News for hackers. Stuff that matters.
Re:Recaptcha v3: new way to stop bots by _asummers on Monday October 29, 2018 @05:02PM (#18331419)
Hopefully having an ad blocker (uMatrix) doesn't cause it to flag the user like reCAPTCHA v2 does on every single site I go to. I have had to click way too many cars and street signs at this point.
Re:Recaptcha v3: new way to stop bots by jetpks on Monday October 29, 2018 @05:05PM (#18331457)
It's in Google's interest to make using an ad blocker as painful as possible.
Re:Recaptcha v3: new way to stop bots by candiodari on Monday October 29, 2018 @06:24PM (#18332140)
And yet comparing using one on Youtube with not using one will quickly drive the point home that Google is committed to letting you do that, and doesn't mind losing a few bucks in the process.
Re:Recaptcha v3: new way to stop bots by snazz on Monday October 29, 2018 @05:18PM (#18331596)
I’ll guess it’s going to be worse: without a checkbox to check (the whole “frictionless experience” thing), I don’t see a way for the site to give you a challenge to prove you’re human if the script hasn’t loaded. Correct me if I’m wrong, but I think this means that you simply can’t use the site that requires reCAPTCHA v3 with uMatrix (or uBlock hard mode) turned on.
Re:Recaptcha v3: new way to stop bots by merb on Monday October 29, 2018 @05:03PM (#18331429)
especially on firefox. currently I tested ublock on chrome and I was done after the first image. on firefox however with ublock I sometimes needed to try it 2-3 times until it worked.
Re:Recaptcha v3: new way to stop bots by ucaetano on Monday October 29, 2018 @05:05PM (#18331459)
Probably WAI.

What is the incentive for the site owner to provide a streamlined experience to an user that will consume resources but intentionally prevent monetization?

Not sure I agree with it, but it is obvious to expect that.

Re:Recaptcha v3: new way to stop bots by pwnna on Monday October 29, 2018 @05:12PM (#18331528)
Hold on. Who says the sites using CAPTCHA are also the sites that have an ad based monetization model? The other day I was logging into newegg to order something and I was presented with reCAPTCHA, for which I had to solve 4-5 challenges before letting through.

Looking through the documentations for reCAPTCHA v3, it wants to load a script from Google's servers. As an end user I do not want Google to track me across the web, on other people's property. Thus I want to block this HTTP call. This discussion is pretty orthogonal to "Ad"block, given that all sorts of places have a CAPTCHA implementation.

The cynical side of me thinks that Google's doing this such that a convenient side effect is crippling the user experience for those who uses content blockers/custom user agents to impede its adoption. Even without a cynical motive, this side effect seems to be conveniently ignored, which hurts users. Suppose another non-ad based company were to create such a system, I'd imagine they would want to explicitly work around the problems of blockers/tracking such that the website owner can get a more "true" metric of "suspicious" users as this would likely lead to more sales/engagement/whatever.

Re:Recaptcha v3: new way to stop bots by stefkors on Monday October 29, 2018 @06:56PM (#18332404)
Youtube doesnt seem to save settings like darkmode and languagues (defaulting to my localized option instead of my set language) with ad block from ghostery
Re:Recaptcha v3: new way to stop bots by ucaetano on Monday October 29, 2018 @05:19PM (#18331600)
> Who says the sites using CAPTCHA are also the sites that have an ad based monetization model?

> The other day I was logging into newegg to order something

Newegg uses ads.

> As an end user I do not want Google to track me across the web

Sure, and as a content provider, you might not want users who refuse to go through CAPTCHA. Nobody is forcing you to access the content.

> the side effect seems to be conveniently ignored, which hurts users.

It only hurts users that the content provider doesn't care about, because they don't generate any revenue.

Again, regardless of agreeing with this or not, it is clear that those are the economic incentives at play.

Re:Recaptcha v3: new way to stop bots by pwnna on Monday October 29, 2018 @05:31PM (#18331701)
>> The other day I was logging into newegg to order something

> Newegg uses ads.

That's not my point. We generally understand that newegg is there to sell you something. I was using it as a convenient example and perhaps a better one could be found. Just because they use ads does not invalidate my point there.

From the HN guidelines: "Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize."

> as a content provider, you might not want users who refuse to go through CAPTCHA. Nobody is forcing you to access the content.

Theoretically speaking, this is true. I can opt to simply close the page, turn off my computer, etc. However, it may not be practical to do this all the time. Some example maybe school/government institutions that you have to use deploys reCAPTCHA, or something like the CloudFlare pages that makes you fill out a reCAPTCHA for each website (which amounts to a large part of the internet).

> It only hurts users that the content provider doesn't care about, because they don't generate any revenue.

Disagreed. Perhaps in cases with ad based sites that is the case. If you're selling something and preventing me to buy from you, you're hurting users that may generate revenue. You could say that perhaps the benefit is outweighed by the cost, which maybe true from an abuse perspective. However, if everyone starts doing this, then my cynical view of Google will play out, which is the original point of my argument.

It's clear there's an economic incentive at play, otherwise Google won't develop this and people wouldn't deploy this. I just think that it's overly favored towards Google (and other ad based entities), as opposed to sites that do not rely on ads and the users.

Re:Recaptcha v3: new way to stop bots by ucaetano on Monday October 29, 2018 @05:53PM (#18331882)
> Theoretically speaking, this is true. I can opt to simply close the page, turn off my computer, etc. However, it may not be practical to do this all the time. Some example maybe school/government institutions that you have to use deploys reCAPTCHA, or something like the CloudFlare pages that makes you fill out a reCAPTCHA for each website (which amounts to a large part of the internet).

Sure, but what's your suggestion? Not using reCAPTCHA? Using one of those other crappy CAPTCHAs that impact far more users?

reCAPTCHA seems to only impact a small number of users with adblock (which is largely a personal choice). Seems like a fair trade-off from the content provider's perspective.

Again, what would be the economically-viable alternative?

Re:Recaptcha v3: new way to stop bots by pwnna on Monday October 29, 2018 @06:09PM (#18332025)
I don't have a solution to the problem and I concur it is a difficult problem to solve. A sibling comment has pointed towards https://www.gov.uk/service-manual/technology/using-captchas, which doesn't have much enlightenment either.

That said, I'm merely pointing out the problems I see in the current "solution":

1. It is a very robotic approach to design a system: we end up treating human beings like numbers and thereby marginalizing the minority. After inconveniencing these people, we turn around and tell them: "just be normal" or "no you shouldn't think like this". If that's the type of society we would like to build, I think I have nothing else to say.

2. ultimately externalizes the cost of abuse detection to ads, which makes it very tempting for everyone to adopt it as it is "free". Even if differently motivated entity solved this problem, I'm unsure if anyone would want to pay for it given how invisible the issues it causes are to the business (as you have pointed out). This may mean that what I pointed out in (1)_will occur everywhere and I don't even think there's really a way to stop it from getting to the possible dystopia I see.

Maybe I'm just over dramatizing this and I really hope that is the case.