because Google can’t read as much about you in more privacy based browsers, so you have to prove yourself.

Not saying it’s right, but that’s the reason. It needs to be changed.

N0RMAN• 7 years ago

Someone explain to him that you have to click the Verify button on both browser.

stunt• 7 years ago

I don't have this issue.

shanth• 7 years ago

nah i just need to use tor with chrome to get the same effect as firefox.

neya• 7 years ago

This happens even on Chrome. If you're logged into a Google account, it seems to know that you're not a bot since your Google Account is tightly integrated within Chrome. If you try the same captcha on an Incognito page on Chrome, you will have the same experience as on Firefox. Atleast, that's the case for me.

somebodythere• 7 years ago

The latest captchas are so hard that when I encounter one, it really feels like I am engaged in an unpaid labor relationship with Google.

It makes me sad that they are so pervasive or I would categorically refuse to engage with any site that uses reCaptcha.

hosteur2• 7 years ago

I consider putting the following on my cv:

2016-2019: working for google - analyzing street footage for implementing AI for self driving cars.

Maybe I should also invoice google for the effort.

emiliobumachar2• 7 years ago

Would a class action lawsuit for unpaid wages be plausible?

bussiere• 7 years ago

Human seems able to see face on anything. WOuldn't be a good idea to use this as a way to make a captcha ?

dpcan• 7 years ago

I never use Firefox, but I'm pretty sure I've seen this same format before in Chrome. No?

NelsonMinar2• 7 years ago

Do websites get paid to run reCAPTCHA?

I keep seeing reCAPTCHA installed on very low security sites that don't seem like targets for automated bots. I'm wondering if they have some external incentive to install it.

quwert95• 7 years ago

As a developer who has worked with reCAPTCHA in the past and as a diehard Firefox user, what likely happened here is a form of shadow banning.

You're moving too fast; your mouse and mouse clicks are "too good" to be human. Try solving the reCAPTCHA slower and you'll see wildly different results, or, purposely fail one reCAPTCHA to get easier ones.

reCAPTCHA tech is crazy; reCAPTCHAs are not simple web forms and Javascript, they're a sandboxed and monitored 'window' to a Google server. If you solve too many reCAPTCHAs too quickly (ie. when you are testing a web page, or are rotating your passwords on many websites) then Google's servers will try to rate limit you with slow animations and harder reCAPTCHAs.

resoluteteeth• 7 years ago

reCAPTCHA tech is crazy; reCAPTCHAs are not simple web forms and Javascript, they're a sandboxed and monitored 'window' to a Google server. If you solve too many reCAPTCHAs too quickly (ie. when you are testing a web page, or are rotating your passwords on many websites) then Google's servers will try to rate limit you with slow animations and harder reCAPTCHAs.

Google should absolutely not be in a position where it can be inadvertently rate limiting your attempts to rotate passwords on different websites across the internet.

hhjinks• 7 years ago

This is bullshit. I regularly experience the "Firefox" example in Chrome, but only in incognito mode. Either way, it's not something Google does deliberately to disincentivize other browsers.

DrJaws• 7 years ago

The thing that happens to him in firefox, it also happens to me in chrome.

misleading

simias• 7 years ago

I'm a Firefox user and I did encounter some issues with reCaptchas in the past but this video doesn't convince me at all.

For reference I post regularly on 4chan (not compulsively but maybe a dozen comments a day on average) and if you don't have a pass you have to fill the captcha every time. I only use Firefox. I definitely experienced what this video shows on Firefox in the past (the super-slow loading images) but it felt more like a bug than anything else and it doesn't represent the typical experience. Maybe I tripped one of Google's bot filters somehow and I ended up with a reinforced captcha, or there was a bug somewhere.

The Chrome section of the video is a lot closer to what I see usually, but they make me go through two challenges in a row typically (although that might be 4chan's settings at play).

I'm all for the Chrome hate if it means that people switch to Firefox but I think we need harder data than a short video to call shenanigans on that one.

Off topic rant: the fact that a post with such lack of substance manages to reach 700 votes in 3 hours is frankly depressing, it has no place on this website IMO.

seieste• 7 years ago

I believe this is part of a greater Google strategy of using their monopoly power.

I’ve noticed that in the last week, Google no longer provides a link to the non-amp version of pages. Previously, you could press two button taps to get to the non-amp page, but now that ability has been removed. This sucks because Amp doesn’t always support all the features of a normal site, like Reddit or blogs (commenting).

I worry how Google will abuse this in the future. Right now they control the first page you visit after leaving Google through AMP, but you can usually find a link to the home page of a site. In the future, they may restrict it further.

caconym_• 7 years ago

The mainstream internet of today exists to serve the advertising industry (including but not limited to Google) and things that don't so serve will be marginalized like an organism rejecting a foreign body or disease. It's funny, because really the thing that makes users "more significant" than bots for the average website operator is that showing ads to real people has a monetary value attached to it. That is the only reason you prove your humanity to a machine: to validate your suitability as a target for ad spend.

hollander• 7 years ago

I've noticed this effect as well. The white boxes, waiting and waiting, four or five different consecutive tests. All in all a terrible user experience. I thought it was because I used VPN, but this is another explanation.

mikejb• 7 years ago

I'm not sure what the comparison is on Chrome vs. Firefox. I've had the pain of these slow animations, with a follow-up captcha, and it's infuriating - On Chrome. Is it better on Firefox?

tootahe453• 7 years ago

I decided to test this for a good hour once. I was suprised how little it actually matters whether you're on a cheap VPN (although i do think they limit TOR) or are actually getting the answers correct. Load up chrome or brave, and it almost instantly solved, whereas Firefox on default privacy settings is a total pain. The worst thing is how they purposely try to just waste your time with the fading images, like in OP.

r00fus2• 7 years ago

I use a site frequently and am on the latest FF and I don't see this behavior - the refresh is quite quick.

Does this mean that Google knows enough about me (ie, privacy leak) that it's choosing to not having infuriating UI?

teekert• 7 years ago

Oh, I thought it was me... seems like it was my choice of browser. In any case, perhaps Google has a harder time telling me apart from a computer. I guess that is a plus for FF then.

realcr• 7 years ago

I experienced a similar problem. I'm using Firefox. Two websites I have great difficulties logging into are twitch.tv and italki.com, both require solving a google captcha that can sometimes take more than a minute to solve.

I am working on a micro-payments system (based on mutual credit) that should allow to pay something like $0.001 instead of solving a captcha. If this would introduce zero extra friction, would you consider using this kind of solution over the traditional captcha?

cloud_thrasher• 7 years ago

From my experience, it's the "Access-Control-Allow-Origin: *" response header that causes the problem. So, it's in the way Chrome uses/enforces cross-origin HTTP request/response headers.

elagost• 7 years ago

reCAPTCHA is malware. If a site uses it, I (usually reluctantly) stop using the site. It's not even a privacy issue anymore - I'm logging into the site, usually so I can give them some money (bandcamp, humble bundle) - I just don't want Google all up in my business. Is that too much to ask these days? In order to not have some creepy giant corporation overseeing everything I do, I guess I just have to not use the Internet.

make3• 7 years ago

this is just unacceptable

anticensor2• 7 years ago

A class action for drudgery needs to be started.

superasn• 7 years ago

The Recaptcha 3 is even worse. For example go to truecaller.com and enter a phone number to lookup in Firefox (android). You won't be able to, it will say Recaptcha had failed. Now do the same in chrome on Android and it works. It's because on ff it gives a low score (i. e user is a bot) while on chrome it passes without a hitch.

Funny thing is I haven't used chrome in months so it should be the other way round!

taf22• 7 years ago

I can replicate this same thing in a chrome incognito window...

glenngillen• 7 years ago

If you’re looking for a good commercial alternative that isn’t turning you into a mechanical Turk to train/classify ML: https://funcaptcha.co/

If you’re primarily trying to stop bots and similar take a look at https://www.kasada.io/

miohtama• 7 years ago

reCaptcha v3 fixes this behavior. Instead of having one gateway test to determine if you are a human or a bot, it collects data on a background on your browsing behavior. Thus, it has a longer browsing behavior sample for heurestics.

https://developers.google.com/recaptcha/docs/v3

Of course, you need to have cookies enabled.

If you do any browser in ignonito mode and/or use VPN or Tor you are going to get persona no grata treatment because it is likely your source network and IP address have caused a lot of problems before. The only way to go around is to have some permacookie on your browser saying you are a good citizen.

floatingatoll2• 7 years ago

HN previously, when Google released RCv3: https://news.ycombinator.com/item?id=18331159

Has anyone posted a technical analysis of the changes? I’d love to read more about it.

goblin89• 7 years ago

In my experience[0], the captchas are rotated regardless of the browser. The captcha shown each time seems to be chosen based on some sort of hidden “trust level”, which fluctuates across attempts based on your choices.

The starting level, I suspect, is heavily influenced by browser settings and many other factors. With that in mind, and assuming that

1) trust inversely correlates with anonymity,

2) people using Firefox tend to be more tech-savvy and careful about their privacy, and

3) tech-savvy people using Chrome probably won’t bother locking it down, since it “talks to Google anyway”,

I’d be disinclined to believe Google actually discriminates against browsers—no matter how compelling a narrative this may seem—until I have a complete picture of OP’s setup (from browser settings to OS and connection).

[0] Last year there was a period I was getting many captchas (either my location or AWS VPN caused me to be considered “untrusted”); I actively tried to figure out how to get past it without giving the algorithm what it wants, so I could go through a dozen of these captcha screens in one browser window. I use Safari, Firefox and Chrome routinely.

joshfraser• 7 years ago

I absolutely hate CAPTCHAs and have done my best to persuade developers to never use them (1).

But in fairness to Google, the promise of their new Captcha system is that it uses all of your previous browsing history across the web to determine how likely you are to be a bot. You can't do a fair apples to apples comparison unless the browsing history and behavior is the same across both browsers.

1) https://www.onlineaspect.com/2010/07/02/why-you-should-never...

driverdan3• 7 years ago

Based on some CAPTCHA solving sites it costs about $3 per 1000 ReCAPTCHAs solved. That shows you how worthless adding ReCAPTCHA to your site is. All it'll do is slow bots down a bit and cost $0.003.

Here's an extension to use those services in the browser so you never have to solve one again: https://addons.mozilla.org/en-US/firefox/addon/recaptcha-sol...

That's assuming you can't get Buster to work.

gouh• 7 years ago

Or even pay, I wouldn't mind paying 0.003$ at each Captcha as long as I have an anonymous payment system.

napsterbr• 7 years ago

That's exactly what happens to me on an almost daily basis. But then I decided to change my feeling from rage to revenge. Here's how:

I get the first few selections right, so the algorithm knows I'm trustworthy. Then I purposefully get the last ones wrong. This way, I'm still validated by the captcha and I get to show the middle finger to Google.

Now I smile every time I'm faced with reCaptcha :)

Highly recommend. It does take some time to figure out the patterns (when to get it right and when to get it wrong), but once you do, it just works.

terrycody• 7 years ago

I got same thing in Chrome too, so I guess its related trackers, not just for firefox lol.

NamTaf• 7 years ago

Oh wow, I assumed it was just my combination of ublock origin + privacy badger + accelereyes + privacy-first settings in FF (block all 3rd party cookies, containers, resist fingerprinting, etc.) that caused many hits.

I'm not sure whether I'm glad to find out it's (also? only?) because they hate Firefox.

m4632• 7 years ago

Google chrome can already identify who you are and it knows you're not a robot.

That said, it still forces you do to work for its self-driving car effort.

camgunz• 7 years ago

Antitrust investigators should look into captcha stats for at least browser, ISP, mobile device, IP address, and referer header. It would be better if they could just get Google's algorithm, which I assume is based on more data. I'd be very surprised if Google popped captchas less for non-Google IPs, devices, and browsers.

ashaikh• 7 years ago

Does Google use this data to help train its self driving cars and maps for identifying information?

I feel like every captcha is about a street scene of some sort... house numbers, cars, motorcycles, hydrants, stop lights etc.

627467• 7 years ago

My default approach is to leave site that require reCaptcha (meaning, when ticking the box triggers the challenge) but when I do need to take the challenge I make sure I sprinkle my results with subtle errors.

vageli3• 7 years ago

I'm frankly surprised there has not been an ADA-based lawsuit against Google. I can't tell you the number of times the audio captcha has been unavailable for "reasons".

nilsocket• 7 years ago

Google search results page in Firefox mobile browser looks like it is from 2010.

I filed a bug report, only one version of it is fixed, later versions were just displaying same old pages.

piyush_soni5• 7 years ago

There have been many discussions on HN about this before. Google is making us its free slaves, when they can clearly know in the first click that we are not a robot (it used to work perfectly! How can it unintentionally become that worse?) Is there no Google employee here that sees how absurd this is and get this message sent across?

tyler_larson2• 7 years ago

Congratulations, you played yourself.

It's not Firefox that's the problem; reCAPTCHA works just fine on Firefox. It's all those anti-tracking measures you installed and enabled -- they work by making your browser indistinguishable from a low-quality bot, kicking the website into self-defense mode. The slow fade is a rate-limiting measure. It's annoying to you, but it's more annoying to people trying to automate login attempts.

The site is attempting to protect your account by preventing automated attacks against it. Meanwhile your browser is doing it's best to look like a shell script, refusing to send any sort of behavioral feedback or distinguishing characteristics that might give away the fact that you're a human.

So the question is: is it really worth alienating those quirky, paranoid users who take extraordinary anti-tracking measures, just to protect your normal users from automated attacks?

Yes.

Of course it is.

lousken• 7 years ago

Can someone from recaptcha team respond to this? Because this happens to me all the time and it's ridiculous

Google's Captcha in Firefox vs. in Chrome

Related Stories