Google's reCAPTCHA Turns 'Invisible,' Will Separate Bots From People Without Challenges (arstechnica.com)

Google is making CAPTCHAs invisible using "a combination of machine learning and advanced risk analysis that adapts to new and emerging threats." Ars Technica reports: The old reCAPTCHA system was pretty easy -- just a simple "I'm not a robot" checkbox would get people through your sign-up page. The new version is even simpler, and it doesn't use a challenge or checkbox. It works invisibly in the background, somehow, to identify bots from humans. Google doesn't go into much detail on how it works, only saying that the system uses "a combination of machine learning and advanced risk analysis that adapts to new and emerging threats." More detailed information on how the system works would probably also help bot-makers crack it, so don't expect details to pop up any time soon. When sites switch over to the invisible CAPTCHA system, most users won't see CAPTCHAs at all, not even the "I'm not a robot" checkbox. If you are flagged as "suspicious" by the system, then it will display the usual challenges.

Comments

Up until it tags the handicapped as bots

[Anonymous Coward]

I believe there are accessibility laws most parts of the world ....

Lots of work to do

[arth1]

For some reason, I get flagged for captchas all the time, but no matter how vigilant I am at choosing storefronts, mountains, street signs and house numbers, I have to go through at least a dozen pages of them before it believes me.
I wonder whether being behind load balanced proxy servers might have anything to do with it.
Anyone else having similar problems?

Re:Lots of work to do

[MatthiasF]

Yep. I constantly need to do them because I have my browser locked down to stop tracking.

I have a feeling most of Google's new "invisible" method has more to do with the fact they are tracking you as a unique user and following your path to the page. If it looks legit, they don't challenge.

But if you're one of the many of us who actively fight being tracked, we're going to be relegated to second-hand internet user thanks to Google's monopoly.

Re:Lots of work to do

[93 Escort Wagon]

Yep. I constantly need to do them because I have my browser locked down to stop tracking.

I have to do them all the time, and I'm not even that aggressive regarding blocking tracking. I mostly just clear things out after the fact, every few days - I'm not even running noscript (but I am running an ad blocker, and don't use Google for much).
I'll be curious to see how many of us this disenfranchises...

Re:Lots of work to do

[MatthiasF]

That's a really nice attempt at an apologist's view of Google's monopoly, except credit card companies can only track WHERE you spend money, not the specifics of what you actually bought. Whereas Google literally knows what sites you are browsing, what pages on that site you are browsing, even what parts of the page you read through it's AdSense product and then takes all of that to determine what parts of the Internet it wants to show you through it's Search product. Then there's the email product, and the social media, etc. etc.

No other entity has ever been able to get that much information in that detail on a "customer" (quotes intentional, since let's face it you're the product to Google, not the customer).

The fact that Google is pushing an internet standard that would require accepting the use of their invasive business practices to maintain a normal experience on the Internet is pretty abusive of their monopoly in my opinion.

Re:Lots of work to do

[AmiMoJo]

The invisible ones seem to be using things like mouse movements and other measurements of human interaction, which can be difficult to fake. They must have some way to prevent replay attacks. Not sure how they will handle people disabling Javascript, probably fall back to the old HTML5 method.

I find what triggers to endless captcha loops is:

- Privacy settings in your browser, especially Privacy Badger and uBlock
- Blocking Flash/WebGL/Canvas fingerprinting
- Disabling Javascript
- Using a VPN
- Especially using TOR

There goes anonymous browsing

[cfalcon]

The current "identify some bullshit" captchas can be done without javascript. This seems unlikely to have that failsafe. It will be a wad of purposefully hard to reverse engineer javascript, probably with some timing crap to make it hard to do anything with, and that will be that. It will of course ultimately end up generating telemetry.

I sound pessimistic, but this has been the direction we've been heading for some time.

Re:Google knows who you are already

[Black Parrot]

Speak for yourself. Insofar as Google knows, I am a dog.

No, on the internet nobody knows that.

The inverse Turing Test

[goombah99]

So now we have an AI trying to decide who is the human, the inverse of the turing test. What it comes down to then is it easier to create an AI that can pass the Turing test or the inverse turing test. If it's easier for a bot to fool a bot then this AI strategy will meet it's match in another AI. On the other hand if it's easier to do the inverse turing test then this new strategy will work. I'm not really sure if it's obvious which test is harder.