Hacker News Reader

Comment by snek | Hacker News Reader

The article is complaining that CloudFlare (as a result of them refusing to track you) requires people to solve captchas over and over again. How is this hurting your privacy exactly?

View on HN

Correct me if I’m wrong but isn’t one of the strongest signals recaptcha uses to prove “I am not a robot” the fact that you’re currently logged into a google account, have the associated cookies, etc? This “phoning home” from all these sites is a clear privacy challenge.

The good news is Safari and Firefox are making this harder and harder. The bad news is that you’ll be solving a lot more captchas.

I wonder if privacy conscious browsers making their users have to solve more captchas will lead to more people disabling the privacy features... or there will be a time when captchas may become micro transaction based, so for a fee you might be able to skip them. A browser with support for an anonymous cryptocurrency to make the payments should be private and easy to use enough, but it might become an interesting world where you need to pay to remain anonymous.

Try creating a free email account on ProtonMail. I think they have an interesting approach very similar to what you're describing.

reCAPTCHA takes time and effort. It includes intentional delays and a random number of iterations (1-3). It also randomly fails and requires reloading the page. Instead of 2 second page loads, you spend 15-20 seconds. This makes browsing over a VPN frustratingly slow.

I'm convinced that reCAPTCHA is now just one of Google's tools to keep us all trackable and stop us from protecting our privacy. And CloudFlare is bringing it to half of the Internet. Bad bad bad. And shame.

> This makes browsing over a VPN frustratingly slow.

This is my pet peeve, too. I browse over a VPN all the time and these things pop up all the time and I hate them. I wouldn't have a problem with this mechanism if it worked, but it doesn't! It will randomly fail in various silly ways: new challenges are faded in so slowly there's no way you can wait for it, other times it will just keep on asking you to solve new challenges even though you're solving them correctly (I counted them once and it asked me to solve one 11 times before I gave up). And sometimes it will simply fail to load properly, or it will break websites in various ways.

Lately, I've taken to solving the challenges badly in subtle ways, just because I can. If I'm gonna train Google's neural networks for free, I might as well train them badly...

>'Lately, I've taken to solving the challenges badly in subtle ways, just because I can."

Can you elaborate on this technique? Do you just purposefully solve them incorrectly a number of times before solving them correctly or something else?

If it asks me to identify traffic lights, for example, I also include a couple of squares that aren't traffic lights, like a tree on the side of the road. I'm more selective than a random algorithm, so that correctly gets me labeled as a meatbag, but I'm definitely not providing good answers, either.

At this point, to be honest, I'm really not sure about the effectiveness of this mechanism anymore. It seems to me like a poorly-trained neural net with convincing human-like interaction (e.g. clicks spaced unequally) could produce exactly slightly-incorrect results that let me through. There's no way a smart 17 year-old wizzkid hasn't figured it out already and getting rich selling it to spammers in onion space.

This is a downright lie. CloudFlare isn't refusing to track people, CloudFlare is outsourcing the tracking.

My computer needs to contact Google to make those captchas work

They don’t make you solve captchas if they have enough information about you to think you’re unlikely to be abusive.

If you're on an ip that is part of a pool they consider unsafe, it's every time. When I use one of my vpns to browse, i end up skipping all websites using cloudfare.

This is a lot and it makes you realise how dangerous this situation is. Way too much traffic goes through cloudflare.

Isn’t that like complaining that your insurance costs more if you live in a high theft neighborhood? I mean, it’s not a good situation but if you’re sharing network space with a lot of dodgy activity is the real problem that the site owners wanted protection from those threats or that your network provider doesn’t have an effective abuse management process?

if they consider the subnet you’re on unsafe have you taken the issue up with your VPN provider? if they don’t have a negative stance towards abuse and you continue to use them then you’re actually enabling this behavior. i also wouldn’t be surprised if they considered all vpns unsafe blocks. TOR is usually blocked entirely for abuse reasons.

Reply on news.ycombinator.com