Slashdot Mirror
Google Launches reCAPTCHA v3 That Detects Bad Traffic Without User Interaction (zdnet.com)
Google has pushed an update to its reCAPTCHA technology that the company has been offering since 2007 to fight off bots on the world wide web. From a report: reCAPTCHA v3, as the new version has been branded, is a complete overhaul of the reCAPTCHA technology that we know and... most of the time hate. The good news is that the new system does not require any user interaction anymore. Gone are the days of reCAPTCHA v1 when everyone was trying to decipher in garbled text, and gone are the days of v2 when everyone was getting annoyed at clicking on endless image streams of "store fronts," "roads," and "cars" for up to 2-3 minutes. Instead, reCAPTCHA v3 will use a secret new Google proprietary technology to learn a website's normal traffic and user behavior. Google says that by observing how regular users interact with the website and its sections, it would be able to detect abnormalities and detect bots or undesirable actions.
Please see Comment Subject
Whatever they are doing is fine with me, those image based Capthas are an absolute nightmare, trying to see if one pixel in an image is a sign or a car or whatever.
I think one time I cycled through picking objects something like 15 times! Absurd.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
This can't possibly work for me. /s
I thought the point of v2 was to help train their computer vision systems.
I find that about one of every 3 or 4 times that I click "Search" on Google after I've already scanned the first page of results it gives me without finding any promising leads, I will get a prompt like that which I have to click in order to proceed.
It's damn annoying to be perfectly honest.
File under 'M' for 'Manic ranting'
How long will it take before most sites have it instead of previous versions?
reCaptcha is so negative an experience I will actively avoid using sites which employ it.
There's really no way around it... Eventually Chrome will take authentication into the browser, which of course is integration into the Google Service in the back end, and just use that to bypass.
If you're not signed into Chrome (thus signed into Google), you'll get captchas of varying degrees of annoyance until/unless Google no longer needs people to categorize visuals for its AI training, at which point Google will just make a login mandatory under the guise of identity assurance.
Hire a Linux system administrator, systems engineer,
function is_bot($IP_address, $unique_identity)
{
if (is_any_kind_of_privacy_such_as_Tor_exit_node_or_paid_VPN($IP_address))
return true;
if (is_person_disliked_by_us($unique_identity))
return true;
return false;
}
How much you want to bet you'll be locked out completely with no recourse?
reCAPTCHA v3 will use a secret new Google proprietary technology
OK. So if this is cross-browser I would have to assume this involves or fully relies on in-browser Javascript. In which case calling it "secret" is silly.
If it relies on servers (thus keeping the "secret") run by Google then why bother with it all? Why not just use OAUTH/OAUTH2 authentication against existing Google+ logins and then no need for a 'bot test?
I could not always prove that I was a human, that just makes my blood boil, and there is no where to complain!
Shut up
-msmash
... otherwise it appears that google blocks you from continuing. google must assume that all humans will allow google trackers on to their computers and bots won't.
Are you kidding me? I fucking prey that I get the store front one rather than enter street sign hell for 5 minutes.
ReCap v2 is one of the worst things to ever happen to the internet and I prey to the god of the Internets that the creator dies or horrible death.
What if the user is not "normal"?
You could probably game this too. Its sort of like the trouble they had with language bots--they were too perfect. They only started making advances once they allowed "umm... ahh... uhh" because humans do superfluous things. It's the same with humans using websites. They take extra time and move the mouse in superfluous ways. They scroll back and forth. A bot could easily take this into account.
Or if you do routine tasks, just use a macro recording tool of you doing something like posting an ad on a website that has reCaptcha and then just play the macro recording each time. It would look exactly identical as a human user unless you tried to speed it up or something.
If I understand right, the deal is that website developers now do the heavy lifting work of informing Google about every user and user action on their site, in meaningful profile-building ways, and in return Google will help them recognize bots.
Its similar to the deal they made with Google Analytics (inform Google of page visits and in return get traffic analysis) except the new captcha bargain will extract more visitor-profiling than was ever needed before.
They're data mining your session with the website to see if you're acting like that site's average user. If not, you're blocked. Meaning you'll be required to enable Google's tracking scripts on every website which uses this. Blocking those scripts mean no web content for you.
If you do something different, like open 10 tabs of the next ten articles you want to read... BLOCKED. Assuming most users read articles one at a time.
Basically this is the same tech anti-virus software uses to dynamically categorize running software when trying to figure out if it's a threat or not. Those features don't work too well, so expect this new system to not work as well either.
And for my final point, CAPTCHAs only block initial access to a site. This new system continually monitors your interaction with the site. Previously you could login and then archive a bunch of content. Now you'll be banned if you try to download all your topics/favs. I'd bet money someone with a disability is going to sue Google over this is as it'll probably block everyone using screen readers and other accessibility features. No keyboard-only browsers either. If you prefer addons and shortcuts to jump to the links you want, too bad. Either you use your mouse properly and look at the ads for the average amount of time, or Google will block you. Afterall, the average user isn't blocking ads, so if your mouse rolls over a pre-ad element then hits a post-ad element without entering the ad in between them then obviously you just engaged in an undesirable action. Banned.
This is a horrible service for the end-user. It'll get even worse in a couple years when they add in eye tracking as well.
function validateCaptcha3(context) {
var user = getUserProfileFromContext(context);
if (user.isConservative) return false;
return actualValidateCaptcha3(context);
}
I completely trust Google to not blacklist conservatives or anyone else they don't like.
What are the chances that it'll let you in if you block Google's tracking scripts and mask your IP?
Google does NOT like people to have privacy from Google.
checkbox should be good enough.
Now I'll fail to prove I'm a human faster than ever before!
Yeah, bullshit.
Google is saying if only they collected more information on users they could do this, the reality is it will just drive more ads and analytics.
Fuck that, Google is becoming less trustworthy every day. The last thing we need is them trying to track us even more.
I never know whether an image grid section that has one tiny edge/corner of the street sign or store front in it counts as a "street sign" or a "store front." I've tried it both ways, and I get it wrong every time. The textual CAPTCHAs were no better: as robots got better at solving them, the squiggly figures got more and more obscure, until AI was required to solve them.
Is reCAPTCH's new technique a spy system? I don't goddamn care. I just want user solving of CAPCHAs gone, using whatever technique they wish to devise.
JFC where were you? You were gone the WHOLE DAY, on one of the busiest posting days of the year! Come on man, you KNEW it was an Apple Event day, what did you think would happen?
Were you drunk with your mom again or what?
Christ you can't even find reliable trolls these days. And while we are at it, what is up with vaguely non-committal threats. I've felt more threatened by unexpected updates to cereal boxes. Step up your game buddy or I'm getting a new troll who actually shows up when it matters and can use a calendar to set some real deadlines.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
captcha v3: spy and censorship
> observing how regular users interact
Last time I checked, I don't think I qualified to be a "regular" user.
If this is done wrong, it's going to be a nightmare for me. And a lot of other users who are not "regular" because they are simply handicapped, as opposed to being outliers in the geeky/techno direction.
Frequently when I do an "advanced" search, which includes the use of double quotes, or the site:blah.com limiter, or the numeric range operator 1..100, I get the message that they have detected suspicious activity from my IP address and they want to verify that I am human.
Even the current one does. If you take steps to protect your privacy, such as using a VPN or disabling Javascript or blocking access to canvas etc. it breaks and you have to solve it about 900 times to get past.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
I'm VPN'ed and captcha got me off of google search. After the 200th time having to solve it I simply moved on to DDG, Bing, searx. You'd think they would figure me out since I have a static IP but nope. Logging into gmail with the same IP, one would think they make the connection since they track everything. Nope! Now you get captchas logging into gmail, even with the right password and the same IP for months.
So what's this v3 going to do? I disable mouse movement polling and all that other JS invasive stuff. Is it going to lock me out of the internet? Maybe my VPS ip was used for something bad before I got it. How long is this going to be a problem? If my personal information is the price of entry, I'm not paying it. I'm just stuck in 1996, i've certainly returned there in terms of search.
They can't use the same vpn because its my VPN. Maybe the same ISP but that's about where it ends.
"Please upgrade to a supported browser to get a reCAPTCHA challenge."
Yeah I use vpn and canvas blocker. Fuck you google.
What would stop somebody from just automation account creation? Unless that one is CAPTCHA-protected aswell.
Are you mentally disabled or something?
It means it's security through obscurity. And since it's practically guaranteed, that somebody will reverse-engineer ir leak it, it will fail quickly. Sorry, it never made sense to act like connections are not using automation, when coming from a freaking *computer*! Whether a human sits in front of them or not. That's why upvotes/likes/rating/etc can not and will not ever work. You must treat ALL connections like ones with infinite flooding abilities, and not discriminate by action rate or packet rate.
If recaptcha v3 whitelists Google IP addresses (and if they did this for recaptcha v2 & v1), would this be an insidious mechanism for google bots to run freely while other bots are "captured"?
Even if they don't baldfacedly whitelist Google IP address, they've certainly got the inside track on their own bot detection, so they know how to behave to avoid detection.
Is this something that Trump will tweet about early this morning?