Research Findings:
- reCAPTCHA v2 is not effective in preventing bots and fraud, despite its intended purpose
- reCAPTCHA v2 can be defeated by bots 70-100% of the time
- reCAPTCHA v3, the latest version, is also vulnerable to attacks and has been beaten 97% of the time
- reCAPTCHA interactions impose a significant cost on users, with an estimated 819 million hours of human time spent on reCAPTCHA over 13 years, which corresponds to at least $6.1 billion USD in wages
- Google has potentially profited $888 billion from cookies [created by reCAPTCHA sessions] and $8.75–32.3 billion per each sale of their total labeled data set
- Google should bear the cost of detecting bots, rather than shifting it to users
“The conclusion can be extended that the true purpose of reCAPTCHA v2 is a free image-labeling labor and tracking cookie farm for advertising and data profit masquerading as a security service,” the paper declares.
In a statement provided to The Register after this story was filed, a Google spokesperson said: “reCAPTCHA user data is not used for any other purpose than to improve the reCAPTCHA service, which the terms of service make clear. Further, a majority of our user base have moved to reCAPTCHA v3, which improves fraud detection with invisible scoring. Even if a site were still on the previous generation of the product, reCAPTCHA v2 visual challenge images are all pre-labeled and user input plays no role in image labeling.”
I always thought they are just getting the training data for AI using these.
I thought the whole point of reCaptcha was to provide a reliable set of data to train bots. Entering a fuzzy scanned word, identifying bikes and traffic lights, etc.
The fact that they’ve now got that, and the bots are trained is hardly a surprise.
Without captchas the problem of spambots would still be a million times worse.
Yup. I like Cloudflare’s checkbox, it works well and probably catches more bots than reCaptcha while being simple for humans.
How does that checkbox work? Does it just look at your cookies?
No, it tracks things like mouse movements to see if it looks human or like a bot. Humans don’t move the mouse in a straight line, there’s some jitter and whatnot, whereas bots will look quite a bit different.
That’s super easy to fake for a bot…
It’s a ton more than mouse movement. Lots of browser fingerprinting for example and tracking.
Yup. It does do a lot more than the checkbox, but the checkbox itself mostly does mouse movement and click tests.
We already knew that, but it’s nice re to have data.
reCAPTCHA v2 visual challenge images are all pre-labeled and user input plays no role in image labeling
That’s funny, because when I’m faced with this, I keep adding/removing one of the image randomly and it keeps accepting them as ok.
I like this strategy.
I thought it was detecting bots based on how you are moving your mouse, etc to solve it, but if they can be solved by AI do they want their AI trained by other AI?
Alright, I don’t use google.com
Sites you visit use Google, their recaptcha, their analytics, their ads.
But you might still be using their captcha
They were using us to label the data.
That’s why you always make sure that labeling is “garbage in” and label whatever
The objective of reCAPTCHA (or any captcha) isn’t to detect bots. It is more of stopping automated requests and rate limiting. The captcha is ‘defeated’ if the time complexity to solve it, whether human or bot, is less than what expected. Now humans are very slow, hence they can’t beat them anyway.
There are much better ways of rate limiting that don’t steal labor from people.
hCaptcha, Microsoft CAPTCHA all do the same. Can you give example of some that can’t easily be overcome just by better compute hardware?
The problem is the unethical use of software that does not do what it claims and instead uses end users for free labor. The solution is not to use it. For rate limiting a proxy/load-balancer like HAProxy will accomplish the task easily. Ex:
And what will you do if a person in a CGNAT is DoSing/scraping your site while you want others to access? IP based limiting isn’t very useful, both ways.
I thought captcha’s worked in a way where they provided some known good examples, some known bad examples, and a few examples which aren’t certain yet. Then the model is trained depending on whether the user selects the uncertain examples.
Also it’s very evident what’s being trained. First it was obscured words for OCR, then Google Maps screenshots for detecting things, now you see them with clearly machine-generated images.
[…] reCAPTCHA […] isn’t to detect bots. It is more of stopping automated requests […]
which is bots. bots do automated requests and every automated request doer can also be called a bot (i.e. web crawlers are called bots too and -if kind- also respect robots.txt which has “bots” in its name for this very reason and bots is the shortcut for robots) use of different words does not change reality behind it, but may add a fact of someone trying something on the other.
There isn’t a good way to classify human users with scripts without adding too much friction to normal use. Also bots are sometimes welcome amd useful, it’s a problem when someone tries to mine data in large volume or effectively DoS the server.
Forget bots, there exist centers in India and other countries where you can employ humans to do ‘automated things’ (youtube like count, watch hour for example) at the same expense of bots. There are similar CAPTCHA services too. Good luck with those :)
Only rate limiting is the effective option.
Only rate limiting is the effective option.
i doubt that. you could maybe ratelimit per IP and the abusers will change their IP whenever needed. if you ratelimit the whole service over all users in the world, then your service dies as quickly into uselessness as effective your ratelimiter is. if you ratelimit actions of logged in users, then your ratelimiting is limited by your ability to identify fake or duplicate accounts, where captchas are not helpful at all.
at the same expense of bots. they might be cheap, but i doubt that anyway, bots don’t need sleep.
i was answering about that wording (that captchas were “not” about bots but about “stopping automated requests”) and that automated requests “are” bots instead.
call centers are neither bots nor automated requests (the opposite IS their advantage) and thus have no relation to what i was specifically saying in reply to that post that suggested automated requests and bots would be different things in this context.
i wasn’t talking about effectiveness of captchas either or if bots should be banned or not, only about bots beeing automated requests (and vice versa) from the perspective of the platform stopping bots. and that trying to use different words for things, (claiming like “X isn’t X, it is really U!”* or automated requests aren’t bots) does not change the reality of the thing itself.
*) unrelated to any (a-)social media platform
stopping automated requests
yeah my bad. I meant too many automated requests. Both humans and bot generate spams and the issue is high influx of it. Legitimate users also use bots and by no means it’s harmful. That way you do not encounter captcha everytime you visit any google page, nor a couple of scraping scripts gets a problem. Recaptcha (or hcaptcha, say) triggers when there is high volume of request coming from same ip. Instead of blocking everyone out to protect their servers, they might allow slower requests so legitimate users face mininimal hindrance.
Most google services nowadays require accounts with stronger (like cell phone) verification so automated spam isn’t a big deal.
since bots are better at solving captchas and humanoid services exist that solve them, the only ones negatively affected by captchas are regular legitimate users. the bad guys use bots or services and are done. regular users have to endure while no security is added, and for the influx i guess it is much more like with the better lock on the front door: if your lock is a bit better than that of your neigbhour, theirs might be force-opened more likely than yours. it might help you, but its not a real but only relative and also very subjective feeling of 'security".
beeing slower than the wolves also isn’t as bad as long as you are not the slowest in your group (some people say)… so doing a bit more than others always is a good choice (just better don’t put that bar too low like using crowdsnakeoil for anything)
the bad guys use bots or services and are done. regular users have to endure while no security is added
put in other words, common users can’t easily become ‘bad guy’ ie cost of attack is higher hence lower number of script kiddies and automated attacks. You want to reduce number. These protections are nothing for bitnet owners or other high profile bad actors.
ps: recaptcha (or captcha in general) isn’t a security feature. At most it can be a safety feature.
I bypassed 35000 google recaptcha v2 using bots. Don’t ever rely on this for security
Where can I learn this power?
I just spent 3$ worth of bitcoin on NoCaptchaAI. I used their web extension on a server which had a browser opened and controlled by a custom webextension I made so that a solved challenge would be returned to a swarm of clients upon request
Your extension is archived, I’d rather not use it.
It’s a custom extension solving my very specific problem on a specific internal website. It was never meant for you to use it, it’s just there to serve as inspiration to others
It is neither intended nor even stated to be intended for security.
Except, that’s most of its ad copy on Google’s own website?
reCAPTCHA uses an advanced risk analysis engine and adaptive challenges to keep malicious software from engaging in abusive activities on your website. Meanwhile, legitimate users will be able to login, make purchases, view pages, or create accounts and fake users will be blocked.
It’s literally billed as a security measure for a website.
I see your perspective, but I don’t consider that security in the context of software, which may also explain why they don’t use that word, though I readily admit that it is technically security of a sort. The term usually implies authentication, authorization, and isolation.
I mean, except they do. Just because their simple ad copy omits it, doesn’t mean that’s not what they’re implying. It’s literally listed as one of their security products and also uses the term to talk about demos
I’m sorry I wasn’t more agreeable. You’re absolutely correct. I take it back.
I kinda figured. It was annoying to do one, but then they wanted you to do two or three and that’s absurd. Whenever it comes up now, I usually just close out.
Im surprised that this is in the news right now. This has been acknowledged as fact for a decade or so.
Relevant 1053
I still don’t get this one even after being linked to it so many times 😌🤣
Someday you will, and you’ll be one of the lucky 10.000 that day.
😆👌🏻
Things that are common knowledge for you is not common knowledge for everyone and vice versa.
Instead of making fun of people for not knowing things, you should take the opportunity to teach so that you can get these fun moments of discovery and learning.
😮l made fun of people that did not know something?
No, I explained what the comic is trying to convey.
Just answering your question.
❤️
Some captchas have also just gotten obvious AI training. “Click on the living being in this image”, “Select every image of the same object as in this example image”. And the images you have to select look obviously AI generated.
Heh, I got one just the other day “Select the images containing structures built by people” lmao
“click on all people not helping with the robot uprising”
Alas, I have but one up-vote. :~(
Funny thing is they stop asking if you do them really slowly. Almost as if to tell you, you‘re too inefficient to even be an unpaid intern or something. Anyway, if they annoy you, take your time.
they wanted you to do two or three and that’s absurd
Yea how about 20
if you have to do that many, you either have some privacy setting on or on a flagged ip given from a VPN
Yeah exactly
Or google knows you will out up with it and want the most interaction it can get from you.
Google’s just lonely 🥺👉👈
Well yah of course I do. Why the hell is that ‘abnormal’?
its abnormal to them because vpns are often also used by bad actors. your use is not abnormal but its a there are other people misusing it making it worse for everyone else.
Wow, way to blame individuals who take basic precautions instead of the corporations who are blantly invading your privacy. Good job making the world a better place, bud.
Most people don’t, most bots do. You look more like a bot, so you get extra challenges.
Stop using Tor…
VPN? Google will just go in a loop with these things, so I just stopped using Google completely.
No. But it’s also not like I get 20 constantly, it was just the worst I’ve seen. Usually it’s 2 to 5, I think.
I assume they’re just collecting data on how many are users willing to do.
One time I did five in a row, because I use VPNs for everything, and realized after the 5th time that it would have been easier to just use bing so I do that first now. Google has turned into my last last resort, which is quite funny, because that’s where Bing used to be. Lmao
Whenever I’m on a private window the captchas just keep on coming. Trying to reset your Steam password via the program will also trigger an infinite loop of captchas, you HAVE to use a browser.
I tried to order some components on Digikey a few months ago and I’m still mentally scarred. Probably did a few hundred of those things over the course of 2 weeks.
STOP BEING SNEAKY MICHAEL
That’s because you’re shady.
Had this when at uni, mostly due to the amount of requests coming from a single IP
They knew I was committing crimes with my adblocker.
The worst kind - crimes against profit!
Elon musk wants to know what the government is going to do about you not viewing ads on Xitter
Not going to his shithole website.
Cries in battlenet sign up process
The one reason I tried to create an account and never came back
At a certain point I did like 10 of them, and then ended up closing the page, cause it never let me in, all because I was on a vpn
Does this work?
I tried it before. It worked for me on one small game website for account creation. After that it was more or less useless on any other site. It has a weird focus thing where it’ll try to solve the captcha before you can enter in login details so if by chance the extension works, you’ll fail the login anyways.
It still needs work. I think if the dev can work out those issues it could be great. Until then, it’s pretty much worthless.
Judging from the reviews, it doesn’t
Ah, right, there are reviews too.
The conclusion can be extended that the true purpose of reCAPTCHA v2 is a free image-labeling labor and tracking cookie farm for advertising and data profit masquerading as a security service,” the paper declares.
I thought this was known since it came out. It seemed even more obvious when the images leaned in heavily to traffic related pictures like stoplights.
I had to deal with one yesterday that wouldn’t let me in no matter what I did.
So it isn’t even good at figuring out who isn’t a robot.
Solving too fast. I shit you not. Sometimes you have to go really slow. Like you’re 80 and can’t see very well trying to discern what’s in those boxes.
I will gladly solve a reCAPTCHA for you today if you pay me for it today.
There’s platforms that do that.
I can pay a service to auto solve captcha and anything that can’t be solved will be pushed to a human to solve.
Never actually used it but it was interesting learning it existed
Getting served a captcha often results in me closing the tab. I’m not doing stupid puzzles for you.
I haven’t done an image one in years for the same reason.
My general internet usage has plummeted between ads and captchas and all the other modern website bullshit, which is why I am here so much.
Do them wrong and then close out
I do it right and it says I’m wrong =\
I have bad news for you friend…
You might be a robot
What do you mean? I am a fleshy human and do fleshy human things like being made of flesh.
Ever heard of bio-robots?
Time to take a knife and check for sure
Seriously /s Don’t harm yourself!
It knows they’re wrong which is why I don’t really think this article is accurate. Is it training if it already has the answers? Probably not.
My understanding is different from others here. I thought they served the same Captcha to many people at once and use the majority response to decide who is answering correctly.
That’s true, or at least it used to be back when they were using it for OCR. I have no reason to believe it’s changed.
That’s why it gives you a panel of 9 images. It had a high confidence on some images, and a low confidence on others. When you pick the correct images and don’t pick incorrect ones it uses the ones it’s confident about as “validation” while taking the feedback on low confidence images to update the training data.
What this means is that only ones actually being “graded” are the ones bots can solve anyway.
and it will show the images to multiple people
It’s why they ask you to do multiple, 1-2 of them are the control group, they are training on the others
You’re implying they give you multiple. I hardly ever get multiple, pretty much only if I ‘fail’ the first one.
If they have a good fingerprint on you they don’t need the control group. That’s why you get 5+ captchas when using a VPN/tor.
