Hacker News new | past | comments | ask | show | jobs | submit | page 2 login
Google's Captcha in Firefox vs. in Chrome (grumpy.website)
1343 points by kojoru 36 days ago | hide | past | web | favorite | 482 comments



The slow animation is the worst. You really want to punch someone responsible in the face.

And I never figure out how to solve the traffic light riddle.


The worst part about the slow animation is that when an image you've clicked is fading out, you might think you've completed everything and then click the "Verify" button at the bottom. But then that causes you to have to restart if that wasn't the last image. This is the part that convinces me that ReCAPTCHA was made to fuck with people.


I've never understood why they don't just say what you're supposed to select - it it just the lights, or the poles too? What if part only enters a box by a few pixels? Just tell me what you want, dammit!


You're not supposed to figure out the traffic light riddle, you're not a human if you do.


Yes, it's the most obvious internet rage trigger.

But I can't figure out why they make a 'delay'? Why not just show the next dam image?


To make it more expensive for bots to try this at scale, obviously. Unfortunately it's making it more expensive for humans too.


you may be right about the fade-out and delay but the time spent fading in only hampers humans not bots. As soon as it starts fading in the image is present in non-faded form and the bots can start processing it.


You realise you've just described why this would distinguish between bots and humans.

(And yes, I'm also driven to rage by slow-fade animations. A practice I can date back to Microsoft's Clippy, which, when you punched it in the fact to go away, had just one more gratuitous animation just to twist the knife that just more.)


No, it doesn't help distinguish the two, because this check can be easily circumvented by adding a small, random delay.

To reiterate: the primary goal seems to be slowing down bots.


But does it slow the bot down in a meaningful way?

If you have one IP, there's a limit on captchas solved that you're going to blow through with or without the delay.

If you have a bunch of IPs, you can multithread the solving.


> the time spent fading in only hampers humans not bots

Not necessarily, contrast adds detail and mistakes are expensive, so bots too are incentivized to wait for the final picture (this assuming that network communications aren't monitored to get the incoming image out of the request).

Also clicking on that image too early is a good signal that it's a bot.


The bot presumably is running in something like chrome headless or selenium (if you're processing JS), so it would have access to the image the moment the response is received.

Unless Google is literally streaming in the image frame-by-frame, I'll admit I haven't looked into the details but this doesn't seem likely as it's pretty complicated compared to just using an image.


The bot would just read the unfaded image from the DOM.


> Clicking the image too early is a good signal that it’s a bot.

The fade in is actually a nice gesture to the human to show them that an image will be there soon, while still slowing them down to rate limit the bots.


I don't agree that's it.

... it really doesn't make it that much more expensive for bots, it's just a short delay. In fact, I doubt it makes a difference at all.

But it makes things really annoying for humans.

So I don't see any advantage in that trade-off.


Include the traffic light poles.


I've never included the traffic light poles.


If I don't include them, I get asked more. (Or occasionally 'select ALL the...'.) If I include them, it usually goes away.


I don't include the poles, how about wires? What about pedestrian lights, are they "traffic lights"?


While relatable, this is just a low effort post more suited for Twitter or Reddit.

For a fair comparison OP would need to use clean browser profiles on fresh IPs. Like this it is just fan-service for Google Captcha victims (like me).


FWIW I encountered the same problem this weekend. On a fresh Firefox profile (no prior browsing activity), reCAPTCHA just wouldn't let me log in to a website! Out of curiosity, I wanted to see how long they deny me -- well over ten minutes before I gave up in shock and horror.

It felt like staring into the soul of evil.


This is a common problem with FF if you have any privacy settings enabled. ReCAPTCHA does deep fingerprinting. If you block that fingerprinting it punishes you.


If you come up with another way that is as effective in an ever growing world of bots trying to break anything in their way, I would love to use it.

I've had to pay 100x bills on my monthly quota once too often, and as a hobby developer, I just can't afford trying to fight off people abusing my website every day.

Yes, resorting to fingerprinting is not ideal, but what's better, asking everyone to solve that hard captcha, or only some users?


Considering how easy it is to use real chrome with puppeteer, I'm inclined to not give the benefit of doubt on this one to google.

In the end, a custom captcha is probably a better solution, even if it is easier than google's.


Use self-hosted CAPTCHA with simpler solutions. They still keep out the stupid bots that can't get past ReCAPTCHA.


> Use self-hosted CAPTCHA with simpler solutions

My favorite CAPTCHA is the one on the Arch Linux forms but I realize this cant be used many places. > What is the output of "date -u +%V$(uname)|sha1sum|sed 's/\W//g'"?

Easy to do but hard to do with computers. My second favorite are the math problems one.

However if these become popular people will just write bots for them and were back to square 1.


> > Use self-hosted CAPTCHA with simpler solutions

> My favorite CAPTCHA is the one on the Arch Linux forms but I realize this cant be used many places. > What is the output of "date -u +%V$(uname)|sha1sum|sed 's/\W//g'"?

> Easy to do but hard to do with computers. My second favorite are the math problems one.

> However if these become popular people will just write bots for them and were back to square 1.

Interesting...I wonder if they show destructive commands below a certain threshold. It would be funny if a captcha caused a bot to delete itself.


It would not be funny if even just one person ended up with that so I hope not. A bot would not end up in that situation anyways, either the earlier commands were already evaluated or your proposed remote kill would also not work.


Surely the same is true if you block these things in Chrome?


I kept looking for the article. Surprised to see such a low-effort post submitted to HN.


Users have the option to flag submissions


Okay, I will flag it. This submission still received almost 400 comments. That's pretty disappointing.


How can you have a fresh IP which isn't in your control?


Many of us have control of our IP Address within a certain range. In fact I have to specially request a static IP and pay money for it. A dynamic IP that changes when I refresh DHCP on the edge router is free.


> A dynamic IP that changes when I refresh DHCP on the edge router is free.

But you don't know who had it before you, what Google thinks of it ("known Spammer", "legitimate User") etc, so that's not going to help in this case.


Maybe try buying up some unclaimed IPv6 space and test from there?


The slow reloading of images is just intentional harassment. There's no other explanation I can think of.


I disagree about the more appropriate for Twitter/Reddit than HN. But that's because my immediate interpretation, while not spelled out in the "article", was within the context of anti-competitive behavior by Google in making non-Chrome browser perform more poorly with google-created content.


The topic itself is definitely super interesting and relevant. But the submitted post is pretty much a meme.


That's a good idea for a research paper. Not something I'd OP though :-)


being logged into gmail and the status of that account affects captcha as well


Not only that, you need to run multiple trials and average them. The post obviously picks the slowest most painful instance of a reloading captcha, where they got really unlucky. I've had those slow captcha's on Chrome too, they are not inherent to the browser.


FYI. Title is misleading. This experience has nothing to do Firefox vs Chrome. Result is because of 3rd party cookie and tracker blocking. I had same and even worse (I was not able to get through captcha) experience on chrome itself because I have 3rd party cookies disabled and couple privacy oriented extensions running.


No, I believe it is because the Chrome as a browser works in conjunction with Gmail and other google properties' logins to kinda figure out that you're a human.

One of the things, if it ever gets there, would be for the anti-trust probe, if any, to look at how Google shares data between its browser, Chrome, and it's other services.


How would the website code communicate with the browser, unless it was some open API you can refer to. As for "in conjunction with Gmail", yes that's called cookies.


Goole websites (and frames in other websites) share information with Chrome browser. That's what the Chrome Login brouhaha was all about.


From my understanding, that's just expanded cookies. The Chrome frame can see the cookie from your Gmail, and also log you in the browser, and vice versa. Nothing magical going on, just cookies.


This! I have a Chrome development profile which I primarily use for testing. When I encounter a captcha it's the same painful experience as the OP's FF video. I don't have restrictions around cookies or tracking either. My best guess is that I just don't have as much "usage history" on that profile for Google to just declare me clearly human. Alternatively, on my main profile that I use for normal browsing captcha (which it still sucks) is never as painful.


But I never touch cookies in FF and never install any privacy features. I have been facing the same for years.


This cannot be entirely correct as I use Chrome and Firefox with as close as possible configuration, with uBlock Origin with exact same settings, and the behaviour I've encountered is very similar to the one shown here. I'm logged in to my google account in both browsers as well.


Probably you are right. I use tracker and 3rd party cookies blocking in FF and I often spend 30-60 seconds solving captchas. Often Google says that I solved it wrong (although I try to be careful) so I have to solve it 3-4 times, sometimes with those slowly appearing images. Upgraded my skills of recognising bridges, buses and fire hydrants but still struggle with searching storefronts.


Your comment is correct, Firefox now blocks trackers and it's probably, and hopefully, blocking whatever recaptcha uses to determine you're not a robot. So using firefox you get the harder recaptcha because it's blocking Google from spying on you.


reCAPTCHA needs to be re-engineered to work even in the face of privacy measures in browsers. Otherwise it will be better at distinguishing expert humans from ordinary humans than at distinguishing bots from humans.


I'm sure there's room for improvement but at some point this is paradoxical. Users who want data privacy want their presence and behavior obfuscated, which is fundamentally opposed to anti-fraud systems which are designed to analyze the presence and behavior of users to determine if they are fraudulent.


The way recaptcha happens to work now, and its purported goal - to differentiate humans from bots - are two different things. Privacy is not fundamentally opposed to anti-fraud in the slightest.


I said that privacy is fundamentally opposed to anti-fraud systems, not the general concept of anti-fraud. To an automated anti-fraud system, there is no difference between a user who obfuscates their identity because they want privacy and a bot who obfuscates its identity because it doesn't want to be revealed as a bot.


The user is complaining about the slow CSS animations. It's definitely a bug though not something they did on purpose. I remember having the same issue on Chrome as well.


IIRC, it is something they do on purpose, to make it clear to the user something is happening while rate-limiting challenges given to the user.


Oh no Google ReCaptcha doesn't work that way. In case of rate limiting, they will just throw an error. It's probably some clever JS or CSS that got a bug in it. Here's the official thread on GH: https://github.com/google/recaptcha/issues/268

Disclaimer: We built a solution at SerpApi.com to solve those offline using ML. Timing of solving doesn't matter. It will be odd that they do that just to annoy user when it's not a technical limitation.


They’re slow because it’s live-challenging two or more recaptcha users at once with an unknown image, right?


It's not a bug. Its part of a patent Google holds designed at frustrating access for bots.


I'm from the UK and often get very American questions. Such as "select all the images with cross-walks". This isn't really a phrase we have over here, so when I first got this I had no idea what I was meant to be looking for in the array of random pictures and actually had to look it up to get past it. If you're going to force me to do a captcha, at least localise the damn questions.

Do other non-American's get this as well?


American storefronts are always an interesting guesswork for me. "Is this a rundown shack or an actual store?"


Or fire hydrants, which don’t exist in the NL. I only recognize those from US movies. Or taxi’s which can be any brand, model or color here. Sigh.


American here: I when given the challenge of "select all the images with storefronts", typically they are not US based. I almost never speak/understand the language, but if there's a big sign on the building, I select it because it's most likely a storefront.


They're zebra crossings, but I suppose you know that by now.

The captchas are completely non-localised as far as I can tell; as others have pointed out the 'store-fronts' tend to be non-American.


Generally it's not too hard to find something in a picture that is from another country, but the actual request text should really be localised. I usually go for the audio ones now though rather than the visual ones.


Another Brit here, and yes this does annoy me a bit.


I believe this is part of a greater Google strategy of using their monopoly power.

I’ve noticed that in the last week, Google no longer provides a link to the non-amp version of pages. Previously, you could press two button taps to get to the non-amp page, but now that ability has been removed. This sucks because Amp doesn’t always support all the features of a normal site, like Reddit or blogs (commenting).

I worry how Google will abuse this in the future. Right now they control the first page you visit after leaving Google through AMP, but you can usually find a link to the home page of a site. In the future, they may restrict it further.


For Google Recaptcha, I use GreaseMonkey with an user script:

"Speed Up Google Captcha"

"Makes Google Captcha works faster by removing slow visual transitions and unnecessary delays."

https://greasyfork.org/en/scripts/382039-speed-up-google-cap...


I'm really surprised that works, as I assumed the delay was random and it was looking for bots who were completing the image processing before the image has actually faded in. Huh.


Ha! Been there, done that. I registered with Patreon (using Firefox), then tried to login (using Firefox) after verifying my email address. Nineteen (19) Captcha screens later and I gave up. Seriously. Bastards (and apologies to the Creatives I was trying to contribute to).


As a developer who has worked with reCAPTCHA in the past and as a diehard Firefox user, what likely happened here is a form of shadow banning.

You're moving too fast; your mouse and mouse clicks are "too good" to be human. Try solving the reCAPTCHA slower and you'll see wildly different results, or, purposely fail one reCAPTCHA to get easier ones.

reCAPTCHA tech is crazy; reCAPTCHAs are not simple web forms and Javascript, they're a sandboxed and monitored 'window' to a Google server. If you solve too many reCAPTCHAs too quickly (ie. when you are testing a web page, or are rotating your passwords on many websites) then Google's servers will try to rate limit you with slow animations and harder reCAPTCHAs.


> reCAPTCHA tech is crazy; reCAPTCHAs are not simple web forms and Javascript, they're a sandboxed and monitored 'window' to a Google server. If you solve too many reCAPTCHAs too quickly (ie. when you are testing a web page, or are rotating your passwords on many websites) then Google's servers will try to rate limit you with slow animations and harder reCAPTCHAs.

Google should absolutely not be in a position where it can be inadvertently rate limiting your attempts to rotate passwords on different websites across the internet.


The fire hydrant example... I deal with this every day. It takes soooo looooong to load, it's really ridiculous.


There have literally been times where I debated whether or not I wanted to purchase something because of the knowledge that I would have to solve Google's captcha. Humble Bundle, in particular--the login process for me (due to uBlock+uMatrix installed) is like this:

1) Try to login

2) Login doesn't show up--go to uMatrix and whitelist some crap.

3) Try to login again.

4) First phase of login completes, now blank when site tries to load Google captcha.

5) Whitelist Google captcha frames in uMatrix and reload again.

6) Login for the third time, Google captcha now displays properly.

7) Spend 10 minutes solving captchas. If I'm lucky, the first "Verify/Submit" will work. If not, I probably need to whitelist cookies for it within uMatrix and reload/try again.

8) Get notification from HumbleBundle that "You have not logged in from this browser before" and wait for a Verification email to hit my inbox.

9) Enter verification code. Site usually then logs me out for some reason, even though it was successful.

10) Login again. Solve Google Captchas again. Finally allowed to login.

11) Finally buy the goddamn thing I was there to buy.

12) Search Amazon for wig.


>Humble Bundle, in particular

Funny you should mention that, I actually wrote an email to support asking them to have frickin mercy with the google captchas. The response was as you expect "we do this for safety and protection, yada yada" which to be fair, I obviously didn't expect them to change anything, although I hope it did help raise some awareness.

The interesting thing I got out of it was that they mentioned that google captcha for logging in is disabled so long as you have 2FA activated on your account, which certainly helped, at least a little bit. You do still have to use the captcha to buy anything from the bundle (at least if you're using something like paypal, anyway).


I've emailed them about it as well. Totally sick of having to grind through Google to sign in to HB, I've not bought stuff because of the effort too. I also really don't think it's appropriate to include Google as a third-party in login processes anymore.


I wrote to them asking to close my account for exactly the same reason. Recaptcha was making me less inclined every visit to buy something.


It always amazes me that companies, especially those that know their audience is tech savvy, don't test their sites/shops/systems with common things like ad blockers or privacy plugins. I often run into hidden problems on sites that go away after I allow some third party domain.

I wonder if it's just incompetence at the developer stage or a management decision to annoy users that have ad block etc. Neither really makes sense, I'm a paying customers, they shouldn't take it personally that I don't care for ads, and they are multi-million (or even multi-billion) companies, surely somebody there knows that ad blockers exist.


I _have_ multiple times walked away from a purchase due to reCAPTCHA at the login form (Sony - PSN). It makes me think "You know what, this isn't worth it", and I don't want to help Google out anyway.


I tried sending an email on their support page to complain about it as they are likely losing customers like me but it was behind a captchas and I gave up.


I'd be cool with it if it didn't fade out the selection and load new images. Fine, you want to do that, Google? I think some of these other images are hydrants, too!


The point of the challenge isn't really to get the "correct" answer. It's for the captcha to be sufficiently confident that you're a human.


I face that example everyday too. I'm really curious this does not appear in Chrome.


It does. I've run into it plenty of times with chrome.


The Google captcha enrages me. Why should I train their stupid AI?


there are updates coming that will make it much more tied to your google account. i fear that it will mean anybody not currently logged in is assumed to be a robot. (even more so than now, i mean.)


ReCAPTCHAv3. It will differ from ReCAPTCHAv2 in one important respect: it will no longer ask you any questions, meaning it will no longer give you the opportunity to appeal it's snap judgement of you.

https://developers.google.com/recaptcha/docs/v3


> "reCAPTCHA v3 will never interrupt your users, so you can run it whenever you like without affecting conversion. reCAPTCHA works best when it has the most context about interactions with your site, which comes from seeing both legitimate and abusive behavior. For this reason, we recommend including reCAPTCHA verification on forms or actions as well as in the background of pages for analytics."

Just what the world needs, another tracking script...


According to the recent Planet Money podcast on Captcha, the upcoming changes will only use the signal of whether or not you have an account, and not any account-based data, since it will be domain based on the website or something.

Also, they're doing away with the questionnaire. It works by using a scoring system or something similar since it loads on the pages leading up to form fills.

Edit: Source for you disbelievers - https://developers.google.com/recaptcha/docs/v3

>reCAPTCHA v3 returns a score for each request without user friction. The score is based on interactions with your site and enables you to take an appropriate action for your site.


> It just "works" by default.

right. until it doesn't, like it wouldn't for someone who actively avoids feeding their personal information to the goog. and it is sounding an awful lot like the fail case is full denial of service, without any option for the user to prove themselves.


>the upcoming changes will only use the signal of whether or not you have an account, and not any account-based data

Recaptcha doesn't care. But totally unrelated, it just accidentally worked out to be awfully convenient for Google's other surveillance products embedded on the same sites, which do care quite a bit about how long and how often they can follow me with a single unique identifier.


You still believe PR fairytales?


And the alternative is believing something else with no evidence. Is that better?


I use https://github.com/dessant/buster to avoid captchas and swear by it. It uses google's speech to text to transcribe the captcha audio element, and posts it back as an answer so you don't have to do the annoying images.


Because you're not providing advertising revenue as a non-chrome user ;)


To provide compensation for the websites use of their free, and effective, service designed to combat bots?


What's funny is that the AI needs to be trained...yet it already knows which choices are correct and incorrect. So, is it really necessary?

Edit: This is a joke, I am joking.


I don't know how the image captchas work but the old-fashioned type-the-words captchas asked you one it knew the answer to and one it didn't. By giving unknown words to multiple users and finding a consensus they could move words from the unknown to known set.


If they do it the way that the OCR recaptcha works, it allows some new ones to go through and uses consensus to classify them.

So most of them will have already been classified and those are used to test your integrity (and verify you) but an occasional new one will be presented that won't count towards your verification and if enough people agree on it it'll be classified.


I suspect it knows the correct choices for some of the little pictures it shows you, but for others you are training it.


This is the natural question to ask. I finally decided that they probably compare your answers to several other humans to validate training data.


> Edit: This is a joke, I am joking.

The voters seem to have formed a consensus that it was not a joke, unfortunately, so your humor has failed the test.

(This was a meta-joke, and I too am joking.)


I find it incredible that modern reCAPTCHA exists and is legal.

Aside from the the obviously concerning censorship that happens if you try to access reCAPTCHA-locked sites over Tor, it is literally forcing internet users to do free labour for Google so that can train their AI for whatever project they're doing.

So not only is it a tax on using the internet (paid in seconds to minutes of human existence each time -- I bet reCAPTCHA has collectively cost humanity thousands of lifetimes of wasted effort solving stupid puzzles) and it creates censorship, it also is an act of charity on our part that we provide Google free work with no benefit for ourselves. Given that they literally pay people to do (something similar to) what we are doing for free, I wonder it there are labour law arguments to be made (we aren't paid anything for this work which Google clearly is willing to employ people to do).


You're barking up the wrong tree here. reCAPTCHA is a free service that developers implement. If you don't like that, complain to them. Companies aren't compelled to use Google services - they have no choice because the bot issue is untenable without it.


Yes it's a free service which developers choose to use (though many sites use it without knowing through CloudFlare), but that doesn't change the fact that Google has decided to use it as a method of getting free labour out of internet users.

reCAPTCHA used to be far more reasonable and ethical when it was being used to digitise books. And when you got reCAPTCHA'd constantly as a Tor user, it wasn't so bad. These days I have to spend several minutes of my life giving training data to Google on every site which uses reCAPTCHA, with nothing in return except for the privilege to be able to access the internet.


This is the experience with the `privacy.resistFingerprinting` flag set to true. A while back I made a few try to see how the behavior change with different settings and extensions, you can see the result here: https://github.com/google/recaptcha/issues/268#issuecomment-...

I solved the problem by using an extension that toggle that flag: https://addons.mozilla.org/en-US/firefox/addon/toggle-resist...


When confronted with reCAPTCHA I always switch to the audio-version as that:

- is generally easier to solve (download the sound clip using curl or wget, type in the nonsense it says, done)

- does not turn me into a mechanical Turk training Google's AI

- works in 'any browser' by circumventing the browser (by using wget/curl), thereby not allowing Google to punish me for not using their dragnet/browser.


> does not turn me into a mechanical Turk training Google's AI

I’ve been wondering about that. Are you sure you’re not training their speech recognition AI?


No, I'm not sure. It deem it unlikely though as those sound snippets are rather short and uncomplicated, something which I'd think any reasonable STT-system should be able to handle - which makes it vulnerable to those systems as well.


I'm using the audio too. The image captcha is simply broken, it often doesn't let me pass even though I've provided the only valid answer.


While you find this convenient, others may find it imperative.

Somewhat akin to labelling your pet dog a support animal or using a disabled bathroom.


More like walking up the handicapped ramp because the stairs are covered in oil and slippery.


Would it be possible to build a Firefox plugin that creates and isolates the requisite cookies to allow reputation to be built, but at least partially maintains privacy?

I was thinking maybe something that has 10 difference Google sessions, and shards them depending on the website, deciding which to send to the Captcha. You'd build reputation at 1/10th the speed, but you'd still potentially build it. Or, one that allows you to create a random Gmail account and then use that as your identity across the different sites. Perfect privacy would be hard, but improved privacy should be doable.

Alternatively, getting something like blinded identity tokens widely used would be good.


I doubt it's easy, so I prepared such a setup myself, i.e. I keep a separate browser with a Google account and use it only when I really need to. Helps in cases like this one, but of course you give up some privacy - hopefully just the minimal bit.



I'd love Apple to throw their weight behind this. Maybe this + bundle it seamlessly into iOS Safari.


I'm fairly sure (but admittedly not certain) that captcha uses non-cookie and non-account based methods for identifying users, so I don't those methods would work.


I suspect it falls back to the other methods, but if there are Google cookies, I'd have thought it starts with them cookies.


Sounds like Firefox containers should support this kind of usage.


I consider putting the following on my cv:

2016-2019: working for google - analyzing street footage for implementing AI for self driving cars.

Maybe I should also invoice google for the effort.


Would a class action lawsuit for unpaid wages be plausible?


I there any anti reCaptcha or anti Google, that I can donate to? I want to donate a small amount every time Google forces me to solve their problems.


Pay the website owner to remove reCaptcha from the sites you use?


Get a disabled person to take them to court for discrimination.


> Get a disabled person to take them to court for discrimination.

I was thinking something more along the lines of sponsoring them to take Google to court ;)


Are you using Canvas Blocker or similar extensions ? As a FF user I also have to go thru 3-4 captcha everywhere and I'm pretty sure it's because the system is having trouble giving me a stable fingerprint.


The latest captchas are so hard that when I encounter one, it really feels like I am engaged in an unpaid labor relationship with Google.

It makes me sad that they are so pervasive or I would categorically refuse to engage with any site that uses reCaptcha.


This is especially prevalent in the Google mobile site tester in Firefox. In FF you have to do the Captcha almost every damn time. Switch to Chrome and it stopped immediately for me.


Sometimes it's stairs, and they ask you to click all the stairs, but there's an inch of stairs overlapping one window, so you aren't sure if you should click that window because of the pixel or not.

This whole captcha joke and firefox made me hate Google more than anything else.


It's simple; any shitty website that uses this garbage—don't use it. If there is a "contact us" page or email, tell them why you will no longer use it.

If it's your bank's site, move a bank. You say "oh, it's a lot of work just for some captcha"; yes it is, but this is the only way this clowns will learn. When 1000 people leave a bank for a competing one and say "I left because your site employs captcha", it will magically disappear. I've seen it happen.


Are you against all captcha then? How do you suggest websites deal with automated spam or other attacks?


I'm a Firefox user and I did encounter some issues with reCaptchas in the past but this video doesn't convince me at all.

For reference I post regularly on 4chan (not compulsively but maybe a dozen comments a day on average) and if you don't have a pass you have to fill the captcha every time. I only use Firefox. I definitely experienced what this video shows on Firefox in the past (the super-slow loading images) but it felt more like a bug than anything else and it doesn't represent the typical experience. Maybe I tripped one of Google's bot filters somehow and I ended up with a reinforced captcha, or there was a bug somewhere.

The Chrome section of the video is a lot closer to what I see usually, but they make me go through two challenges in a row typically (although that might be 4chan's settings at play).

I'm all for the Chrome hate if it means that people switch to Firefox but I think we need harder data than a short video to call shenanigans on that one.

Off topic rant: the fact that a post with such lack of substance manages to reach 700 votes in 3 hours is frankly depressing, it has no place on this website IMO.


In my experience[0], the captchas are rotated regardless of the browser. The captcha shown each time seems to be chosen based on some sort of hidden “trust level”, which fluctuates across attempts based on your choices.

The starting level, I suspect, is heavily influenced by browser settings and many other factors. With that in mind, and assuming that

1) trust inversely correlates with anonymity,

2) people using Firefox tend to be more tech-savvy and careful about their privacy, and

3) tech-savvy people using Chrome probably won’t bother locking it down, since it “talks to Google anyway”,

I’d be disinclined to believe Google actually discriminates against browsers—no matter how compelling a narrative this may seem—until I have a complete picture of OP’s setup (from browser settings to OS and connection).

[0] Last year there was a period I was getting many captchas (either my location or AWS VPN caused me to be considered “untrusted”); I actively tried to figure out how to get past it without giving the algorithm what it wants, so I could go through a dozen of these captcha screens in one browser window. I use Safari, Firefox and Chrome routinely.


This is why once I switched to FF I also switched to DuckDuckGo


The captcha has nothing to do with Google the search engine. Google's catpcha is used on a lot of websites which are not connected with Google.

On a different note, this also makes it difficult to use such websites if you block google domains in your adblocker for non-Google sites.


You would think that they wouldn't block search. But Google kept throwing me at captcha when I was in FF and not signed in. The biggest pain so far has been the lack of map integration.


They actually block you from search if you're connecting from a VPN and have uMatrix enabled.


It looks like the user missed one fire hydrant in the middle left square. If you look closely there is a tiny fire hydrant in that picture.


I laughed when mouse hovered over it like the user was deliberately looking for fire hydrant on this one and then just moved on with rage, waiting for other images to load :D.

I honestly think this was the reason why Captcha's bot was so passive-aggressive :D


This is bullshit. I regularly experience the "Firefox" example in Chrome, but only in incognito mode. Either way, it's not something Google does deliberately to disincentivize other browsers.


Those storefront photos were remarkably clear/unambiguous, compared to some I've gotten.

When logging into an account I needed to log into, maybe a couple years ago, they'd jerk me around in the manner of this grumpy.website example, but more. One time, it went on for several topics, for what seemed around 10 minutes. I pay money for that account.

This obnoxious annoyance is in addition to the offense of some company letting third-party code from a mass-surveillance company not only into their pages (which almost every company with a Web site does, sadly) but also into their authentication page. Much more important services on the Web do not need captchas for login to accounts that were paid for. Now, every time I get a hassle to log in to my account I pay for, plus directly leak that info to a surveillance company. It makes me regret paying money for the account, like the company are oblivious or don't care, and I won't have much loyalty when the right competitor appears.


I get this all the time with Safari.

It’s because Google can’t read as much about you in more privacy based browsers, so you have to prove yourself.

Not saying it’s right, but that’s the reason. It needs to be changed.


Every website that uses this fingerprinting abomination, should be ashamed.


1. Big company browser attains majority market share. 2. Big company browser's quality starts to slip, but they are not so powerful, they don't have to care. 3. Big company browser starts to work against the common good.

We've seen this before. We'll probably see it again.


Based on some CAPTCHA solving sites it costs about $3 per 1000 ReCAPTCHAs solved. That shows you how worthless adding ReCAPTCHA to your site is. All it'll do is slow bots down a bit and cost $0.003.

Here's an extension to use those services in the browser so you never have to solve one again: https://addons.mozilla.org/en-US/firefox/addon/recaptcha-sol...

That's assuming you can't get Buster to work.


Or even pay, I wouldn't mind paying 0.003$ at each Captcha as long as I have an anonymous payment system.



I see a website with google captcha I just close it. Not going to waste time and also train this huge monopoly's AI further for free.


I have experienced the same behavior when trying to complete Captchas in Tor Browser. However the vast majority of the time it just says "Your computer or network may be sending automated queries. To protect our users, we can't process your request right now." so I cannot even attempt to complete the Captcha.


I barely use Edge in Windows 10, but whenever I do and I go to any google site I get constantly badgered about 'downloading chrome' even though, a) I've already downloaded Chrome and have it installed, b) I've click such notices away 1000 times. More than mildly annoying and aggressive.


I think what most people don't realize is that you don't need a good captcha to stop most abuse. Even the crappiest of captchas will stop 95% of the bots out there. Unless your site is a high value target, you don't really need a great captcha.


Happens to me in chrome every single day. I think it's a bug in how they're detecting potential bots. Of course no one at Google will listen when you submit reports. Especially the one about selecting street lights/stop lights/crosswalks.


the concern here is about super-slow loading and more tiles to verify when you use Firefox than when you use Google Chrome browser


All of which I see in Chrome as well. Literally the same experience in the linked post.


I absolutely hate CAPTCHAs and have done my best to persuade developers to never use them (1).

But in fairness to Google, the promise of their new Captcha system is that it uses all of your previous browsing history across the web to determine how likely you are to be a bot. You can't do a fair apples to apples comparison unless the browsing history and behavior is the same across both browsers.

1) https://www.onlineaspect.com/2010/07/02/why-you-should-never...


From my experience, it's the "Access-Control-Allow-Origin: *" response header that causes the problem. So, it's in the way Chrome uses/enforces cross-origin HTTP request/response headers.


Do websites get paid to run reCAPTCHA?

I keep seeing reCAPTCHA installed on very low security sites that don't seem like targets for automated bots. I'm wondering if they have some external incentive to install it.


I'm not sure what the comparison is on Chrome vs. Firefox. I've had the pain of these slow animations, with a follow-up captcha, and it's infuriating - On Chrome. Is it better on Firefox?


The mainstream internet of today exists to serve the advertising industry (including but not limited to Google) and things that don't so serve will be marginalized like an organism rejecting a foreign body or disease. It's funny, because really the thing that makes users "more significant" than bots for the average website operator is that showing ads to real people has a monetary value attached to it. That is the only reason you prove your humanity to a machine: to validate your suitability as a target for ad spend.


This doesn't make sense to me. Making reCaptcha work worse in FF without telling user that if he/she used Chrome it would be better. Only few tech savvy people (hn readers), will eventually realize that. And it doesn't make them to switch to Chrome (or does it?). They'll just be angry.

And btw I hate reCaptcha. Is it really only option to fight with spam? When I see it on sites, like dhl parcel tracking, I get mad. I always ask why? Can they just block suspicious traffic, or at least not display captcha on first attempt.


If you increase user friction enough, subtly, eventually the affected user is going to look for something else, and now there's only one real something else - especially for non-techie users.


That's exactly what happens to me on an almost daily basis. But then I decided to change my feeling from rage to revenge. Here's how:

I get the first few selections right, so the algorithm knows I'm trustworthy. Then I purposefully get the last ones wrong. This way, I'm still validated by the captcha and I get to show the middle finger to Google.

Now I smile every time I'm faced with reCaptcha :)

Highly recommend. It does take some time to figure out the patterns (when to get it right and when to get it wrong), but once you do, it just works.


This could either be some of Firefox's privacy features genuinely making it look more bot-like to Google, Google accidentally or deliberately sabotaging Firefox, or some combination of the two. It's not really possible to tell from the outside, but it's clear that Google's incentives are for Google's products to work better with each other.

This is why Google should be broken up -- it should be forced to spin off Chrome into a separate company with a business model similar to what Firefox has.


The thing that happens to him in firefox, it also happens to me in chrome.

misleading


I experienced a similar problem. I'm using Firefox. Two websites I have great difficulties logging into are twitch.tv and italki.com, both require solving a google captcha that can sometimes take more than a minute to solve.

I am working on a micro-payments system (based on mutual credit) that should allow to pay something like $0.001 instead of solving a captcha. If this would introduce zero extra friction, would you consider using this kind of solution over the traditional captcha?


I decided to test this for a good hour once. I was suprised how little it actually matters whether you're on a cheap VPN (although i do think they limit TOR) or are actually getting the answers correct. Load up chrome or brave, and it almost instantly solved, whereas Firefox on default privacy settings is a total pain. The worst thing is how they purposely try to just waste your time with the fading images, like in OP.


The Recaptcha 3 is even worse. For example go to truecaller.com and enter a phone number to lookup in Firefox (android). You won't be able to, it will say Recaptcha had failed. Now do the same in chrome on Android and it works. It's because on ff it gives a low score (i. e user is a bot) while on chrome it passes without a hitch.

Funny thing is I haven't used chrome in months so it should be the other way round!


If you’re looking for a good commercial alternative that isn’t turning you into a mechanical Turk to train/classify ML: https://funcaptcha.co/

If you’re primarily trying to stop bots and similar take a look at https://www.kasada.io/


This reminds me of ticketmaster.

Site owners can choose not to use google's recaptcha2 but it has become the de facto standard now so no one cares.


This is exactly what you would encounter if you access Google services using TOR. It's actually even more frustrating than this.


There have been many discussions on HN about this before. Google is making us its free slaves, when they can clearly know in the first click that we are not a robot (it used to work perfectly! How can it unintentionally become that worse?) Is there no Google employee here that sees how absurd this is and get this message sent across?


Antitrust investigators should look into captcha stats for at least browser, ISP, mobile device, IP address, and referer header. It would be better if they could just get Google's algorithm, which I assume is based on more data. I'd be very surprised if Google popped captchas less for non-Google IPs, devices, and browsers.


Why are we labeling images for free for google?


Not for free. It's a service the owners of the website give to Google in exchange for letting you post. You are the product here.


This happens even on Chrome. If you're logged into a Google account, it seems to know that you're not a bot since your Google Account is tightly integrated within Chrome. If you try the same captcha on an Incognito page on Chrome, you will have the same experience as on Firefox. Atleast, that's the case for me.


Omg I knew I wasn't imagining things...I reached the point when I don't bother anymore...captcha means no !


Oh wow, I assumed it was just my combination of ublock origin + privacy badger + accelereyes + privacy-first settings in FF (block all 3rd party cookies, containers, resist fingerprinting, etc.) that caused many hits.

I'm not sure whether I'm glad to find out it's (also? only?) because they hate Firefox.


Human seems able to see face on anything. WOuldn't be a good idea to use this as a way to make a captcha ?


I have noticed that Google often signs me off from my multiple Google accounts on FF too :/ While Chrome (which I use only for Hangouts) remains logged in. A bit annoying! :D

Also, good to see that it's a more widespread issue with these captchas too, I somehow thought that I am just bad at solving them :)


The worst part is that fading effect is completely useless because a bot can wait too if it doesn't detect a proper image. When I tried to exploit Google recaptcha for fun it was an easy task for me to implement a timer that will wait for the image to appears correctly.


I never use Firefox, but I'm pretty sure I've seen this same format before in Chrome. No?


reCaptcha v3 fixes this behavior. Instead of having one gateway test to determine if you are a human or a bot, it collects data on a background on your browsing behavior. Thus, it has a longer browsing behavior sample for heurestics.

https://developers.google.com/recaptcha/docs/v3

Of course, you need to have cookies enabled.

If you do any browser in ignonito mode and/or use VPN or Tor you are going to get persona no grata treatment because it is likely your source network and IP address have caused a lot of problems before. The only way to go around is to have some permacookie on your browser saying you are a good citizen.


HN previously, when Google released RCv3: https://news.ycombinator.com/item?id=18331159

Has anyone posted a technical analysis of the changes? I’d love to read more about it.


I can't tell for sure, but it looks like middle row, first image might have a fire hydrant


Is this ISO52600 image thick with grain at 200% crop a car?


now that's weird. firefox is my main browser (developer edition on linux, windows and macos) and i never get captchas.

maybe it's because i don't use umatrix (i only use ublock origin)? maybe because i'm always logged-in in at least one google account?


> maybe because i'm always logged-in in at least one google account?

That's likely a primary reason.


I use a plain FF and I'm always logged in the Google account but I face this annoying captcha everyday.


I use ublock but stock Firefox otherwise. I am also logged into a Google account most of the time, but still get impossible captchas unless I switch to Chrome.


It's easy to configure umatrix to let Recaptcha through.


My company proxy kept triggering endless Google captcha games. I switched to DuckDuckGo.


I've noticed this effect as well. The white boxes, waiting and waiting, four or five different consecutive tests. All in all a terrible user experience. I thought it was because I used VPN, but this is another explanation.


I use a site frequently and am on the latest FF and I don't see this behavior - the refresh is quite quick.

Does this mean that Google knows enough about me (ie, privacy leak) that it's choosing to not having infuriating UI?


My default approach is to leave site that require reCaptcha (meaning, when ticking the box triggers the challenge) but when I do need to take the challenge I make sure I sprinkle my results with subtle errors.


As a Brave browser user, I go through this partial behaviour every single time.


Does Google use this data to help train its self driving cars and maps for identifying information?

I feel like every captcha is about a street scene of some sort... house numbers, cars, motorcycles, hydrants, stop lights etc.


I'm frankly surprised there has not been an ADA-based lawsuit against Google. I can't tell you the number of times the audio captcha has been unavailable for "reasons".


Oh, I thought it was me... seems like it was my choice of browser. In any case, perhaps Google has a harder time telling me apart from a computer. I guess that is a plus for FF then.


I've had this a lot, thought this was a bug in firefox's rendering or something. Glad to know it isn't, but now I'm somewhat more annoyed to know the real issue.


This also happens in Chrome when 3rd party cookies are turned off.


So basically Google is abusing it's monopoly as a captcha provider to inconvenience users into enabling enhanced tracking in their browsers under the guise of "security"?


Can someone from recaptcha team respond to this? Because this happens to me all the time and it's ridiculous


This fits the pattern of Google consistently going "oops we broke Firefox" (or otherwise made it worse than Chrome) to the extent it raises suspicion of a deliberate strategy, as described by this former Mozillian: https://twitter.com/johnath/status/1116871246510264320


I got same thing in Chrome too, so I guess its related trackers, not just for firefox lol.


I've never run into these image captcha things before. Where do they get used at?


It's the same widget as the checkbox but it throws the images at you if it has doubts.


I guess maybe because I don't have all the privacy extensions installed that some people use?


I've seen that behavior using chrome on linux when using public wifi networks.


I can replicate this same thing in a chrome incognito window...


A class action for drudgery needs to be started.


Google search results page in Firefox mobile browser looks like it is from 2010.

I filed a bug report, only one version of it is fixed, later versions were just displaying same old pages.


reCAPTCHA is malware. If a site uses it, I (usually reluctantly) stop using the site. It's not even a privacy issue anymore - I'm logging into the site, usually so I can give them some money (bandcamp, humble bundle) - I just don't want Google all up in my business. Is that too much to ask these days? In order to not have some creepy giant corporation overseeing everything I do, I guess I just have to not use the Internet.


This looks suspiciously like slowbanning.


Google chrome can already identify who you are and it knows you're not a robot.

That said, it still forces you do to work for its self-driving car effort.


i shifted from Chrome to Firefox a few months ago. been facing this super-slow Captchas. I simply assumed this is due to some network slow / server slow / browser slow. I didn't even bother to go back to Chrome to compare this.

After reading comments in this thread, now I realize this is intentional thing against Firefox.

Damn Google. what happened to your "Don't be evil" beginnings ?


I saw both variants in both browsers.


I don't have this issue.


nah i just need to use tor with chrome to get the same effect as firefox.


Someone explain to him that you have to click the Verify button on both browser.


reCaptcha's not all bad guys, it's actually educational.

It's thanks to reCaptcha that I know what a 'crosswalk' is.


Also how storefronts around the world look like.


this is just unacceptable


Dear developers, if you want to avoid most of the bots use only HTTP/2 and only TLS v1.3. Don't support lower protocols than these ones and your bot problem will decrease greatly. Even GoogleBot won't be able to crawl your web site.


Congratulations, you played yourself.

It's not Firefox that's the problem; reCAPTCHA works just fine on Firefox. It's all those anti-tracking measures you installed and enabled -- they work by making your browser indistinguishable from a low-quality bot, kicking the website into self-defense mode. The slow fade is a rate-limiting measure. It's annoying to you, but it's more annoying to people trying to automate login attempts.

The site is attempting to protect your account by preventing automated attacks against it. Meanwhile your browser is doing it's best to look like a shell script, refusing to send any sort of behavioral feedback or distinguishing characteristics that might give away the fact that you're a human.

So the question is: is it really worth alienating those quirky, paranoid users who take extraordinary anti-tracking measures, just to protect your normal users from automated attacks?

Yes.

Of course it is.




Registration is open for Startup School 2019. Classes start July 22nd.

Guidelines | FAQ | Support | API | Security | Lists | Bookmarklet | Legal | Apply to YC | Contact

Search: