ReCAPTCHA and the Anonymous Experience

https://blog.repl.it/anon

by simonpure • 6 years ago

91 106 6 years ago

blog.repl.it

S04dKHzrKT• 6 years ago

As someone that hasn't had to use any captcha services, does an alternate like hCaptcha not have feature parity with reCaptcha?

ve55• 6 years ago

On the surface it does, but many more users will have to complete the captcha, since they cannot judge your 'humanness' by your Google cookies+account.

Although I like services like hCaptcha a lot more myself, it may be possible that this notably bothers users and decreases conversion rates.

feanaro2• 6 years ago

I don't have a Google account, I fanatically block Google's tracking and I still usually don't see captchas. For this reason, I don't think this holds.

daveoc64• 6 years ago

Its approach to accessibility is terrible.

https://dashboard.hcaptcha.com/signup?type=accessibility

As a user that can't answer the challenges, you have to register with hCaptcha in advance of using the website you want to.

This lets you bypass the verification checks for a while.

The discoverability of this is poor

lrvick4• 6 years ago

And throws privacy out the window.

miyuru• 6 years ago

hCaptcha does not have IPv6 support. It breaks the web, when trying IPv6 only.

whatsmyusername3• 6 years ago

Sooooo hcaptcha is way more aggressive. Like when it first went into cloudflare it made browsing the web miserable.

They've since seemed to put a lot of work into it. To the point where I don't notice it anymore.

They're iterating, and that's what I want to see.

sofixa• 6 years ago

Out of the loop, didn't know reCAPTCHA became paid. After a quick Google search I can only see that the Enterprise version is paid,but v3 isn't.

Can one still use v3 and not pay for Enterprise?

GlitchMr• 6 years ago

reCAPTCHA v3 has 1000000 calls per month limit, after that for commercial purposes you need to migrate to reCAPTCHA Enterprise.

octoberfranklin2• 6 years ago

So can I boot lame websites out of the free tier by making 1000000 bot requests to the captcha page?

Or does Google only count successful human detections towards the 1000000-request limit?

ffpip• 6 years ago

Guess they got tired of training their AI for free. Started charging now

Contax2• 6 years ago

Started charging now

So... a web/company has to pay Google for the service... while the company's users/visitors will still do free AI training for Google? If that is how it works, that's some bold business plan (money on top of free labor).

akalsz4• 6 years ago

reCAPTCHA
anonymous

Pick one. reCAPTCHA is based on tracking users in countless unknown ways, which is why it's basically unusable with any kind of known proxy (i.e. Google usually classifies Tor users or users from 3rd world countries as bots by default). It may be stopping "dark web hackers", exactly because it's unsolvable by anyone Google decides to be a potential threat, and that also includes bots.

Honestly, I feel like everyone would be better off if instead of reCAPTCHA, websites just used some service that automatically blocks proxies. That way you aren't getting Google to track legit users, and still forbidding potential users from joining who would otherwise be blocked by reCAPTCHA. And maybe if Google isn't watching me on your website, perhaps I'll be more inclined to visit you from my actual IP.

Or just use something that is actually solvable by humans, like hCaptcha. Cloudflare did that and it's wonderful (well, compared to reCAPTCHA), I can solve it in a few seconds, unlike reCAPTCHA which I can keep clicking on for countless minutes only to get told that "my network is sending too many requests" or something.

arbol6• 6 years ago

I also can't get through Google recaptcha. Proxy services rotate their up blocks so you can't simply block them all.

Captchas are in their infancy. We need to move beyond something that involves simply clicking to identify images - we're providing free training for AI, not to mention the fact that it's incredibly inconvenient for blind people.

I think a measure of uniqueness is required based answers to questions that don't necessarily have correct answers. The distance between the question and answer would be the measure. Identifying questions that provide consistent distances for individuals would be the hard thing.

throwaway3699• 6 years ago

Captcha have audio versions for the blind, no?

qertoip3• 6 years ago

Tor/VPN/proxy users are legit users, for fucks sake.

akalsz4• 6 years ago

They can't be distinguished from bots with tracking, and tracking is pretty much all v3 does. Google doesn't seem to care about collateral damage, I suppose it's the "why use VPNs/proxies if you have nothing to hide" mindset.

whatsmyusername3• 6 years ago

Yes but we're a business. They're not profitable users.

edit: Downvote and be mad if you want, but payments made through known tor/vpn services are not getting through fraud review.

y72• 6 years ago

Honestly, I feel like everyone would be better off if instead of reCAPTCHA, websites just used some service that automatically blocks proxies.

That's even worse than reCAPTCHA. At least as a human using Tor you have some shot at solving a captcha, even though you usually have to try 5 times or move to a different end node.

0xdeadb00f• 6 years ago

I've been caught in captcha loops before. It will flat out refuse to let me in and I will solve captcha after captcha after captcha. This has happened to me when using Tor, being prompted by that annoying Cloudflare "Attention Required!" page both when they were using reCaptcha AND when they more recently switched to hCaptcha.

It would have saved me quite a lot of time if those sites had just flat out said "403 Forbidden".

ClawsOnPaws• 6 years ago

Their accessibility mode is "Give us your email and we'll probably think you're a human for a while... until we don't and make you use privacy pass... until we take away your tokens because yeah you're absolutely a bot.". yeah... no. Absolutely not. Also that thing doesn't work with incognito, nor vpn's/tor/whatever. I've stopped trying to bother with numerous sites, all running behind Cloudflare, for exactly this reason.

BlueTemplar4• 6 years ago

Cloudflare

I'm starting to think that Cloudflare is even worse than the GAFAMs, due to its impact on so many of the other websites :

https://www.gigablast.com/blog.html

(If it can even be separated from them, considering that Cloudflare has received up to $110M from Microsoft, Google and Baidu !!

https://techcrunch.com/2015/09/22/cloudflare-locks-down-110m...

tleb_• 6 years ago

It troubles me how a company can say in the same post that it respects user privacy and used Google reCAPTCHA. It's not only about what you collect, it's also about what third-party services collect. Otherwise the magic solution to respecting user privacy would be using a back-end as a service (e.g. Firebase).

I might try navigating the web while blocking reCAPTCHA. How limited would my reach be? And what about blocking CloudFlare's solution?

CGamesPlay• 6 years ago

Charging for reCAPTCHA, and even removing the free tier, seems like a good win for consumers. By having a non-zero price tag, companies are forced to actually attach a monetary value to the service, which will discourage them from using it so frivolously. As it stands today, reCAPTCHA costs consumers both privacy and time, and costs the companies nothing.

octoberfranklin2• 6 years ago

Yeah the amount of website laziness that reCAPTCHA has prompted is ridiculous.

Guess what, folks, every visit to your website involves some mix of humans and software. Nobody uses the web without a browser, and every browser was written by a human. You aren't entitled to make hair-splitting distinctions and dump the enforcement burden on the public.

swebs• 6 years ago

As it stands today, reCAPTCHA costs consumers both privacy and time

Also it forces users to perform unpaid labor for Google.

dheera2• 6 years ago

Why not simply just not differentiate between humans and bots, and enforce a usage policy that works for your business?

You don't want them scraping 1000 articles an hour? Just put a limit on viewing 20 articles an hour, no need to differentiate between human and robot.

The boundary between humans and robots will blur over the next few centuries. At some point it will just be a spectrum from all-inorganic to mixed to all-organic beings that roam the planet. We might as well prepare for that future by abolishing chemistryism (discrimination against organic vs. inorganic chemistry of a being) today.

(Yes this sounds stupid, but 200 years ago, abolishing racism sounded stupid too.)

marcinzm• 6 years ago

Limit by what? IP? Bots are distributed across IPs while certain users share IPs (NAT, universities, etc.). Cookie? Bots won't store cookies. Overall? Then human users will be blocked outright if there's enough bots.

judge2020• 6 years ago

That's only for huge clients - it's free if you'll have less than a million assessments per month[0].

0: https://www.google.com/recaptcha/about/#combined-table__tabl...

02020202• 6 years ago

fuck recaptcha and all websites that make it impossible to use without it. the state of current things is insane. i can't even talk with the government or pay some bills without letting google spy on me. this is ridiculous.

Contax2• 6 years ago

I feel your pain. Google is cancer for the web. And it should be illegal for sites to require third-parties you want no business with, at the very least for public or utility sites.

fab1an• 6 years ago

Consider hCaptcha - it's basically a superset of reCAPTCHA's functionality, but much more privacy-friendly and more affordable at scale. Also, it lets anyone label their data on it, not just Google. Full disclosure, I work with their excellent team.

milankragujevic• 6 years ago

Just wanted to thank you for mentioninf hCaptcha.

I had tried it some time before but IIRC it was either invite-only or enterprise-only or had some "size" requirements.

Just saw that it's available for all. Thank you!

lrvick4• 6 years ago

Cloudflare/hcaptcha are the bane of my existence.

Privacypass itself is a privacy violation and not available on most browsers and I don't want to spend an half hour a day doing free labor training someone else's AI to just use the internet anonymously.

gruez3• 6 years ago

Privacypass itself is a privacy violation and not available on most browsers

what? https://support.cloudflare.com/hc/en-us/articles/11500199265...

It has addons for firefox and chrome, which makes up 90+% (by market share) of the browsers out there.

whatsmyusername3• 6 years ago

Cloudflare was a blessing for us. It's an incredible service for the price.

Business tier (we needed custom certs) + advanced ssl is like $220/month and you get a WAF, a world class cdn, and DDOS protection.

zepearl• 6 years ago

Thank you! (it's this one https://www.hcaptcha.com , right? )

I was thinking about looking for recaptcha alternatives since October and until now I wasn't aware of hcaptcha.

spyder• 6 years ago

Uh... please no, it requires double the clicks/time to solve it. I just tried it: reCaptcha 5 clicks, hCaptcha 10-12 clicks

lights0123• 6 years ago

although, installing Privacy Pass allows you to bypass 5 hCaptcha prompts for every one you solve.

GoblinSlayer6• 6 years ago

FWIW recatcha had or still has noscript mode.

kasabali• 6 years ago

it's basically a superset of reCAPTCHA's functionality

If by superset you mean it's as anyone as ReCaptcha plus 10 times more, I concur.

Recaptcha is annoying but at least it gives me a relief short a while after solving it. hCaptcha is dumb as rock and challenges me every 10 minutes even when browsing the same fucking website.

qertoip3• 6 years ago

The only long term solution is to request anonymous users to commit a tiny amount of cryptocurrency.

If you don't want to deal with cryptocurrency then this could be simply a provable burn - purely an IT thing with no accounting team involved.

beagle33• 6 years ago

Bitcoin is pseudonymous, NOT anonymous, and is often easy to connect to a real identity (and there’s already legal action against tumblers, etc, that would make it even more so)

Monero and ZCash supposedly offer real anonymity, but IIRC all implementations so far have been found vulnerable to (at least partial) deanonymization.

Crypto currencies may have good uses, but so far, anonymity is not one of them - most definitely not for the masses (and hard-to-impossible for the very disciplined and knowledgeable pros)

qertoip3• 6 years ago

We are talking about relative anonymity against specific service provider and not necessarily absolute anonymity when the government descends upon you.

VPN or proxy users are not really anonymous anyway and would certainly welcome an option to pay $0.1 in cryptocurrency instead of fighting infuriating CAPTCHA-s all the time.

BlueTemplar4• 6 years ago

Bitcoin has 'mixers', using which, AFAIK your anonymity goes from zero to 'only the NSA will be able to track you down'.

bzb6• 6 years ago

Why haven’t they considered using other captcha solution?

shuringai• 6 years ago

just use hcaptcha. even cloudflare switched to it

pdkl95• 6 years ago

reCAPTCHA won't even try to work if your UserAgent isn't on Google's short list[1] of supported browsers. If they don't like your browser, the reCAPTCHA widget simply gives up with a fatal error[2]. Any new browser, browser variant, or browser-like tool cannot access any website that requires reCAPTCHA. Same for anyone obscuring their UserAgent or using an older browser for any reason. reCAPTCHA is de facto restriction against any new competition in the browser market.

[1] https://support.google.com/recaptcha/answer/6223828?hl=en

[2] https://user-images.githubusercontent.com/20207154/29577170-...

GoblinSlayer6• 6 years ago

UserAgent variability is a bug anyway. Apple was right when tried to freeze it. It shouldn't affect browser market, because browser is a user-facing tool, UserAgent isn't.

known• 6 years ago

ReCAPTCHA has forced me to use https://www.qwant.com/ as my default search engine in tor browser

protoduction3• 6 years ago

I built FriendlyCaptcha [1], it's a proof of work based alternative to reCaptcha that is accessible.

While it's not the perfect captcha either (which I think is impossible), it makes a better tradeoff in terms of UX, price and privacy.

[1] https://friendlycaptcha.com

bo1024• 6 years ago

I think this is a great solution! I have been thinking over the problems with captchas and also came to the conclusion that a proof-of-work puzzle is a fair, private, and hopefully-effective solution.

You can look around for "useful" work, similar to how recaptcha was originally about transcription. If you can find some problems of the right difficulty that people want solved (e.g. I dunno, protein folding or something), then the electricity isn't wasted and you might even be able to sell the solutions.

gruez3• 6 years ago

AFAIK there used to be a service that did exactly that - it used cpu cycles to mine cryptocurrencies.

gruez3• 6 years ago

The problem with other CAPTCHAs
It's broken
Tasks that are easy for all humans but difficult for computers may no longer exist.
Using machine learning or even browser plugins one can solve ReCAPTCHA in under a second. There are even CAPTCHA solving companies that offer thousands of solves for $1.

This is probably a bad argument when your proof of work captcha can be solved for much cheaper. Your site says "Solving it will take a few seconds on a desktop computer", which I'll interpret as 5 seconds. The spot price for a c5a.2xlarge instance (8 thread zen2 CPU) is 21.6 cents/hr. That works out to 0.03 cents per solve, an order of magnitude less than the 0.1 cents per solve for commercial recaptcha solving services. It probably gets even cheaper if you get your compute through non-cloud providers, or through GPUs.

snazz• 6 years ago

The FriendlyCaptcha demo takes less than a second on my machine (i5-7400, RX 560). A c5a.2xlarge is far more powerful.

protoduction3• 6 years ago

You're right that it won't stop determined attackers, there was some prior discussion here [1]. The idea is that it's good enough - while not punishing your users as much.

The difficulty can be scaled in a predictable way - it's similar to rate limiting but less all or nothing. We're about to release automatic difficulty scaling per IP, so if many CAPTCHAs are requested/submitted from a single IP the difficulty increases exponentially. Also being able to set the initial difficulty for your usecase and audience is something that should help.

Aside from that there's some more measures on the roadmap: using lists of known-to-be-datacenter IPs, and reputation lists such as [2], as hints to increase the difficulty.

But you're right - it will still be affordable to attack any CAPTCHA, FriendlyCaptcha is no exception. Proof of work approaches have downsides too.

The main ideas behind FriendlyCaptcha vs ReCAPTCHA:

* The user experience is superior. It can happen in the background while the user is doing something else. There is no labeling task.

* We don't have any incentive to collect user data or track users (GDPR compliant, no tracking cookies etc)

* It's as easy to add as ReCAPTCHA to your website. The API is a near copy of ReCAPTCHA's API. You can host the JS code yourself, or even bundle it. With recaptcha it must be third party.

* It works in any browser less than 8 years old (IE>=11), although of course it's much slower in old browsers that don't support WebAssembly.

* It doesn't have inherent accessibility problems (poor eyesight/hearing doesn't matter).

* Open source at its core [3], the SaaS wrapper is not open source.

[1] https://news.ycombinator.com/item?id=24921288 [2]: https://www.stopforumspam.com/ [3]: https://github.com/friendlycaptcha/

saddlerustle2• 6 years ago

It gets worse for a determined attacker. The "difficulty" on that page seems to be 136, corresponding to ~131000 hashes of blake2b if I'm understanding the documentation right [1]

There are ASICs for crunching blake2b designed for mining siacoin. One ~$2000 card [2] can do ~4 trillion hashes, or 30 million captcha solves, per second

[1] https://github.com/FriendlyCaptcha/friendly-pow

[2] https://www.miningstack.com/products/dragonmint-b52

0df8dkdf3• 6 years ago

what about hCaptcha https://www.hcaptcha.com?

0df8dkdf3• 6 years ago

but yeah. rCaptcha is horrible. And you know google is making money of you when you use it, and some times it takes 10 - 15 minutes to finish one thing. I hope the site owner are getting paid for my work, not just google.

dmix• 6 years ago

The idea that 1) Google is using it to train modelling stuff (I still think is true?:) for free AND 2) on top of that is also charging small startups money for it AND 3) it's annoying as hell as a customer just makes me angerier.

A trifecta of doing evil from Google (well at least two out of three, 1 should cover for 2). And I say that as a relatively pro-capitalist with no problem charging money for services but I'm also pro-privacy and don't like training their AI models for free with them charging the hosts on top of it.

tyingq• 6 years ago

Curious how spam bots react to Friendly Captcha. If it's just gobbling a bit of cpu time, I assume they mostly don't notice.

0df8dkdf3• 6 years ago

interesting project. However, couldn't what they are doing be simply solved by applying bcrypt or scrypt in JS?

whywhywhywhy• 6 years ago

For a system designed to weed out bots, whomever lead the redesign of reCAPTCHA to the crossing and traffic light identification unpaid labour system had nothing but utter contempt for humans and their time.

I actually can't think of another user interaction I've had with a computer that had less respect for me as a person.

swiley• 6 years ago

Having to use recaptcha just to download minecraft has to be one of the biggest things that has completely pissed me off about it being sold to Microsoft.

modzu• 6 years ago

false dichotomy!!!

_qcti• 6 years ago

I'm happy to hear Google is charging for ReCAPTCHA. I hope they make it completely unaffordable and get rid of any free tier.

Any disincentive for sites to force users to train AI for Google is a good thing.

Every time I run into it, it makes me hate the site I'm on. Google punishes my crimes of Firefox use and not being logged into Google by giving challenge after challenge - along with those infuriating "slow fade in" images to take bigger bites out of my day.

The world would be better off without ReCAPTCHA.

mtmail• 6 years ago

And it also opens the chance for innovative (or not) competition. Hard to compete with a free Google service.

mdifrgechd• 6 years ago

For most low value sites e.g. inc.com type random news that ask me to sign up to continue, I just dont use them, because the value they provide is lower than how I value creating an account.

The same is true for recaptcha, I usually just don't use a site if they make me use it. I have stopped donating to charities because they use recaptcha and would never buy from an online store that uses it. The same as I would never go to a bar where you are searched on the way in, or buy a pizza from a place with a central call center that makes me wait to make an order. If a business wants to treat me like shit, I just wont use it.

luord• 6 years ago

This reminds me that I've got to remove recaptcha from the contact form in my website.

I rarely get contacted so I wouldn't have to pay any time soon, but I want to remove all third party services from my site anyway and I have to find a way to prevent spam that would nevertheless be less annoying for someone who would actually want to contact me.

ReCAPTCHA and the Anonymous Experience

Related Stories