> I’m using a reputable, top-tier UK mobile provider

I'm in the UK too and have found that If you use any mobile internet provider, and have a browser configuration that dumps cookies etc on close, you will get a google captcha every - single - fucking - time... I just end up tunneling everything through sshuttle to one of my servers to save time, but these days you also get a bunch of websites blocking IP address blocks assigned to datacenters, so you can't win :(

As far as I can tell all mobile internet IP addresses are black listed for google captcha - I assume because they are frequently rotated between users.

I've found this to be the case for Three, EE, and O2 so far (been testing them all out to find the fastest because fixed line internet always sucks around here). I presume it's not the same on a smart phone mostly because people don't have such aggressive browser cache/cookie etc purging configured.

Pretty sure this is at least somewhat related to Carrier-Grade NAT[1]. Influx of connections from a single public IP shared by multiple public users = 'security concern'. Not to forgive the big tech giant of its inflexibility :P

[1] https://en.wikipedia.org/wiki/Carrier-grade_NAT

Never happened to me in the UK with either Three or Vodafone with firefox with various privacy extensions (privacy badger, decentraleyes, unlock etc)

Maybe something else you are doing?

> Even Google has taken to occasionally popping up CAPTCHAs just so I can see search results!

The most annoying one for me recently has been stackoverflow. The most basic use of stackoverflow (other than arriving through a web search) is to use its own search bar to search for something. Every time I do so, it asks for a captcha. It would make some sense to ask for a captcha when asking or answering a question, but why ask for a captcha when searching? And it's always the first search after opening the browser (the browser is set up to clear cookies on close), so it's not some sort of rate limiting.

Search is restricted because it's an expensive operation and prone to abuse. This practice is not just found at Stack Exchange, now GitHub doesn't even display the full code search result to visitors. The only option is to log in (if you are already an established SE/GitHub user and doesn't mind the web tracking)...

Even if search is expensive you can just rate limit it, a captcha is a dumb solution.

Yep, and this resulted in me just searching duckduckgo for the stackoverflow page I wanted to find, instead.

Probably too stop automated abuse and reduce unnecessary searches. Search can be expensive.

I see a lot of captchas that I was missing now that I am using the temporary container plugin [1]

Also for sites that I don't know why they need captchas...

[1] https://addons.mozilla.org/en-US/firefox/addon/temporary-con...

That would be because they're trying to leverage browser fingerprinting, and you're screwing with the fingerprint.

The sad thing is, if you're privacy conscious and don't play ball with the rest of the world, and actively mitigate these surveillance/data leaking mechanisms, you're assumed to be a malicious actor by corporate risk departments the world over.

Welcome to the web. Give us your data, and enjoy being tracked.

In a world where bot herders try to blend in with the crowd, and historically lots of them aren't great at it, you have to be careful about your choices. It's very easy to look like a bot by accident, and odds are pretty good that anyone who sticks out is likely to be a bot. Just like odds are quite good that any HTTP request coming through Tor is quite likely to be malicious.

This is a pretty shitty scenario all around. It shouldn't have happened. It should never have come to this! That said, I've yet to see a better solution on offer for general-purpose low-effort anti-abuse purposes.

People here on HN generally seem to either hate CAPTCHAs with the passion of a million blazing suns (but have nothing better to offer) or want everyone to use something strictly worse (like argon2 hashing).

> (“suspicious activity on your network” - I’m using a reputable, top-tier UK mobile provider)

So are a _lot_ of other people, for all kinds of purposes, including nefarious purposes.

Well, exactly. And of course the IP addresses are dynamic. So it seems a bit silly to treat a whole network as suspicious because someone on it (amongst thousands or millions) is doing something suspicious...

I get the same thing on Wikipedia sometimes because someone, who at some point in the past had my randomly assigned IP address, once made some dodgy edits. (Solution: reboot router to get new IP address!)

I suppose if we had static IPv6 addresses (each account always gets assigned the same IP) then this would be less of an issue.

Companies need to stop treating IPs or groups of IPs like identifiers. When I'm in my office, I can't access yelp. They blocked that ip range for some reason, maybe because of something we did. We block entire countries at work because we were getting a lot of DDOS from those countries and we don't do business their but it ends up blocking a lot of legit use cases and wasting a lot of time.

Your first mistake was using Yelp in any capacity[0-6]. Thankfully Apple is trying to drop Yelp by having their own review and photo system[7].

0: https://news.ycombinator.com/item?id=20625232

1: https://news.ycombinator.com/item?id=3884515

2: https://news.ycombinator.com/item?id=14238576

3: https://news.ycombinator.com/item?id=19220988

4: https://news.ycombinator.com/item?id=22706307

5: https://news.ycombinator.com/item?id=486468 (all the way back in 2009)

6: https://news.ycombinator.com/item?id=6452410

7: https://9to5mac.com/2020/08/26/apple-maps-reviews-inhouse/

I worked at a company once that decided to add an entire range of IP addresses to their firewall’s deny list. Seems an executive had their personal home network pwned, and an unknown figure told him it was from a certain part of the world.

Said executive made enough noise and put enough pressure on the network engineers to get it done without question or delay or...most critically..a reviewed and authorized change control ticket that would have caught what was about to happen

Following Monday help desk was underwater triaging tickets from the entire office full of team members we had just denied from the corporate network, and customers who now couldn’t use our product at all.

That's the point though, it's not just someone doing it that has triggered their defences, it's many - most probably unwittlingly because of malware or even some of those cheap shitty games that mysteriously steal your battery and/or data allocation with unknown background processes.

The point is thus: they are receiving enough bad traffic from that range to have determined they need to filter it somehow.

These companies are so determined to keep people from legally scraping their sites that they don't care that they're walking all over the ADA in doing so.

That is because >50% of internet traffic is bots. Mostly BS marketing tools, ad conversion scams and quack-security 'scans' from my experience. Pretty sure the entire captcha proliferation is to reduce fake clicks in google ads.

I've been working on ways to block bots from some websites I manage the hosting for. It is nearly impossible. I rate limit the hell out of most of the world and block a long list of fake user agents. Still like 40% of out traffic is bots.

>'legally challenge CAPTCHAs'

Probably not, depending on where you live etc. Here, in the netherlands only gov. websites are required to be accessible.

> “suspicious activity on your network” - I’m using a reputable, top-tier UK mobile provider

Same in Canada. WiFi is fine. Using the web when connected to cell data (from the second biggest mobile operator in the country) brings up CAPTCHA almost 100% of the time.