this post was submitted on 24 Jul 2024
1081 points (98.5% liked)

Technology

58303 readers
11 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS
 

Research Findings:

  • reCAPTCHA v2 is not effective in preventing bots and fraud, despite its intended purpose
  • reCAPTCHA v2 can be defeated by bots 70-100% of the time
  • reCAPTCHA v3, the latest version, is also vulnerable to attacks and has been beaten 97% of the time
  • reCAPTCHA interactions impose a significant cost on users, with an estimated 819 million hours of human time spent on reCAPTCHA over 13 years, which corresponds to at least $6.1 billion USD in wages
  • Google has potentially profited $888 billion from cookies [created by reCAPTCHA sessions] and $8.75–32.3 billion per each sale of their total labeled data set
  • Google should bear the cost of detecting bots, rather than shifting it to users

"The conclusion can be extended that the true purpose of reCAPTCHA v2 is a free image-labeling labor and tracking cookie farm for advertising and data profit masquerading as a security service," the paper declares.

In a statement provided to The Register after this story was filed, a Google spokesperson said: "reCAPTCHA user data is not used for any other purpose than to improve the reCAPTCHA service, which the terms of service make clear. Further, a majority of our user base have moved to reCAPTCHA v3, which improves fraud detection with invisible scoring. Even if a site were still on the previous generation of the product, reCAPTCHA v2 visual challenge images are all pre-labeled and user input plays no role in image labeling."

(page 2) 50 comments
sorted by: hot top controversial new old
[–] [email protected] 9 points 3 months ago

We already knew that, but it's nice re to have data.

[–] [email protected] 9 points 3 months ago (5 children)

Gonna have to disagree hard with this, based on extensive first-hand experience (web dev). I've added CAPTCHA to dozens (hundreds?) of web forms, and it all but eliminates spam.

[–] [email protected] 7 points 3 months ago (1 children)

Right, so similar to locks? Usually can be easily bypassed if you know how, but it at least filters out the people who aren't determined enough to put in the effort.

[–] [email protected] 4 points 3 months ago

Basically, yeah. The vast majority of spambots are simple and lazy.

[–] [email protected] 5 points 3 months ago

My experience matches yours. I don’t enjoy putting recapcha v3 on my sites but it takes contact form spam from 70-80 messages per day to 0-2.

I’d switch to other services if they could be as effective. If anybody has real-world experience with another option working I’d love to hear it.

load more comments (3 replies)
[–] [email protected] 8 points 3 months ago (1 children)

reCAPTCHA v2 visual challenge images are all pre-labeled and user input plays no role in image labeling

That's funny, because when I'm faced with this, I keep adding/removing one of the image randomly and it keeps accepting them as ok.

load more comments (1 replies)
[–] [email protected] 5 points 3 months ago (2 children)
[–] ICastFist 6 points 3 months ago (1 children)

Judging from the reviews, it doesn't

[–] [email protected] 4 points 3 months ago

Ah, right, there are reviews too.

[–] [email protected] 5 points 3 months ago

I tried it before. It worked for me on one small game website for account creation. After that it was more or less useless on any other site. It has a weird focus thing where it'll try to solve the captcha before you can enter in login details so if by chance the extension works, you'll fail the login anyways.

It still needs work. I think if the dev can work out those issues it could be great. Until then, it's pretty much worthless.

[–] [email protected] 5 points 3 months ago* (last edited 3 months ago)

Is it only 7200 people solvning reCAPTCHA every hour for the past 13 years? Feels like it should be more?

[–] [email protected] 4 points 3 months ago

I thought it was detecting bots based on how you are moving your mouse, etc to solve it, but if they can be solved by AI do they want their AI trained by other AI?

[–] [email protected] 4 points 3 months ago

I thought this was old news 20 years ago?

[–] [email protected] 3 points 3 months ago

I always thought they are just getting the training data for AI using these.

load more comments
view more: ‹ prev next ›