Google's reCAPTCHA Turns 'Invisible,' Will Separate Bots From People Without Challenges (arstechnica.com)

Google is making CAPTCHAs invisible using "a combination of machine learning and advanced risk analysis that adapts to new and emerging threats." Ars Technica reports: The old reCAPTCHA system was pretty easy -- just a simple "I'm not a robot" checkbox would get people through your sign-up page. The new version is even simpler, and it doesn't use a challenge or checkbox. It works invisibly in the background, somehow, to identify bots from humans. Google doesn't go into much detail on how it works, only saying that the system uses "a combination of machine learning and advanced risk analysis that adapts to new and emerging threats." More detailed information on how the system works would probably also help bot-makers crack it, so don't expect details to pop up any time soon. When sites switch over to the invisible CAPTCHA system, most users won't see CAPTCHAs at all, not even the "I'm not a robot" checkbox. If you are flagged as "suspicious" by the system, then it will display the usual challenges.

Comments

"suspicious" by the system

[turkeydance]

the ceiling is the roof

Re: "suspicious" by the system

[Spazmania]

yeah... display the usual challenges and then reject correct answers two or three times in a row before accepting a correct one. And by the way Linux = suspicious. It's a POS.

Re: "suspicious" by the system

[Spazmania]

Just reporting my experience with the product, so if you're the guy who wrote it then right back at you.

Re: "suspicious" by the system

[Anonymous Brave Guy]

You got through after only two or three times? That's a huge improvement on the old system then. I have literally been locked out of making financial payments and even being able to access some government systems because of captcha madness, giving up trying after several minutes of not being able to get one right. The picture-based ones, where you have to click every square with a tree or road sign or something, are the worst. So much time wasted.

Re: "suspicious" by the system

[Spazmania]

This. So much this.

Re: "suspicious" by the system

[PixetaledPikachu]

"The desk is just a desk"
Twice's Sana

Up until it tags the handicapped as bots

[Anonymous Coward]

I believe there are accessibility laws most parts of the world ....

Re:Up until it tags the handicapped as bots

[gnick]

If they're compliant now, it shouldn't be a problem. If you're suspicious, they just kick you back to the system they were using before. If they're not compliant now, this may be part of their accessibility solution.

Eh!

[Anonymous Coward]

"You're either a bot or you're running NoScript!"

Re:Eh!

[Anonymous Coward]

As far as I can tell, if you are running noscript you cannot get through these things at all.

Google wants to know what you are signing up for. If you won't tell it, it won't let you pass.

Re:Eh!

[infolation]

But google's CAPTCHAs are not only used for signups. If you search google using the TOR browser you're also presented with CAPTCHAs for every search. Which gets quite annoying.

(Google say they don't target TOR but experience says otherwise.)

Re:Eh!

[toddestan]

Browsing the internet through TOR is downright painful now thanks to all of the CAPTCHA garbage. Besides Google, Cloudfare is another major offender. Though at least as far as search goes, you can use DuckDuckGo.

Don't know how I feel about this

[Anonymous Coward]

For one thing, I never get the checkbox from my residential IP connection. But once I switch to my vpn on my own assigned /24 I get recaptcha's all day. This isn't new, I've been browsing from the same /24 for the last 5 years. Yet for some reason, Google things when I'm coming from there I'm a threat. I know I'm a minority that's going to be drowned out because who cares about the few users caught in the net. It's just an annoying feature that kills any competition for my business. Any remote sites using a squid cache connection get the reCaptcha flag. They switch to a different provider or move the cache server to GCE then everything magically works.

What's a BOFH to do.

Re:Don't know how I feel about this

[jaymemaurice]

Did you ever make sure that /24 doesn't have an open proxy, DNS or NTP server running on it? Did you make sure that there are DNS reverse/PTR records? When using squid did you make sure it is locked down? Did you ever try removing the x-forwarded-for headers or adding them?

Lots of work to do

[arth1]

For some reason, I get flagged for captchas all the time, but no matter how vigilant I am at choosing storefronts, mountains, street signs and house numbers, I have to go through at least a dozen pages of them before it believes me.
I wonder whether being behind load balanced proxy servers might have anything to do with it.
Anyone else having similar problems?

Re:Lots of work to do

[MatthiasF]

Yep. I constantly need to do them because I have my browser locked down to stop tracking.

I have a feeling most of Google's new "invisible" method has more to do with the fact they are tracking you as a unique user and following your path to the page. If it looks legit, they don't challenge.

But if you're one of the many of us who actively fight being tracked, we're going to be relegated to second-hand internet user thanks to Google's monopoly.

Re:Lots of work to do

[sinij]

Yes, if you lock down your browser you get them a lot. Basically, for Google, if they know where you live and your cat's name - then you don't get shown captchas.

Re:Lots of work to do

[hcs_$reboot]

Yes, and this is because you do, on Google behalf, some picture recognition as well, in order either to confirm some other person recognition "work", or to be the initiator. The percentage distribution between "recognition work" and "actual recaptcha" is not clear, but the more you have to recognize, the more you work for Google at no charge.

Re:Lots of work to do

[93 Escort Wagon]

Yep. I constantly need to do them because I have my browser locked down to stop tracking.

I have to do them all the time, and I'm not even that aggressive regarding blocking tracking. I mostly just clear things out after the fact, every few days - I'm not even running noscript (but I am running an ad blocker, and don't use Google for much).
I'll be curious to see how many of us this disenfranchises...

Re:Lots of work to do

[MatthiasF]

That's a really nice attempt at an apologist's view of Google's monopoly, except credit card companies can only track WHERE you spend money, not the specifics of what you actually bought. Whereas Google literally knows what sites you are browsing, what pages on that site you are browsing, even what parts of the page you read through it's AdSense product and then takes all of that to determine what parts of the Internet it wants to show you through it's Search product. Then there's the email product, and the social media, etc. etc.

No other entity has ever been able to get that much information in that detail on a "customer" (quotes intentional, since let's face it you're the product to Google, not the customer).

The fact that Google is pushing an internet standard that would require accepting the use of their invasive business practices to maintain a normal experience on the Internet is pretty abusive of their monopoly in my opinion.

Re:Lots of work to do

[arth1]

This isn't difficult, and let's be honest, it's also not a big deal (these reCaptchas take like 30 seconds maybe every couple of days).

30 seconds? More like 10 minutes. Once I've selected all the pictures, I get a new set. And a new set. And a new set. It doesn't matter that I answer them all correctly - I have to go through a lot of sets before finally being let through.

Re:Lots of work to do

[Anonymous Coward]

Yep, same problems for me, and some images are so grainy it's not possible to make out anything on them.
Since I normally don't have 10 minutes to spare clicking images when I want to do something, I just put that site to my blacklist and find an alternative instead.

Re:Lots of work to do

[AmiMoJo]

The invisible ones seem to be using things like mouse movements and other measurements of human interaction, which can be difficult to fake. They must have some way to prevent replay attacks. Not sure how they will handle people disabling Javascript, probably fall back to the old HTML5 method.

I find what triggers to endless captcha loops is:

- Privacy settings in your browser, especially Privacy Badger and uBlock
- Blocking Flash/WebGL/Canvas fingerprinting
- Disabling Javascript
- Using a VPN
- Especially using TOR

Re:Lots of work to do

[jenningsthecat]

I find what triggers to endless captcha loops is:

- Privacy settings in your browser, especially Privacy Badger and uBlock - Blocking Flash/WebGL/Canvas fingerprinting - Disabling Javascript - Using a VPN - Especially using TOR

I find what triggers endless captcha loops is the regression of Google's search capability, such that I have to repeat the same basic query multiple times with different minor variations in attempts to bypass Google's belief that it knows what I want better than I do. At least once a week, and often several times per day, I get stuck doing Google captchas. I guess it doesn't help that I have a wide range of interests and the type and range of query I make can change dramatically in a short period of time.

Google really is gearing its results to the lowest common denominator among Internet users. It never used to be that way. If I had the opportunity to pay for the quality of search capability that Google provided a decade ago I would do so. But I guess they're not interested in receiving money from us, AKA "their products". They're only interested in monetizing us by selling our data, not in providing quality data to us.

Re:Lots of work to do

[TheRaven64]

"Oh, but then google.com doesn't work, and I can't watch funny cat videos on YouTube!" Well... what did you expect?

That's absolutely fine. The problem is that it's not just Google, it's every third-party site that uses reCAPTCHA stops working properly as well if you don't permit Google to track you all across the web.

Re:Lots of work to do

[TheRaven64]

- Blocking Flash/WebGL/Canvas fingerprinting

I'd wondered why a load of sites seem to be asking for WebGL access now when nothing seems to need it - using it for fingerprinting makes sense. I disable it by default, because I've worked on GPU drivers and there's no way in hell I'd allow untrusted code into them, even if it's been through a WebGL verifier.

Re: Lots of work to do

[BlytheBowman]

and I can't watch funny cat videos on YouTube!#### Anybody that obsessed with cats needs to check into a mental institution. Seriously Today's die-hard "lolcats" fans - Tomorrow's animal hoarders

Re:Lots of work to do

[Wrath0fb0b]

But if you're one of the many of us who actively fight being tracked, we're going to be relegated to second-hand internet user thanks to Google's monopoly.

Whatever happened to you happened because the owner of the site chose to use ReCaptcha as a tool to prevent bots. You have no right to insist that a particular website cater a particular user experience to you -- if you don't like it, you can go elsewhere.

And what monopoly are we talking about here? There's certainly no monopoly on plugins to detect bots, there are dozens. Google might (probably even) have a monopoly on search, but that's hardly relevant to the captcha story. . .

Re: Lots of work to do

[BlytheBowman]

Must suck for those who have any kind of eye or visual perception problems. Those capchas that twist and contort the letters and mash them close together must really be fun for dyslexics.

Re: Lots of work to do

[BlytheBowman]

I never get those on my tablet or phone, but that is because they are generally gimped compared to a desktop or laptop computer (even though there is no real technical reason they can't do what a "proper" computer can , the marketeers demanded these hobbles). If you are using a "proper" desktop computer, Google must ass-u-me the user is some Ev1l SpAm 73rr0r ha>0r and must prove they are innocent. (Yes, I know what our forefathers said, but right now they are bound and gagged and dressed in a silly clown suit, proverbaly speaking. Not even the peasants take seriously or care what they had to say anymore. Citizen Rights? That is so last millenium!) If you are using a browser where you can change the User-Agent string that it sends out to match an Android browser, you may be able to get around this, but be prepared to to be bombarded with "This stupid web site works best with our app!" messages, or be locked out entirely from some sites by this until you change the string back.

Re:Lots of work to do

[tepples]

I've worked on GPU drivers and there's no way in hell I'd allow untrusted code into them, even if it's been through a WebGL verifier.

What should reach more users: an application developed for WebGL or an application developed for, say, OpenGL on a Mac?

Re:Lots of work to do

[Anonymous Brave Guy]

I haven't used much from Google in years, personally. I'll still use Google search if my first choices don't get good results, but usually they do fine. I watch videos on YouTube sometimes. It's not as if anyone actually has to use Google services routinely if they don't want to be subject to Google hassles.

We're all fine unless other admins start plastering Google-hosted junk all over their own sites. Oh, wait...

Re:Lots of work to do

[TheRaven64]

The web-based malware will be a lot easier to deploy, if that's your question.

Re:Lots of work to do

[Ol Olsoc]

If you don't want somebody knowing what you bought, you absolutely have to use cash.

That's gone by the wayside. For some reason I had to buy something around a hundred dollars or so with cash. I had to show them ID and give a phone number.

I suspect a lot of Slashdotters are going to have to sell everything, and move to a compound in remote Idaho, only barter, tear up their SS card, and go back to subsistence living.

I wonder if the 1840's were really that much better than today.

Re:Lots of work to do

[tepples]

Let me rephrase:

A video game developer might consider targeting WebGL in order to avoid having to develop the game five times, once each for Windows, macOS, GNU/Linux, iOS, and Android, or to avoid the editorial censorship imposed by the sole app store of one or more of said platforms. If you were developing a video game, would you develop it five times in such a manner, or would you instead limit supported operating systems and forgo revenue from users of others?

Re:Lots of work to do

[FlaSheridn]

http://www.bfi.org.uk/are-you-...

Re:Lots of work to do

[dryeo]

Google doesn't have a monopoly, there's competition like Facebook and MS in the tracking space, Bing in the search engine space and a few ad networks. Soon your ISP will also be competing in gathering your info and selling it as well (yay consumer freedom) and it is harder to block your ISP then just adding a few entries to your hosts file and running no-script. Your ISP also has a lot more power then Google in controlling your internet use

Re:Lots of work to do

[cant_get_a_good_nick]

I always say --

I really do hope there's an evil Phase 2 to Google, possibly enslaving us and forcing us to use Google Wave, Buzz, and Knol. Because if they're tracking me across every web page, every place I go, listen to everything I say, just to sell me socks, I'd be disappointed.

Re:Lots of work to do

[mrchaotica]

I'd develop it in SDL + OpenGL.

Re:Lots of work to do

[tepples]

And then compile the game made in SDL and OpenGL for which of the five platforms that I mentioned above (Windows, macOS, GNU/Linux, iOS, or Android)? Because I doubt that these platforms are binary compatible, unlike web browsers running a web application.

Re:Lots of work to do

[mrchaotica]

And then compile the game made in SDL and OpenGL for which of the five platforms?

Um... all of them, as you normally do? I'm confused because you ask that as if it's some kind of problem...

Re:Lots of work to do

[MatthiasF]

You just linked a service that is essentially only used for huge companies and government entities. Even on that very same page is an explanation that Level 1, the level for the majority of credit card purchases via the average consumer, only passes minimum data like I stated. Level 2 is the old Level 3, where it offers sales tax and a unique customer code along with what Level 1 offers to help track the purchases in the card holder's accounting or ERP systems.

Level 3 requires an entire infrastructure of software on both sides, the credit card owner and the merchant, for it to work. I doubt many consumer-based merchants have Level 3 support, nor would any amount of fee reduction pay for the expense of it (and I would doubt many merchant merchants would survive had they agreed to doing this). This level of information is only used for large corporations buying from wholesalers and such so they can track the inventory they are purchasing from moment of purchase.

But nice try Googling something to feed your paranoia.

Re:Lots of work to do

[tepples]

And then compile the game made in SDL and OpenGL for which of the five platforms?

Um... all of them, as you normally do?

Not everybody "normally do[es]", for two reasons.

First, an individual developer graduating from hobby projects to a first revenue-generating project is unlikely to have the financial resources right off the bat to purchase five different devices for which to build and test: a Mac, a Windows 10 PC, a GNU/Linux PC, an iPhone or iPad, and an Android device. He would have to make a version for each platform and use the revenue from users of each platform to fund a port to the next platform. But with web technologies, it's possible to hit multiple operating systems with one testing effort, such as all three major PC operating systems plus Android. In addition, someone who habitually uses Chrome and Firefox and refers to Can I Use is likely to be able to make something that's at least partially usable in Edge and Safari and can fix reported issues on demand. In addition, all users of Edge or Safari for macOS are eligible to install Chrome or Firefox and use it to run a particular web application until the application's support for Edge or Safari is more thorough.

Second, with WebGL, if you publish the game once, all five platforms receive it simultaneously. There is no mandatory app review process to delay it by two weeks or reject it, as there is with native apps for iOS.

Re:Lots of work to do

[mrchaotica]

First, an individual developer graduating from hobby projects to a first revenue-generating project is unlikely to have the financial resources right off the bat to purchase five different devices for which to build and test: a Mac, a Windows 10 PC, a GNU/Linux PC, an iPhone or iPad, and an Android device.

LOLWUT?

There are only two possibilities: either the programmer in question is a hobbyist, or a pro. If the former, then Virtualbox (or whatever other emulator/virtualization system is applicable) would be fine. If the latter, then two phones and a Mac Mini is affordable.

Besides, even writing platform-specific code from scratch is less complicated and time-consuming than you'd think.

Re: Lots of work to do

[BlytheBowman]

Sucks when you are one of the few

Re: Lots of work to do

[BlytheBowman]

Wow, I just had a flashback to all the stink that arose here when it was revealed that the Pentium 3 cpus would have a unique numerical id Damn, so quaint in this age of locked and signed boot loaders, malware from illigitimate and "legitimate" companies*cough*Sony*cough*, all the major commercial computer and phone operating systems constantly phoning home with shitloads of user info, games with DRM that require an always on internet connection just to load, and other such shit to remind us that we are fast backsliding into Feudal times.

Re:Lots of work to do

[tepples]

There are only two possibilities: either the programmer in question is a hobbyist, or a pro.

My question was about the transition from the first of these "two possibilities" to the second. But first, let me make sure we agree on definitions. To me, a "professional" means one who has been paid for his work in a particular field. Am I right? Or are you instead defining it as one who seeks to be paid for such?

I thought one's project to become a professional had to be done with hobbyist tools in order to afford professional tools for the next project. The only ways I can see around this are A. to earn money for the required tools in a day job in a different industry, or B. to release hobby projects to establish one's reputation and then crowdfund the tools needed for a simultaneous 5-platform release of one's first professional project. Which one is more practical?

If the former, then Virtualbox (or whatever other emulator/virtualization system is applicable) would be fine.

I thought it was copyright infringement to run macOS in "VirtualBox (or whatever other emulator/virtualization system is applicable)" on anything but a Mac.

If the latter, then two phones and a Mac Mini is affordable.

Do you consider it a desirable state of affairs to give Apple a monopoly over computers used by developers? If so, why is this an exception to the inefficiency of monopoly?

Re:Lots of work to do

[mrchaotica]

I thought one's project to become a professional had to be done with hobbyist tools in order to afford professional tools for the next project. The only ways I can see around this are A. to earn money for the required tools in a day job in a different industry, or B. to release hobby projects to establish one's reputation and then crowdfund the tools needed for a simultaneous 5-platform release of one's first professional project. Which one is more practical?

C. Become a professional and save up money by working at an established company before striking out on your own, D. get venture capital and/or a small business loan, E. go ahead and release on one platform first to get money for proper testing on the others, although that's not ideal), etc.

I thought it was copyright infringement to run macOS in "VirtualBox (or whatever other emulator/virtualization system is applicable)" on anything but a Mac.

You run Linux and Mac VMs using a Mac OS host. Obviously.

Do you consider it a desirable state of affairs to give Apple a monopoly over computers used by developers?

No, which is why I'd just release on Windows/Linux/Android and fuck Apple. You're the one who predicated this sequence of strawman arguments on wanting to release on Mac and iOS.

Regardless of all this, the fact remains that writing native code (even if it takes multiple times and testing everywhere) is infinitely better than balancing your game on the gigantic Jenga-tower of excessive abstractions and security holes that is Javascript/WebGL!

Furthermore, WTF is wrong with you? I've read your posts on Slashdot for many years now, and you're not usually this trollish and stupidly argumentative. Are you ill, or did somebody else take over your account or something?

Re:Lots of work to do

[mrchaotica]

"Linux and Windows VMs using a Mac OS host," I meant.

Re:Lots of work to do

[tepples]

You run Linux and Mac^W Windows VMs using a Mac OS host. Obviously.

And thus still need to buy the Mac mini to run the macOS host, making the "hobbyist" and "pro" loadouts the same.

No, which is why I'd just release on Windows/Linux/Android and fuck Apple.

At this point, I'm inclined to agree.

Google knows who you are already

[Anonymous Coward]

Translation: Google have collected enough data of most people's browsing habit from google.com + googleanalytics.com + googleadsense, no need to show you a captcha when they know who you are already.

Re:Google knows who you are already

[sinij]

Speak for yourself. Insofar as Google knows, I am a dog.

Re:Google knows who you are already

[Black Parrot]

Speak for yourself. Insofar as Google knows, I am a dog.

No, on the internet nobody knows that.

Re:Google knows who you are already

[Blig]

Speak for yourself. Insofar as Google knows, I am a dog.

Incoming dog food and related products advertising when you visit Google now in 5... 4... 3... 2... 1 ;-)

Given that Google not infrequently flags me...

[gweilo8888]

Given that Google not infrequently flags my web searches as being "suspicious", you'll forgive me if I expect this to work rather poorly in practice. I won't be holding my breath for the pipe dream of seeing captcha images less frequently...

Re:Given that Google not infrequently flags me...

[Anonymous Coward]

If you do stuff like make a succession of similar searches, but with slightly different word orders or adding one or two different words, and then go deep into the returned page cache (past page 10), then Google's servers might get suspicious and throw a captcha box at you. And they won't be nice about it either - they'll say "Prove you're not a robot."

Re:Given that Google not infrequently flags me...

[ayesnymous]

Google always thinks power users (people who use quotes around phrases, or who use the site:domain.com filter, or who are fast typers able to submit more than 1 search every 5 seconds) are suspicious.

Re:Given that Google not infrequently flags me...

[toddestan]

I don't get why anyone would put with a search engine that throws CAPTCHAs at you when you try to use it. Given how lousy Google's search results are nowadays, it seems pretty easy to make the switch to someone else. I've never seen a CAPTCHA using DuckDuckGo, but I imagine even Bing would be an improvement. And if for some reason you like Google's results, there's always Startpage.

That's nothing...

[bistromath007]

If they were really smart, they'd just give up so they don't have to dump effort into the arms race anymore and reCAPTCHA would just secretly be a cryptocurrency mining operation.

reCAPTCHA is simply another tracker

[Anonymous Coward]

reCAPTCHA is triggered if you take basic precaution when browsing the web, e.g. blocking unnecessary scripts, cookies, trackers, beacons, and of course ads
If you do, reCAPTCHA will force you to complete a broken AI-training job, collect your behavioral data, and monetize your labor.
It's purpose: to force you to become a PRODUCT of Google, the all-grabbing data company.

And now it's even worse.

Do not endorse reCAPTCHA. Don't put it on your website.

Google Checkmates Antiphorm

[retroworks]

This has been a war over user rights to "camouflage". Google and other ads-funded corporations have feared the "false positive", the background-running random search engine. The recent "are you human" captchas come when I'm not even running an anti-phorm, so I guess I have to prove I'm human because my searches appear to be non-sequetors to Google (though they are not, to me). x2010 http://retroworks.blogspot.com...

There goes anonymous browsing

[cfalcon]

The current "identify some bullshit" captchas can be done without javascript. This seems unlikely to have that failsafe. It will be a wad of purposefully hard to reverse engineer javascript, probably with some timing crap to make it hard to do anything with, and that will be that. It will of course ultimately end up generating telemetry.

I sound pessimistic, but this has been the direction we've been heading for some time.

Re:There goes anonymous browsing

[Anonymous Coward]

Timing? It could be worse.

Mouse movement cadence. Path eigenmodes and entropy. OS and browser fingerprinting. Render fingerprinting. Anti-fingerprinting fingerprinting. Cross-correlation with thousands of other features Google already knows about.

The human as an autonomous and free agent is over. You're a product.

Re:There goes anonymous browsing

[jbn-o]

Perhaps this is the latest PR initiative to try to get the public to defend "invisible" spying. Google makes considerable money and maintains relationships with powerful organizations on the basis of spying. Spying is very much a part of Google's business. Google could probably use a way to get more people to (even indirectly) defend Javascript-based spying by turning the public into ignorant supporters who say things like 'We *need* this invisible reCAPTCHA' when we could actually choose to do without it.

Without knowing what the code does (and keeping up with all the changes, changes which can happen at any time) we can't confirm this code only does the job Google claims it does.

Re:There goes anonymous browsing

[Blig]

I pictured a captcha image challenge where it gives you assorted piles of crap and you try to guess which ones came from a bull.

So, would this type of captcha technically be a "crapcha"? ;-)

Re:There goes anonymous browsing

[strikethree]

If this requires javascript, then every site that uses it will lock me out.

I use noscript. I am willing to go without any information from anyone else, forever, as long as requiring a script to run is part of the deal.

Executing logic on MY computing device, is purely at my discretion. I am unsure why anyone else feels they have a right to require me to execute logic. Perhaps if they asked, I might agree, depending on the other details in the deal. If it is required up front, then they have my denial up front. There is no business to be had here.

Alternative checkbox

[Black Parrot]

"Yes, I am a robot, but I'm not going to take your job."

Re:Alternative checkbox

[lgw]

Read this yesterday and just now got the joke. So, LOL. Never change your sig - that show was awesome.

Useless

[corychristison]

reCAPTCHA is useless.

There are other very reliable ways of catching automated bots. They are stupid, and make many mistakes that are easy enough to catch even without Javascript.

The real issue is firms hiring people for less than a buck an hour to spam crap. It's impossible to stop without impeding real users... so where do you draw the line?

As it is reCAPTCHA gets in the way more than it should. You're probably better off without it.

Re:Useless

[Gavagai80]

Common spambots that submit contact forms are easy to catch. Advanced registration bots targeting major websites, not so easy.

The amount of paid human spam is minuscule compared to the automated kind, so it's much easier to handle manually.

Re:Useless

[arth1]

Yes you can. Simply turn away from the site that gives you the recaptcha.

That's not always so easy. I had to go through a Google captcha in order to request an RMA from a company.

Re:Useless

[corychristison]

Having been in web development for over 15 years, I can tell you there are some very reliable ways to catch any kind of form submission SPAM.

As stated, there is a point where the bots are not possible to catch, as they emulate exactly how people do it (or they are paid spammers).

You come to a point of diminishing returns, and start to irritate real users.

CAPTCHA's are a bandaid solution for lazy developers.

Re:reCAPTCHA sucks

[molarmass192]

I'm pretty sure you meant Hertzfeld, not Herzog in that SJ citation.

don't expect details to pop up any time soon

[gravewax]

"don't expect details to pop up any time soon", LOL anyone else smell the bullshit here. basically with a few days of this being available you will see published tear downs of it and proposals to work around it.

The inverse Turing Test

[goombah99]

So now we have an AI trying to decide who is the human, the inverse of the turing test. What it comes down to then is it easier to create an AI that can pass the Turing test or the inverse turing test. If it's easier for a bot to fool a bot then this AI strategy will meet it's match in another AI. On the other hand if it's easier to do the inverse turing test then this new strategy will work. I'm not really sure if it's obvious which test is harder.

Re: The inverse Turing Test

[Anonymous Coward]

Yeah its great. A non transparent way to make life to make life more difficult. What could possibly go wrong ?

Re:The inverse Turing Test

[modrzej]

Probably that's how it's done by Google. You just described the training stage of generative adversarial networks.

Re:The inverse Turing Test

[dj245]

So now we have an AI trying to decide who is the human, the inverse of the turing test. What it comes down to then is it easier to create an AI that can pass the Turing test or the inverse turing test. If it's easier for a bot to fool a bot then this AI strategy will meet it's match in another AI. On the other hand if it's easier to do the inverse turing test then this new strategy will work. I'm not really sure if it's obvious which test is harder.

Depends on how invasive you allow the inverse turing test to be. USB blood analyzers already exist, DNA analyzers that fit in your pocket may be built in my lifetime. (Obligatory Skynet reference.)

Wikileaks told us how.

[Anonymous Coward]

New captcha uses you computer, phone, tablet, or TV's microphone to listen for your breathing to see if you are human :-).

Re:Wikileaks told us how.

[Anonymous Coward]

You say in jest, but I give it five years.

Re:BS: I blow all that Joogle crap away!

[fisted]

Fuck you and your ads.

If it was just google it wouldn't be a problem

[Geeky]

Flagging you as a robot incorrectly would be less of an issue if it was just Google doing it.

Unfortunately, lots of other websites use the API. There are plenty of Wordpress plugins that add Google's recaptcha to comment forms and I've seen it elsewhere.

It could become a de-facto standard and at that point the issues - in particular for accessibility - become critical. If it's more likely to pop up if you're disabled and using things like screen readers then it's discriminatory.

If nothing else, it'll be something new to keep the EU busy with Google...

Make sure your proxies aren't open, firewall

[raymorris]

> I wonder whether being behind load balanced proxy servers might have anything to do with it.
Anyone else having similar problems?

Yes, proxies correlate well to bots. Not all attempts from proxies are bots, but most attempts from bots come through proxies. Open proxies especially. Open proxies are bad anyway, so make sure your proxies aren't open. If possible, use a firewall to limit access to your proxies by IP address.

Re:I am the walrus

[Anonymous Coward]

Don't you mean "goo goo ga joob"?

Windows Embedded POSReady

[tepples]

Windows is also a POS.

Re:Windows Embedded POSReady

[Spazmania]

Hah hah. The "it" referred to Recaptcha not Linux.

When a government requires solving reCAPTCHA

[tepples]

Whatever happened to you happened because the owner of the site chose to use ReCaptcha as a tool to prevent bots. You have no right to insist that a particular website cater a particular user experience to you -- if you don't like it, you can go elsewhere.

What you said applies when a private sector business in a competitive market requires solving a reCAPTCHA challenge or running other proprietary scripts as a condition of accessing a luxury. I don't find it so defensible when a private sector monopolist or even a government requires doing so as a condition of accessing a necessity, as the United States Copyright Office required last year.

Can't easily boycott your government

[tepples]

We can just boycott pages that require connections to Google in order to work properly.

Until your national government requires connection to Google in order to exercise the rights of a citizen, such as submitting comments on proposed regulations. It has happened recently; see the Free Software Foundation's 2016 letter to U.S. Copyright Office.

Re:/.ers disagree Fisted... apk

[fisted]

Doesn't matter that the mentioned people allegedly fell for your ads. It doesn't stop the irony of you advertising in a more obnoxious way than the ads your crapware is alledgedly getting rid of. You are a special sort of retarded to not realize that.

Re:Fisted? STFU fake name "ne'er-do-well"

[fisted]

I generally don't care about what advertisers think or say about me, so you might as well save yourself the trouble -- I'm not even reading your ads.

Re:BS FIsted - why else reply? You care

[fisted]

I'm no advertiser

Then what are your posts on /., if not ads? Maybe you need a little reality check?