> Google's reCaptcha code seemed to be very keen on knowing my 'cadence' or the way I used my mouse and how quickly (or how slow) I completed the captcha. It also looked at things like timezone, screen resolution, battery charge level etc So they could determine if it was 'you' who was using the captcha, soon after, in a separate session (even on a different device!)

I'd bet a good amount that they store that along with all the other personally identifying info they have on you (and google of course has a massive amount of that); which is basically why after a single reCAPTCHA solve, you wont see them prompt you again for ages - they know who you are.

Just turn on "Resist Fingerprinting" in Firefox and you'll find ReCAPTCHA _really_ annoying! I have to solve 3-5 "panes" of a ReCAPTCHA on _every_ page... It's very annoying that preserving privacy comes with this cost.

I almost want to just add a "DeathByCaptcha" extension to handle these for me and pay a few cents for every page I visit, lol

It's not a cost. Google doesn't want you to protect your privacy from them. It's a punishment.

> It's very annoying that preserving privacy comes with this cost.

It doesn't necessarily have to if Google supported privacy pass like hcaptcha does. The problem is that they don't.

Why would they? Supporting privacy-preserving options is not within their business interests.

It's way cheaper than that, you'll pay significantly less than a cent for each captcha.

> which is basically why after a single reCAPTCHA solve, you wont see them prompt you again for ages - they know who you are.

If only. If the same site has reCaptcha across more than one page, within mere minutes of having to slog through multiple screens of one, I can guarantee I'll be doing it again.

And I'm never sure if Google has served me either a very long sequence of reCaptchas, or whether they've decided I'm not a person and are serving me an infinite reCaptcha.

Being on a VPN, have blockers on, or not logged into google are a few things that will increase the captchas you’ll see.

Add "running Firefox" to that list.

And that's how you know that your VPN and adblockers work :)

Also using a screen-reader and using anything other than Chrome.

I'm guessing that the comment you're responding to uses Chrome/ium, and that you don't.

Just looked on Takeout and there don't seem to be any reCAPTCHA data there. I wonder what a GDPR request would produce.

Someone on here has tried to get all their data from both Facebook and Google. I wish I could find the blog post. The tech companies are claiming their Takeout/equivalent is sufficient under the GDRP and anything extra we ask for is not being provided due to it being "non user understandable" or in a "machine format". IIRC.

That's still their data though, no?

That is an investigative blog post I would like to read too.

reCAPTCHA only needs to make a determination that the user is some human, not that they are any particular human. And reCAPTCHA is usable without being logged into Google’s identity system. The profiles it builds are clearly not associated with Google’s primary identity database, and its trivial if you don’t need to preserve identity to one-way hash every piece of data that GDPR considers user-identifying at the entry point to the system and store only the hash. The EU isn’t shy about handing out billion-dollar fines to Google, so while Google can match a user to a stored profile there’s no reason to suspect that Google has a way to reverse that mapping.

ReCaptcha seems to use your logged-in status (and, I’d guess, account reputation), along with an ip reputation score when deciding whether to serve a captcha or not.

A GPDR request naming an IP address should allow them to provide those scores.

If not, it’s easily demonstrable that they are storing and using information that they’re not including in a GPDR response, and they deserve their multi-billion dollar fine.

Also, ReCaptcha’s behavior is obviously anticompetitive, and also using Google’s dominant positions in some markets to establish dominance in unrelated markets.

This is anti-trust lawyer candy.

Logged in status and account reputation are obviously useful input, but reCAPTCHA objectively works without requiring login. IP reputation also obviously makes sense to take into account, but the fact that Google collects all of this fingerprinting information demonstrates that’s again only a part of what factors in. The same profile can show up from behind a different IP.

Not sure what you’re getting at about GDPR and IP reputation. GDPR says that an IP address is PII if it can be associated with an individual, but that doesn’t mean an IP address is a “subject” for the purpose of filing an Article 15 Data Subject Access Request. And it doesn’t mean that stored information that is keyed by an IP address is personal data, even if the IP address can be associated back to a particular individual.

I also find it strange that you’re talking about reCAPTCHA being “anti-trust candy” in the comments of an announcement about how a different captcha service now handles 15% of the entire internet.

>GDPR says that an IP address is PII if it can be associated with an individual, but that. . . doesn’t mean that stored information that is keyed by an IP address is personal data, even if the IP address can be associated back to a particular individual.

Okay, I’m usually pretty good at understanding law, but this doesn’t make sense to me. This seems like a very shallow, arbitrary definition of subject data. So GDPR didn’t grant ownership of one’s PII? What did it grant ownership of? I’m very confused by this.

A subject (a person) can make a request for subject data (data about the person) that a company has stored. The data has to be about the person and associatable with the person to be covered by GDPR. If I keep track of say, average CPU time for handling requests from a particular IP address, the CPU metric doesn’t become the personal data of the individual that is associated with the IP address.

That's no secret, ... that's exactly how it is supposed to work.

I've had hCaptcha recheck me repeatedly and fail to work at all on VPN. I much prefer ebay's simple slide the puzzle piece method.

The slide is just as, if not more invasive as recaptcha in terms of privacy, cross-site tracking and fingerprinting.

That's annoying. Have you tried using their accessibility feature?

https://www.hcaptcha.com/accessibility

Anti-feature as you need to sign up for this.

Yes.

hCaptcha is not easy as is being claimed here. I have lost a lot of time and been blocked from much content due to hCaptcha.

I love this extension: https://github.com/dessant/buster

It won’t solve the privacy issues but at least you’re not working on google’s training set anymore and captchas are automatically solved for you.

reCaptcha has also gotten increasingly annoying lately.

I forgot my password to one site and tried about 2 or 3 different passwords and in-between each it asked me to do about 7 or 8 of those labelling exercises. I finally just gave up and left the site.

Not only that, but the labelling exercises weren't clear. It wanted me to label a "公交車" which means more like a public city bus and there were also school buses which would normally not be called that in Chinese so I didn't label them but Google thought they were part of that class, and wouldn't let me proceed without me labelling them, and furthermore, punished me with more "hard" exercises like that. I guess they are trying to turn me into a stupid bot.

Recently Google's captcha asked me to mark all the traffic meters on the photos, and amongst the choices was a photo of a mailbox. It didn't let me through until I marked it as a meter as well.

Good luck to whatever self driving car they are training using this data.

Maybe would be kind of fun if we, the users, could form a coalition to deliberately mislabel photos on captures on a mass scale.

It just seems there lacks a way to make it happen beyond the hacker community.

4chan users already used to do this for the old text based ReCaptcha. The idea was everyone put in a particular racial slur (they're not very imaginative) for the second word. I doubt it had any impact.

If I remember correctly, it did have some impact.

I believe at one point you could use that racial slur in place of the second word in the captcha and it would accept it.

I do this. I just click random boxes and it usually lets me through. It’s more clicks, but not necessarily more time.

I would venture that the repeated attempts from multiple users to not mark the mailbox will help with that.

What's a traffic meter? Maybe it's just important that the car doesn't drive into it.

I think he meant a parking meter.

yes, thank you!

:facepalm:

Well that might be my handiwork! About half the time I have to do an reCaptcha i mislabel one of the photos. Because I’m not being paid, I’m being held hostage to an automated system and I will rebel.

That literally happened to me 5min ago!

I’m not particularly fond of reCaptcha either but I disagree that it’s an obviously good thing for someone to be able to repeatedly make new accounts with no restrictions. Abusive users use this to bypass account bans.

As a nojs browser, I only think it's great in the sense that I don't have to waste my time with sites which don't care about accessibility.

yes we need captcha that supports browsers like links. NOJS browser ought to make a comeback. display image, text and video. For many sites that's ALL we need.

For sure enable javascript to get the fancy stuff, but mostly we just want to read the text, view the picture and see the video.

Is there a way to delete collected reCaptcha data from google accounts? I looked around and I don't see a specific setting for that.

Lots of websites sit behind a single company which has now changed to use its own captach is a good thing?

Creating a monoculture makes it easier to implement systems that automatically bypass the captchas, so it’s good for end users, especially people that are visually impaired, or otherwise unable to solve captchas.

It's not ideal but it is an improvement.

And you are also contributing, without pay, to G$$gle AI and their plans of world domination.

Using hCaptcha is also contributing to some ML model for different companies serving unknown (to us) purposes.

well the slight improvement in usability is a win, but is it really any more anonymous than recaptcha?

Unlike Google, which is making hundreds of billions with ads, we have zero reasons to track users - customers pay us to stop bots, and that's the product we provide.

one significant issue with recaptcha is that it punishes users who are not easily identifiable. the puzzle isn't enough for recaptcha - it needs to know who you are. is hcaptcha better in this regard? for example does it work behind tor? does it work with third party cookies disabled? is the challenge im ostensibly solving really the only thing required to verify my humanity? if so, i'm impressed! but if not, maybe we should just do away with the puzzles...