Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Google Robotics Communications Privacy Security The Internet Technology

Google's reCAPTCHA Turns 'Invisible,' Will Separate Bots From People Without Challenges (arstechnica.com) 160

Posted by BeauHD from the prove-you're-not-a-robot dept.
Google is making CAPTCHAs invisible using "a combination of machine learning and advanced risk analysis that adapts to new and emerging threats." Ars Technica reports: The old reCAPTCHA system was pretty easy -- just a simple "I'm not a robot" checkbox would get people through your sign-up page. The new version is even simpler, and it doesn't use a challenge or checkbox. It works invisibly in the background, somehow, to identify bots from humans. Google doesn't go into much detail on how it works, only saying that the system uses "a combination of machine learning and advanced risk analysis that adapts to new and emerging threats." More detailed information on how the system works would probably also help bot-makers crack it, so don't expect details to pop up any time soon. When sites switch over to the invisible CAPTCHA system, most users won't see CAPTCHAs at all, not even the "I'm not a robot" checkbox. If you are flagged as "suspicious" by the system, then it will display the usual challenges.
This discussion has been archived. No new comments can be posted.

Google's reCAPTCHA Turns 'Invisible,' Will Separate Bots From People Without Challenges More

Google's reCAPTCHA Turns 'Invisible,' Will Separate Bots From People Without Challenges

Comments Filter:
  • the ceiling is the roof

  • Up until it tags the handicapped as bots (Score:3, Interesting)

    by Anonymous Coward on Thursday March 09, 2017 @09:31PM (#54010549)

    I believe there are accessibility laws most parts of the world ....

    • Re: (Score:2)

      by gnick ( 1211984 )

      If they're compliant now, it shouldn't be a problem. If you're suspicious, they just kick you back to the system they were using before. If they're not compliant now, this may be part of their accessibility solution.

  • Eh! (Score:1)

    by Anonymous Coward

    "You're either a bot or you're running NoScript!"

    • Re: (Score:1)

      by Anonymous Coward

      As far as I can tell, if you are running noscript you cannot get through these things at all.

      Google wants to know what you are signing up for. If you won't tell it, it won't let you pass.

      • But google's CAPTCHAs are not only used for signups. If you search google using the TOR browser you're also presented with CAPTCHAs for every search. Which gets quite annoying.

        (Google say they don't target TOR but experience says otherwise.)

        • Browsing the internet through TOR is downright painful now thanks to all of the CAPTCHA garbage. Besides Google, Cloudfare is another major offender. Though at least as far as search goes, you can use DuckDuckGo.

  • Don't know how I feel about this (Score:2, Interesting)

    by Anonymous Coward

    For one thing, I never get the checkbox from my residential IP connection. But once I switch to my vpn on my own assigned /24 I get recaptcha's all day. This isn't new, I've been browsing from the same /24 for the last 5 years. Yet for some reason, Google things when I'm coming from there I'm a threat. I know I'm a minority that's going to be drowned out because who cares about the few users caught in the net. It's just an annoying feature that kills any competition for my business. Any remote sites u

    • The inverse Turing Test (Score:5, Insightful)

      by goombah99 ( 560566 ) on Friday March 10, 2017 @02:23AM (#54011189)

      So now we have an AI trying to decide who is the human, the inverse of the turing test. What it comes down to then is it easier to create an AI that can pass the Turing test or the inverse turing test. If it's easier for a bot to fool a bot then this AI strategy will meet it's match in another AI. On the other hand if it's easier to do the inverse turing test then this new strategy will work. I'm not really sure if it's obvious which test is harder.

      • Re: The inverse Turing Test (Score:1)

        by Anonymous Coward

        Yeah its great. A non transparent way to make life to make life more difficult. What could possibly go wrong ?

      • Probably that's how it's done by Google. You just described the training stage of generative adversarial networks.

      • Re: (Score:2)

        by dj245 ( 732906 )

        So now we have an AI trying to decide who is the human, the inverse of the turing test. What it comes down to then is it easier to create an AI that can pass the Turing test or the inverse turing test. If it's easier for a bot to fool a bot then this AI strategy will meet it's match in another AI. On the other hand if it's easier to do the inverse turing test then this new strategy will work. I'm not really sure if it's obvious which test is harder.

        Depends on how invasive you allow the inverse turing test to be. USB blood analyzers already exist, DNA analyzers that fit in your pocket may be built in my lifetime. (Obligatory Skynet reference.)

    • Did you ever make sure that /24 doesn't have an open proxy, DNS or NTP server running on it? Did you make sure that there are DNS reverse/PTR records? When using squid did you make sure it is locked down? Did you ever try removing the x-forwarded-for headers or adding them?

  • Lots of work to do (Score:5, Informative)

    by arth1 ( 260657 ) on Thursday March 09, 2017 @09:33PM (#54010565) Homepage Journal

    For some reason, I get flagged for captchas all the time, but no matter how vigilant I am at choosing storefronts, mountains, street signs and house numbers, I have to go through at least a dozen pages of them before it believes me.
    I wonder whether being behind load balanced proxy servers might have anything to do with it.
    Anyone else having similar problems?

    • Re:Lots of work to do (Score:5, Insightful)

      by MatthiasF ( 1853064 ) on Thursday March 09, 2017 @09:43PM (#54010603)
      Yep. I constantly need to do them because I have my browser locked down to stop tracking.

      I have a feeling most of Google's new "invisible" method has more to do with the fact they are tracking you as a unique user and following your path to the page. If it looks legit, they don't challenge.

      But if you're one of the many of us who actively fight being tracked, we're going to be relegated to second-hand internet user thanks to Google's monopoly.

      • Re:Lots of work to do (Score:5, Interesting)

        by 93 Escort Wagon ( 326346 ) on Thursday March 09, 2017 @10:28PM (#54010715)

        Yep. I constantly need to do them because I have my browser locked down to stop tracking.

        I have to do them all the time, and I'm not even that aggressive regarding blocking tracking. I mostly just clear things out after the fact, every few days - I'm not even running noscript (but I am running an ad blocker, and don't use Google for much).
        I'll be curious to see how many of us this disenfranchises...

      • Re:Lots of work to do (Score:4, Informative)

        by AmiMoJo ( 196126 ) on Friday March 10, 2017 @05:06AM (#54011453) Homepage Journal

        The invisible ones seem to be using things like mouse movements and other measurements of human interaction, which can be difficult to fake. They must have some way to prevent replay attacks. Not sure how they will handle people disabling Javascript, probably fall back to the old HTML5 method.

        I find what triggers to endless captcha loops is:

        - Privacy settings in your browser, especially Privacy Badger and uBlock
        - Blocking Flash/WebGL/Canvas fingerprinting
        - Disabling Javascript
        - Using a VPN
        - Especially using TOR

        • I find what triggers to endless captcha loops is:

          - Privacy settings in your browser, especially Privacy Badger and uBlock - Blocking Flash/WebGL/Canvas fingerprinting - Disabling Javascript - Using a VPN - Especially using TOR

          I find what triggers endless captcha loops is the regression of Google's search capability, such that I have to repeat the same basic query multiple times with different minor variations in attempts to bypass Google's belief that it knows what I want better than I do. At least once a week, and often several times per day, I get stuck doing Google captchas. I guess it doesn't help that I have a wide range of interests and the type and range of query I make can change dramatically in a short period of time.

          Go

          • I haven't used much from Google in years, personally. I'll still use Google search if my first choices don't get good results, but usually they do fine. I watch videos on YouTube sometimes. It's not as if anyone actually has to use Google services routinely if they don't want to be subject to Google hassles.

            We're all fine unless other admins start plastering Google-hosted junk all over their own sites. Oh, wait...

        • - Blocking Flash/WebGL/Canvas fingerprinting

          I'd wondered why a load of sites seem to be asking for WebGL access now when nothing seems to need it - using it for fingerprinting makes sense. I disable it by default, because I've worked on GPU drivers and there's no way in hell I'd allow untrusted code into them, even if it's been through a WebGL verifier.

          • Re: (Score:2)

            by tepples ( 727027 )

            I've worked on GPU drivers and there's no way in hell I'd allow untrusted code into them, even if it's been through a WebGL verifier.

            What should reach more users: an application developed for WebGL or an application developed for, say, OpenGL on a Mac?

            • The web-based malware will be a lot easier to deploy, if that's your question.

              • Re: (Score:2)

                by tepples ( 727027 )

                Let me rephrase:

                A video game developer might consider targeting WebGL in order to avoid having to develop the game five times, once each for Windows, macOS, GNU/Linux, iOS, and Android, or to avoid the editorial censorship imposed by the sole app store of one or more of said platforms. If you were developing a video game, would you develop it five times in such a manner, or would you instead limit supported operating systems and forgo revenue from users of others?

                • I'd develop it in SDL [libsdl.org] + OpenGL.

                  • Re: (Score:2)

                    by tepples ( 727027 )

                    And then compile the game made in SDL and OpenGL for which of the five platforms that I mentioned above (Windows, macOS, GNU/Linux, iOS, or Android)? Because I doubt that these platforms are binary compatible, unlike web browsers running a web application.

                    • And then compile the game made in SDL and OpenGL for which of the five platforms?

                      Um... all of them, as you normally do? I'm confused because you ask that as if it's some kind of problem...

                    • Re: (Score:2)

                      by tepples ( 727027 )

                      And then compile the game made in SDL and OpenGL for which of the five platforms?

                      Um... all of them, as you normally do?

                      Not everybody "normally do[es]", for two reasons.

                      First, an individual developer graduating from hobby projects to a first revenue-generating project is unlikely to have the financial resources right off the bat to purchase five different devices for which to build and test: a Mac, a Windows 10 PC, a GNU/Linux PC, an iPhone or iPad, and an Android device. He would have to make a version for each platform and use the revenue from users of each platform to fund a port to the next platform. But with web technol

                    • First, an individual developer graduating from hobby projects to a first revenue-generating project is unlikely to have the financial resources right off the bat to purchase five different devices for which to build and test: a Mac, a Windows 10 PC, a GNU/Linux PC, an iPhone or iPad, and an Android device.

                      LOLWUT?

                      There are only two possibilities: either the programmer in question is a hobbyist, or a pro. If the former, then Virtualbox (or whatever other emulator/virtualization system is applicable) would be

                    • Re: (Score:2)

                      by tepples ( 727027 )

                      There are only two possibilities: either the programmer in question is a hobbyist, or a pro.

                      My question was about the transition from the first of these "two possibilities" to the second. But first, let me make sure we agree on definitions. To me, a "professional" means one who has been paid for his work in a particular field. Am I right? Or are you instead defining it as one who seeks to be paid for such?

                      I thought one's project to become a professional had to be done with hobbyist tools in order to afford professional tools for the next project. The only ways I can see around this are A. to earn

                    • I thought one's project to become a professional had to be done with hobbyist tools in order to afford professional tools for the next project. The only ways I can see around this are A. to earn money for the required tools in a day job in a different industry, or B. to release hobby projects to establish one's reputation and then crowdfund the tools needed for a simultaneous 5-platform release of one's first professional project. Which one is more practical?

                      C. Become a professional and save up money by wor

                    • "Linux and Windows VMs using a Mac OS host," I meant.

                    • Re: (Score:2)

                      by tepples ( 727027 )

                      You run Linux and Mac^W Windows VMs using a Mac OS host. Obviously.

                      And thus still need to buy the Mac mini to run the macOS host, making the "hobbyist" and "pro" loadouts the same.

                      No, which is why I'd just release on Windows/Linux/Android and fuck Apple.

                      At this point, I'm inclined to agree.

          • Wow, I just had a flashback to all the stink that arose here when it was revealed that the Pentium 3 cpus would have a unique numerical id Damn, so quaint in this age of locked and signed boot loaders, malware from illigitimate and "legitimate" companies*cough*Sony*cough*, all the major commercial computer and phone operating systems constantly phoning home with shitloads of user info, games with DRM that require an always on internet connection just to load, and other such shit to remind us that we are fa

      • But if you're one of the many of us who actively fight being tracked, we're going to be relegated to second-hand internet user thanks to Google's monopoly.

        Whatever happened to you happened because the owner of the site chose to use ReCaptcha as a tool to prevent bots. You have no right to insist that a particular website cater a particular user experience to you -- if you don't like it, you can go elsewhere.

        And what monopoly are we talking about here? There's certainly no monopoly on plugins to detect bots, there are dozens. Google might (probably even) have a monopoly on search, but that's hardly relevant to the captcha story. . .

        • Whatever happened to you happened because the owner of the site chose to use ReCaptcha as a tool to prevent bots. You have no right to insist that a particular website cater a particular user experience to you -- if you don't like it, you can go elsewhere.

          What you said applies when a private sector business in a competitive market requires solving a reCAPTCHA challenge or running other proprietary scripts as a condition of accessing a luxury. I don't find it so defensible when a private sector monopolist or even a government requires doing so as a condition of accessing a necessity, as the United States Copyright Office required last year [fsf.org].

    • Re: (Score:2)

      by sinij ( 911942 )
      Yes, if you lock down your browser you get them a lot. Basically, for Google, if they know where you live and your cat's name - then you don't get shown captchas.
    • Yes, and this is because you do, on Google behalf, some picture recognition as well, in order either to confirm some other person recognition "work", or to be the initiator. The percentage distribution between "recognition work" and "actual recaptcha" is not clear, but the more you have to recognize, the more you work for Google at no charge.

    • Re: (Score:1)

      by Anonymous Coward

      Yep, same problems for me, and some images are so grainy it's not possible to make out anything on them.
      Since I normally don't have 10 minutes to spare clicking images when I want to do something, I just put that site to my blacklist and find an alternative instead.

    • > I wonder whether being behind load balanced proxy servers might have anything to do with it.
      Anyone else having similar problems?

      Yes, proxies correlate well to bots. Not all attempts from proxies are bots, but most attempts from bots come through proxies. Open proxies especially. Open proxies are bad anyway, so make sure your proxies aren't open. If possible, use a firewall to limit access to your proxies by IP address.

  • Google knows who you are already (Score:1)

    by Anonymous Coward

    Translation: Google have collected enough data of most people's browsing habit from google.com + googleanalytics.com + googleadsense, no need to show you a captcha when they know who you are already.

  • Given that Google not infrequently flags my web searches as being "suspicious", you'll forgive me if I expect this to work rather poorly in practice. I won't be holding my breath for the pipe dream of seeing captcha images less frequently...
    • Google always thinks power users (people who use quotes around phrases, or who use the site:domain.com filter, or who are fast typers able to submit more than 1 search every 5 seconds) are suspicious.

    • I don't get why anyone would put with a search engine that throws CAPTCHAs at you when you try to use it. Given how lousy Google's search results are nowadays, it seems pretty easy to make the switch to someone else. I've never seen a CAPTCHA using DuckDuckGo, but I imagine even Bing would be an improvement. And if for some reason you like Google's results, there's always Startpage.

  • If they were really smart, they'd just give up so they don't have to dump effort into the arms race anymore and reCAPTCHA would just secretly be a cryptocurrency mining operation.

  • reCAPTCHA is simply another tracker (Score:2, Interesting)

    by Anonymous Coward

    reCAPTCHA is triggered if you take basic precaution when browsing the web, e.g. blocking unnecessary scripts, cookies, trackers, beacons, and of course ads
    If you do, reCAPTCHA will force you to complete a broken AI-training job, collect your behavioral data, and monetize your labor.
    It's purpose: to force you to become a PRODUCT of Google, the all-grabbing data company.

    And now it's even worse.

    Do not endorse reCAPTCHA. Don't put it on your website.

  • This has been a war over user rights to "camouflage". Google and other ads-funded corporations have feared the "false positive", the background-running random search engine. The recent "are you human" captchas come when I'm not even running an anti-phorm, so I guess I have to prove I'm human because my searches appear to be non-sequetors to Google (though they are not, to me). x2010 http://retroworks.blogspot.com... [blogspot.com]

  • There goes anonymous browsing (Score:5, Insightful)

    by cfalcon ( 779563 ) on Thursday March 09, 2017 @10:11PM (#54010671)

    The current "identify some bullshit" captchas can be done without javascript. This seems unlikely to have that failsafe. It will be a wad of purposefully hard to reverse engineer javascript, probably with some timing crap to make it hard to do anything with, and that will be that. It will of course ultimately end up generating telemetry.

    I sound pessimistic, but this has been the direction we've been heading for some time.

    • Re: (Score:1)

      by Anonymous Coward

      Timing? It could be worse.

      Mouse movement cadence. Path eigenmodes and entropy. OS and browser fingerprinting. Render fingerprinting. Anti-fingerprinting fingerprinting. Cross-correlation with thousands of other features Google already knows about.

      The human as an autonomous and free agent is over. You're a product.

    • Re: (Score:3)

      by jbn-o ( 555068 )

      Perhaps this is the latest PR initiative to try to get the public to defend "invisible" spying. Google makes considerable money and maintains relationships with powerful organizations on the basis of spying. Spying is very much a part of Google's business. Google could probably use a way to get more people to (even indirectly) defend Javascript-based spying by turning the public into ignorant supporters who say things like 'We *need* this invisible reCAPTCHA' when we could actually choose to do without it.

      W

    • If this requires javascript, then every site that uses it will lock me out.

      I use noscript. I am willing to go without any information from anyone else, forever, as long as requiring a script to run is part of the deal.

      Executing logic on MY computing device, is purely at my discretion. I am unsure why anyone else feels they have a right to require me to execute logic. Perhaps if they asked, I might agree, depending on the other details in the deal. If it is required up front, then they have my denial up fron

  • "Yes, I am a robot, but I'm not going to take your job."

    • Re: (Score:2)

      by lgw ( 121541 )

      Read this yesterday and just now got the joke. So, LOL. Never change your sig - that show was awesome.

  • reCAPTCHA is useless.

    There are other very reliable ways of catching automated bots. They are stupid, and make many mistakes that are easy enough to catch even without Javascript.

    The real issue is firms hiring people for less than a buck an hour to spam crap. It's impossible to stop without impeding real users... so where do you draw the line?

    As it is reCAPTCHA gets in the way more than it should. You're probably better off without it.

    • Common spambots that submit contact forms are easy to catch. Advanced registration bots targeting major websites, not so easy.

      The amount of paid human spam is minuscule compared to the automated kind, so it's much easier to handle manually.

      • Having been in web development for over 15 years, I can tell you there are some very reliable ways to catch any kind of form submission SPAM.

        As stated, there is a point where the bots are not possible to catch, as they emulate exactly how people do it (or they are paid spammers).

        You come to a point of diminishing returns, and start to irritate real users.

        CAPTCHA's are a bandaid solution for lazy developers.

  • "don't expect details to pop up any time soon", LOL anyone else smell the bullshit here. basically with a few days of this being available you will see published tear downs of it and proposals to work around it.

  • Wikileaks told us how. (Score:1)

    by Anonymous Coward

    New captcha uses you computer, phone, tablet, or TV's microphone to listen for your breathing to see if you are human :-).

    • Re: (Score:1)

      by Anonymous Coward

      You say in jest, but I give it five years.

  • Flagging you as a robot incorrectly would be less of an issue if it was just Google doing it.

    Unfortunately, lots of other websites use the API. There are plenty of Wordpress plugins that add Google's recaptcha to comment forms and I've seen it elsewhere.

    It could become a de-facto standard and at that point the issues - in particular for accessibility - become critical. If it's more likely to pop up if you're disabled and using things like screen readers then it's discriminatory.

    If nothing else, it'll be som

Slashdot Top Deals

Think of it! With VLSI we can pack 100 ENIACs in 1 sq. cm.!

Close