Hacker News Reader

Comment by lurtbancaster | Hacker News Reader

Don't get me started on how infuriating Google's ReCaptchas are on Tor Browser.

Buster captcha solver fails immediately. And when you do actually manually solve the captcha correctly, sometimes Google still thinks you're a robot.

And sometimes it asks me to select all "bicycles" in the images and there are NO GODDAMN BICYCLES in any of the images whatsover. So I hit Skip and eventually google thinks I'm a robot.

Everybody please either switch to hcaptcha or..., although I've not seen a website use this yet, upgrade to ReCaptcha v3 maybe?

I read somewhere that ReCaptcha v3 is far less annoying than v2? Is that true?

View on HN

It's just that the classification gap between human and computer is closing, so now computers are better than a good percentage of humans, which means that there's a chunk of humans that now cannot conclusively prove they aren't bots.

I suspect there's no way to pass some of recaptcha's challenges, they appear to work like a tarpit.

Don't get me started on hCaptcha! I've spent good 5 minutes yesterday trying to guess what the 'boat' is and is not according to its moderators.

hCaptcha, for me, has such weird angles of objects, like a boat cropped to just the hull. Makes it super easy to pass over correct answers.

> upgrade to ReCaptcha v3 maybe?

Funny you should say that. reCAPTCHA v3 is meant to be invisible, watching the behavior of a user in the background, and then returning a score between 0.0 and 1.0 for the website to do with as they please.

so if you don't pass, say, by using TOR or even just a VPN, you don't even get a chance to prove you're not a bot? Cool, really cool, I can't see that being illegal at all.

EDIT: This comment is stupidly worded, please see clarification below.

Why would it be illegal? Being able to access a website (be it Twitter, Hacker News, or your hometown newspaper) is a privilege, not a right.

My comment was poorly phrased. My point is that this can quickly lead to legal problems, when such a captcha restricts your access to something you do have a legal right to.

Say I buy a new phone and it stops working after 3 weeks. I want to contact the seller, but they only have a web contact form and I fail to get past the captcha.

This is already getting very close to being a huge legal problem, and the only reason why it's probably not that bad is that technically that website is supposed to give at least a contact address so I could just send them a letter which, while hugely inconvenient, is legally still a good enough way for me to contact them.

I'm sure if you spend a while longer you could find a few cases where the problem is even worse (also considering more than just one legal system).

So what I should have said: Using this technology to block users from the wrong endpoints could end up being illegal.

For context: I'm talking German laws here.

It's definitely a problem regarding government sites - the UK even has a page advising their own government agencies to not rely on them unless absolutely necessary[0]. US government sites have simply resorted to putting everything behind a login wall and verifying identity, such as is the case for ssa.gov and healthcare.gov, or just not caring and letting spammers do whatever they'd like (typical for local-level governments).

0: https://www.gov.uk/service-manual/technology/using-captchas

Disability discrimination laws have been in place for decades now.

GDPR could be a concern if you are not able to opt out of automated processing. Deciding if you're a spambot or not is a huge decision for a robot to make.

To be fair, any captcha would have this trouble, but an entirely invisible one would not be able to be questioned

I'm pretty sure recatcha has a punitive/tarpit mode where it had already decided to reject you but just gives a series of slow tests which it will never pass you on anyway.

It seems like Google punishing you for taking actions to increase your privacy, which not-so-coincidentally reduces the data they're able to hoover up from you.

That's just silly; it's well known that Tor nodes are widely abused by spam bots. Google is "punishing" known sources of spam. When I ran a forum many Tor nodes ended up being outright blocked, since there was so much spam coming from them.

I'm not sure how to feel about this. I run Tor relays to support the network, but at the same time having moderated a forum that received tens of thousands of signups per day over Tor and NordVPN and PIA, all of which were able to verify email via various domains,, all of which were for spam...

It's not like I intentionally targetted Tor relays or anything, we just targetted source of spam, which ended up being a lot of Tor relays. Because we were (and actually, still are) running a rather outdated version of vBulletin (upgrading is difficult) things were getting pretty dire if we didn't do ... something.

ReCaptcha v3 is basically a means for Google to let the site owner take the blame for bad UX patterns while still getting browsing data from much of the web.

So they fingerprint you based on your interaction with captcha if you're using tor.

Reply on news.ycombinator.com