Slashdot Mirror
Google Launches reCAPTCHA v3 That Detects Bad Traffic Without User Interaction (zdnet.com)
Google has pushed an update to its reCAPTCHA technology that the company has been offering since 2007 to fight off bots on the world wide web. From a report: reCAPTCHA v3, as the new version has been branded, is a complete overhaul of the reCAPTCHA technology that we know and... most of the time hate. The good news is that the new system does not require any user interaction anymore. Gone are the days of reCAPTCHA v1 when everyone was trying to decipher in garbled text, and gone are the days of v2 when everyone was getting annoyed at clicking on endless image streams of "store fronts," "roads," and "cars" for up to 2-3 minutes. Instead, reCAPTCHA v3 will use a secret new Google proprietary technology to learn a website's normal traffic and user behavior. Google says that by observing how regular users interact with the website and its sections, it would be able to detect abnormalities and detect bots or undesirable actions.
Please see Comment Subject
Whatever they are doing is fine with me, those image based Capthas are an absolute nightmare, trying to see if one pixel in an image is a sign or a car or whatever.
I think one time I cycled through picking objects something like 15 times! Absurd.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
This can't possibly work for me. /s
I find that about one of every 3 or 4 times that I click "Search" on Google after I've already scanned the first page of results it gives me without finding any promising leads, I will get a prompt like that which I have to click in order to proceed.
It's damn annoying to be perfectly honest.
File under 'M' for 'Manic ranting'
How long will it take before most sites have it instead of previous versions?
There's really no way around it... Eventually Chrome will take authentication into the browser, which of course is integration into the Google Service in the back end, and just use that to bypass.
If you're not signed into Chrome (thus signed into Google), you'll get captchas of varying degrees of annoyance until/unless Google no longer needs people to categorize visuals for its AI training, at which point Google will just make a login mandatory under the guise of identity assurance.
Hire a Linux system administrator, systems engineer,
function is_bot($IP_address, $unique_identity)
{
if (is_any_kind_of_privacy_such_as_Tor_exit_node_or_paid_VPN($IP_address))
return true;
if (is_person_disliked_by_us($unique_identity))
return true;
return false;
}
How much you want to bet you'll be locked out completely with no recourse?
reCAPTCHA v3 will use a secret new Google proprietary technology
OK. So if this is cross-browser I would have to assume this involves or fully relies on in-browser Javascript. In which case calling it "secret" is silly.
If it relies on servers (thus keeping the "secret") run by Google then why bother with it all? Why not just use OAUTH/OAUTH2 authentication against existing Google+ logins and then no need for a 'bot test?
I could not always prove that I was a human, that just makes my blood boil, and there is no where to complain!
... otherwise it appears that google blocks you from continuing. google must assume that all humans will allow google trackers on to their computers and bots won't.
Are you kidding me? I fucking prey that I get the store front one rather than enter street sign hell for 5 minutes.
ReCap v2 is one of the worst things to ever happen to the internet and I prey to the god of the Internets that the creator dies or horrible death.
What if the user is not "normal"?
If I understand right, the deal is that website developers now do the heavy lifting work of informing Google about every user and user action on their site, in meaningful profile-building ways, and in return Google will help them recognize bots.
Its similar to the deal they made with Google Analytics (inform Google of page visits and in return get traffic analysis) except the new captcha bargain will extract more visitor-profiling than was ever needed before.
They're data mining your session with the website to see if you're acting like that site's average user. If not, you're blocked. Meaning you'll be required to enable Google's tracking scripts on every website which uses this. Blocking those scripts mean no web content for you.
If you do something different, like open 10 tabs of the next ten articles you want to read... BLOCKED. Assuming most users read articles one at a time.
Basically this is the same tech anti-virus software uses to dynamically categorize running software when trying to figure out if it's a threat or not. Those features don't work too well, so expect this new system to not work as well either.
And for my final point, CAPTCHAs only block initial access to a site. This new system continually monitors your interaction with the site. Previously you could login and then archive a bunch of content. Now you'll be banned if you try to download all your topics/favs. I'd bet money someone with a disability is going to sue Google over this is as it'll probably block everyone using screen readers and other accessibility features. No keyboard-only browsers either. If you prefer addons and shortcuts to jump to the links you want, too bad. Either you use your mouse properly and look at the ads for the average amount of time, or Google will block you. Afterall, the average user isn't blocking ads, so if your mouse rolls over a pre-ad element then hits a post-ad element without entering the ad in between them then obviously you just engaged in an undesirable action. Banned.
This is a horrible service for the end-user. It'll get even worse in a couple years when they add in eye tracking as well.
I never know whether an image grid section that has one tiny edge/corner of the street sign or store front in it counts as a "street sign" or a "store front." I've tried it both ways, and I get it wrong every time. The textual CAPTCHAs were no better: as robots got better at solving them, the squiggly figures got more and more obscure, until AI was required to solve them.
Is reCAPTCH's new technique a spy system? I don't goddamn care. I just want user solving of CAPCHAs gone, using whatever technique they wish to devise.
Unless you play games or do something for a living that requires highly accurate mouse movement.
There are sooo many variables that go into the behviour of an end user vs bot that AI could never learn a profile of everyone. Hell my accuracy changes based on posture, alcohol comsumption, tiredness, etc. There's no way Google could know that.
Here's another rather silly example of why behaviour profiling is a bad idea - ever notice images refresh faster on mouse movement? Now erratically move your mouse as if you were impatient. What happens is Google thinks your human ONLY if you fit THEIR profile of a user, it doesn't take into consideration that you may infact be 14 hours into a shift, and tired of waiting for some damn capatach to refresh. Or a top level League player (thousands of clicks in short periods). It instead considers your eratic mouse to be a bot.
Here's another one - many open tabs to the same site. All Google sees are the requests, it has no context. What if the browser crashed or you move between networks? Certainly could be taken as a DoS attach considering all those tabs are refreshing. But the point is, you AREN'T attacking it nor are you a bot.
JFC where were you? You were gone the WHOLE DAY, on one of the busiest posting days of the year! Come on man, you KNEW it was an Apple Event day, what did you think would happen?
Were you drunk with your mom again or what?
Christ you can't even find reliable trolls these days. And while we are at it, what is up with vaguely non-committal threats. I've felt more threatened by unexpected updates to cereal boxes. Step up your game buddy or I'm getting a new troll who actually shows up when it matters and can use a calendar to set some real deadlines.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
captcha v3: spy and censorship
> observing how regular users interact
Last time I checked, I don't think I qualified to be a "regular" user.
If this is done wrong, it's going to be a nightmare for me. And a lot of other users who are not "regular" because they are simply handicapped, as opposed to being outliers in the geeky/techno direction.
Frequently when I do an "advanced" search, which includes the use of double quotes, or the site:blah.com limiter, or the numeric range operator 1..100, I get the message that they have detected suspicious activity from my IP address and they want to verify that I am human.
Even the current one does. If you take steps to protect your privacy, such as using a VPN or disabling Javascript or blocking access to canvas etc. it breaks and you have to solve it about 900 times to get past.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC