News for hackers. Stuff that matters.
Re:There is no evil like reCAPTCHA by saagarjha on Monday August 05, 2019 @12:26PM (#20615421)
> Isn't the author talking about recaptcha v2?

Yes.

> My understanding of recaptcha v3 is, that it just gives you a score for how well google can track you and then leaves it up to the site operator to block users who aren't transparent enough.

Yeah, that's the one where you're supposed to put it on every page of your website so that Google can collect more information on your users. If they can't, they'll return a low score that you'll use to mark users as "bots".

> What I really hate about recaptcha v2 are those artificial delays before loading the next image (which it can happen to several times on a single card). And then in the end you frequently fail, despite answering everything correctly.

I think this is just what Google does when it thinks you're a "bot": i.e. they don't know who you are.

Re:There is no evil like reCAPTCHA by mevile on Monday August 05, 2019 @12:47PM (#20615633)
If you have strict privacy features enabled in firefox they block recaptcha and force you to do hard puzzles. It really sucks, but I'm not disabling the privacy features.
Re:There is no evil like reCAPTCHA by Wowfunhappy on Monday August 05, 2019 @12:32PM (#20615484)
> I think this is just what Google does when it thinks you're a "bot": i.e. they don't know who you are.

I do wonder why though. For a long time, I assumed it was a rate limiter, but then another HN commenter pointed out to me that time is more valuable to humans than bots. Bots can work on multiple captcha's in parallel.

Re:There is no evil like reCAPTCHA by GraemeL on Monday August 05, 2019 @12:37PM (#20615522)
My thoughts exactly. A bot doesn't care if it takes 2 seconds to fade the images out and in for another challenge round, but a human viewing it perceives it as a frustrating delay.

I've become accustomed to just closing any page that presents me with a v2 reCAPTCHA.

Re:There is no evil like reCAPTCHA by jedberg on Monday August 05, 2019 @12:39PM (#20615555)
Unfortunately one of those pages was the Equifax settlement. And other similar “important” sites. I never seem to come across them when it’s a service I could easily quit or avoid.
Re:There is no evil like reCAPTCHA by Wowfunhappy on Monday August 05, 2019 @01:31PM (#20616160)
This might not be so sinister. It so happens that "important" operations, like a class action lawsuit settlement, are also the type of thing you'd particularly want to protect from bots.
Re:There is no evil like reCAPTCHA by tacon on Monday August 05, 2019 @01:30PM (#20616139)
Why would anyone protect an "unimportant" site with a captcha? The value of the information, to someone, in bulk, is exactly why some throttling is needed.
Re:There is no evil like reCAPTCHA by lozenge on Monday August 05, 2019 @05:13PM (#20619035)
Good CAPTCHAs are solved by farming them out to low-paid workers, not bots.
Re:There is no evil like reCAPTCHA by alistairSH on Monday August 05, 2019 @12:43PM (#20615585)
Why? Maybe Google hopes that if reCAPTCHA is sufficiently annoying and prevalent that users will disabled any and all tracking extensions they've enabled?
Re:There is no evil like reCAPTCHA by jimnotgym on Monday August 05, 2019 @12:51PM (#20615672)
Or maybe they notice that they don't get the same problems on Chrome, so they move to that...
Re:There is no evil like reCAPTCHA by mindslight on Monday August 05, 2019 @01:00PM (#20615773)
Probably neither explicitly as a human judgment, but both constructively - some A/B experiments noticed favorable numbers went up by doing the crappy thing, and so it has been decided.

I'm waiting for the day when it pops up "find the humans" and there's someone clearly wearing CV-camouflage. For anyone that doesn't get it: you let that human hide, because it could be you in twenty years.

Re:There is no evil like reCAPTCHA by ec109685 on Monday August 05, 2019 @12:55PM (#20615706)
A lot of bots use humans to solve captchas, so the human time is important.
Re:There is no evil like reCAPTCHA by Wowfunhappy on Monday August 05, 2019 @01:08PM (#20615857)
The bot is delegating what it presents to the human, though. So just present the human with images that have already faded in (and if no image has finished fading in, switch to the images from the other captcha).

Edit: Unless, it occurs to me now, Google is monitoring how the user responds to the fade in. When in the fade process do they click the square, for instance.

Still seems like it wouldn't be all that helpful, though.

Re:There is no evil like reCAPTCHA by plopilop on Monday August 05, 2019 @12:49PM (#20615653)
> I think this is just what Google does when it thinks you're a "bot": i.e. they don't know who you are.

Maybe this is to prevent adversarial learning? If the images reload immediately, then the bot can learn (via a neural network) whether its solution was good or not. If there's a delay, it's the same, but the learning is slowed down by the same factor.

No idea if this is true, it just popped out of my head.

Re:There is no evil like reCAPTCHA by Wowfunhappy on Monday August 05, 2019 @01:06PM (#20615831)
As I said below, this is what I thought too, but another HN'er pointed out that a bot could load up a thousand captcha's in parallel and just switch between them while waiting for the fade in.
Re:There is no evil like reCAPTCHA by inlined on Monday August 05, 2019 @01:46PM (#20616330)
Sure, they can, but putting a small delay forces an arms race on how big a cluster you need to operate those parallel bots and how cheaply you can offer a cracking service.
Re:There is no evil like reCAPTCHA by dwd on Tuesday August 06, 2019 @03:13AM (#20622903)
Google's pretty well done with the reCaptcha or are counting on a lot of sites to keep using v.2 for a while.

There's more saleable data to be collected tracking people's interactions in a website, under the guise of predicting who's a bot.