Buster: Captcha Solver for Humans
github.com
github.com
Not only does Google presumably usually know exactly who you are when you visit that site, but even if you normally block other Google hidden Web trackers, you can't block the ReCaptcha tracker, so in some cases Google can have a very good idea of what you do on the site.
So, while this browser extension might relieve some of the visible annoyance, it doesn't relieve the more insidious problem.
It’s easy to why device attestation is so alluring to these companies. Anonymity and bots look alike.
either way im sure most people are just annoyed with the gate code then they are with the tracking and would take the cookie everytime. and i feel like this is similar to many things especially with google.
but people just would rather just believe these companies are against them haha. kinda silly imo
Like you might create an Instagram account and be automatically banned in an hour for no apparent reason.
But as you say, it totally makes sense.
Of course, if you're merely embedding someone else's site then it makes a lot of sense to get captcha'ed to death.
CAPTCHA was on for this large company because they see a lot of fraud and it removed the simplest cases of it. We turned it off when within the app, but it was a stop gap. Not sure what came after.
- something gets abused
- a solution is needed to stop the abuse
- the 'techies' implement recaptcha and they are not aware of the regulatory implications
- it's such a small thing that it often get's overlooked in internal audits
Google fonts from their cdn is another.
Landing page Youtube videos is another but a little bit more well known.
The user should be warned so they can decide if they want to give Google everything; how else would they know?
- block them access to your site
- ask for recaptcha (use cookies so you just don’t give a poo of their choice - illegal)
- open the doors without captcha resolution (don’t need captcha as it can be bypassed)
I installed CalcNote on a new android phone today and had to untick "legitimate uses" for 3 vendors in several places, including Google and Bytedance.
Felt like I needed a shower once I was finished setting it up with the minimal apps that I use
And this is a lot of why I've been gradually drifting over the years to getting nearly all my apps from F-Droid.
> often it violates the gdpr
Strictly-speaking, notification before cookies are set is required by the 2002 ePrivacy directive (article 5(3)), which includes cookies (and related technologies) under the banner of the 1995 Data Privacy Directive (later superseded by the GDPR).
The intent of the ePrivacy law is clearly not "have a banner that yells about cookies". The intent is that you only set cookies when someone, say, clicks on the Dark Mode toggle, or does something else that sets a cookie, and that when they do that, they know the data privacy implications.
Traditional uses of cookies aren't affected: "Add to basket? (this uses cookies: learn more)" isn't that onerous, nor annoying. It's a pain for our dark mode toggle, but the law was written back in the day, when the expectation was that we could actually customise our user agents.
And although I am from the EU, my company is not, but I still have to comply with EU rules. Our product has no cookie or consent banners as I choose to make sure we comply and not have tracking products (or collect anything not needed for the functioning of the site) at all on our sites; this is sometimes a little bit more work but I believe the world is better for it. You don't need to track your users and you definitely don't need to pass that valuable data to Google (or CLOUD act; the US gov etc etc) for free so they can make money with your clients.
Browser-based identifiers such as cookies are only a very small part of it. Furthermore, tracking goes way beyond just cookies, and is done with things like IP address/user-agent tracking and browser fingerprinting - neither requires the cooperation of your browser, it can't do anything about it.
If you're talking about codifying the various data processing categories and let the browser communicate that via a header, it's already been tried with Do-Not-Track and was either 1) ignored, or 2) used as one extra part of the browser fingerprint.
The root cause is that there's an entire industry of parasites that make their money on breaching the GDPR and have no incentive to implement it. GDPR enforcement itself being lax means that they can get away with such non-compliant implementations.
If the GDPR is ever enforced properly, the problem would quickly resolve. The consent flows would first become compliant, and a few months later would be removed entirely along with all the tracking because the opt-in rates are so low that it's pointless to have it. But this would also spell doom for a huge industry of scum, so expect hard pushback at every step.
And I am not only talking about cookies; I am talking about that the browser should convey what I want instead of me clicking on buttons every site I get to. But yes, if not enforced, the scum will win anyway.
You can have a very hard captcha that bots cannot solve, but that discriminates against the disabled. This gives you privacy and abuse-prevention, but not accessibility. You can have a very easy captcha (or possibly multiple alternative challenges), but bots can solve those easily. This gives you accessibility and privacy, but not abuse prevention. You can mostly have easy, accessible captchas, but rely on invasive tracking and fingerprinting, this gives you accessibility and abuse-prevention, but not privacy. There's no way to have all three.
As AI gets better, traditional captchas get more and more useless, and you need more and more tracking. We'll probably reach a point where there's no task that computers can easily verify but AIs can't easily perform, except being "vouched for" by a company that the website owner trusts.
Examples being privacy pass and private access tokens, though I haven't seen much mention of them recently.
I'll complain about them. They're, at best, poorly-informed people who don't understand the ramifications of what they're doing as it winds up as abuse, or worst they're malicious actors who I hope are condemned to a life of a 300 baud modem over a rural telephone line in a lightning storm.
The hiccup is, these are two different problems. I'm not the service administrator; I'm the user who has to put up with the absolutely onerous "bot prevention service." Frankly, if you're a private entity, I'm mostly of the mind of do what you like. If I encounter a CAPTCHA, I will probably just bounce off the page. Except, of course, that Google penalizes me for doing that, too, because I Might Be A Bot That Got Stymied(tm).
Where my hackles are truly raised is when the government requires me to work through these moronic puzzles. I shouldn't have to do a CAPTCHA to log in to my transit pass or look up county records!
Finally, it's everyone who will handwave away "well, it's inaccessible but whachagondo" without the acknowledgement that we are all on varying levels of "abled" and that level changes throughout our lives, and not just as it relates to age.
But the alternative was to go down, or spend an order of magnitude more on abusive requests than legitimate ones, or allow spammers to use our commenting system to send emails.
I don't like the situation any more than you do, but that transit site might have captcha to protect it from getting DDoSed and becoming unavailable. That county records site might have captcha to protect personal information from getting scraped for usage in phishing attacks and other unsavory activities.
Sometimes there might be other ways to provide protection from bots, but those can have their own inconveniences for users. Or they could be prohibitively expensive.
I'm not saying we shouldn't try to find better solutions, or that captchas are always necessary. But in many cases, they are there for a reason.
I get this argument, and I even use it myself (it's great for getting through to people who find empathy hard), but shouldn't this be irrelevant? Even if 5% of people were born disabled, and the remaining 95% were abled for their entire lives, shouldn't disabled people still matter?
Let's take court cases as an example. Imagine your jurisdiction always let people look up cases that they had a case number for, but didn't let them search for all cases involving a specific person to protect the innocent. This worked fine when looking up a case involved taking a trip to the court, scheduling an appointment, giving the case number to an employee and waiting the for the documents to be brought into the reading room.
Then, somebody got the bright idea to move all that to the internet, making life easier for both the people who needed access to cases and the employees who used to provide it. There's one problem, however, a computer system won't stop an unsavory company from the Maldives from querying all the case numbers and building an index of all the cases and their participants, letting people search for all cases involving a specific person, something which the government specifically wanted to avoid. Captchas are the only real way to stop this.
> The Internet is full of these micro-tyrants
> often on sites that should want to be publishing their data far and wide (like ecommerce)
Mismatched incentives within the companies mean this may not actually be the case. A situation where customers come in and buy on their own (because they've heard from elsewhere how good/cheap the products are) sounds great for business (and is great) but that's absolute doom for the marketing department for example because not only it's clear they're not actually needed, but they get little of that "engagement" they so desperately need to justify their careers/promotions if people just come in, buy and leave.
With such a situation, the marketing/product department would rather have someone that buys very little but "engages" a lot than the other way around, as said engagement can be (mis?)represented in various ways to benefit their own careers, where as raw sales profit doesn't go into their pockets. Thus, captchas are one possible way to ensure this "engagement" is up, even if it overall leads to lower sales.
The only real value in captchas isn't to stop bots, but to make it more expensive, or slower, for an adversary to abuse your service at scale.
Replace 'bots' with 'bad actors', and isn't that security in a nutshell? It doesn't even have to be computers - every day I suffer having to lock my doors and carry keys because locks are how we deter people from theft.
As an aside, this kind of thing is why I'm a misanthrope. What % of resources are spent on preventing bad actors doing the most basic, bad things? What a waste.
(In the typical meaning of PoW, as opposed to human attention-work)
This is just one example. I get increasingly frustrated by how shit everything is and my way of dealing with it is to disengage. It is rather sad, but I was not put on this earth to wrangle apps, QR codes, verification codes, passwords, usernames, e-mails, TOTP codes, updates, activation codes, etc.
I am blessed that I have a number of excellent music venues in public transport distance and a very good ticketing agency about 30 min walking from my home. So I often go there and by them in person - still I also use the online services when in a hurry, lazy etc…
If not, I usually don't care, and go elsewhere on my list of distractions :) It's not even complicated, just one click in ubo, after looking at the usual suspects, making the stupid machines feel happy, next click to deny that happiness, making ME happy, moving on.
Just out of the corner of my eyes, muscle memory, whatever...
I'm a visually impaired user, and watching captchas get more and more hostile to people like me has been... difficult.
i would've thought the audio version of the captcha can still work for such a user?
The most recent few I've done have sounded like someone whispering "they threw their hair through the chair there" next to a propeller plane in a heavy thunderstorm.
Not that I want trillions of bots hitting up every resource on the Internet. But I don't see how to stop it at this point except by excluding a fair number of regular people.
I’ve heard this before, but where does one actually hire these humans? Mturk is the only thing that comes to mind.
I suspect these businesses do a first pass of ML in case the captcha is easy, before sending it to a human to be solved manually.
That captchas are completely useless is a popular myth.
With it off our system is filled with spam and bots. With it in it drops to 0.
What else should we do instead?
Bots cost nothing to google. Heck google main business IS a huge freaking bot!
this project is awesome. but it will only make google go harder against accessibility in the long run.
I'm assuming they fine-tuned the model to make it less capable of solving those.
An issue with the extension mentioned here is that it's not helping against the fingerprinting... it's actually leaving even more of a fingerprint.
I have to use a separate "fingerprint me" profile.
AWS on my private, hardly used account was the most annoying one in the past because I had at least a 50% chance to get it wrong. But that does no longer come up after I enabled 2FA.
Bots networks are often malware running on infected machines, so there's no cost to the hacker.
Captcha is supposed to stop the attack altogether.