Technology

59373 readers

3394 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

1077

Forget security – Google's reCAPTCHA v2 is exploiting users for profit | Web puzzles don't protect against bots, but humans have spent 819 million unpaid hours solving them (www.theregister.com)

submitted 3 months ago by ForgottenFlux@lemmy.world to c/technology@lemmy.world

173 comments fedilink hide all child comments

Research Findings:

reCAPTCHA v2 is not effective in preventing bots and fraud, despite its intended purpose
reCAPTCHA v2 can be defeated by bots 70-100% of the time
reCAPTCHA v3, the latest version, is also vulnerable to attacks and has been beaten 97% of the time
reCAPTCHA interactions impose a significant cost on users, with an estimated 819 million hours of human time spent on reCAPTCHA over 13 years, which corresponds to at least $6.1 billion USD in wages
Google has potentially profited $888 billion from cookies [created by reCAPTCHA sessions] and $8.75–32.3 billion per each sale of their total labeled data set
Google should bear the cost of detecting bots, rather than shifting it to users

"The conclusion can be extended that the true purpose of reCAPTCHA v2 is a free image-labeling labor and tracking cookie farm for advertising and data profit masquerading as a security service," the paper declares.

In a statement provided to The Register after this story was filed, a Google spokesperson said: "reCAPTCHA user data is not used for any other purpose than to improve the reCAPTCHA service, which the terms of service make clear. Further, a majority of our user base have moved to reCAPTCHA v3, which improves fraud detection with invisible scoring. Even if a site were still on the previous generation of the product, reCAPTCHA v2 visual challenge images are all pre-labeled and user input plays no role in image labeling."

you are viewing a single comment's thread
view the rest of the comments

[–] cygnus@lemmy.ca 10 points 3 months ago (4 children)

Gonna have to disagree hard with this, based on extensive first-hand experience (web dev). I've added CAPTCHA to dozens (hundreds?) of web forms, and it all but eliminates spam.

[–] rbits@lemm.ee 7 points 3 months ago (1 children)

Right, so similar to locks? Usually can be easily bypassed if you know how, but it at least filters out the people who aren't determined enough to put in the effort.

[–] cygnus@lemmy.ca 4 points 3 months ago

Basically, yeah. The vast majority of spambots are simple and lazy.

[–] vastard@lemmynsfw.com 5 points 3 months ago

My experience matches yours. I don’t enjoy putting recapcha v3 on my sites but it takes contact form spam from 70-80 messages per day to 0-2.

I’d switch to other services if they could be as effective. If anybody has real-world experience with another option working I’d love to hear it.

[–] red_pigeon@lemm.ee 3 points 3 months ago

Honestly at first read, the paper feels like a bunch of whining text to prove a point the author believes in without any alternate proposal.

[–] OsrsNeedsF2P@lemmy.ml -4 points 3 months ago (1 children)

It works against basic bots, but if you've got a dedicated adversary, it doesn't do anything

(Granted, most people do not have dedicated adversaries, but when they come, you're in trouble)

[–] cygnus@lemmy.ca 17 points 3 months ago

OK, sure, but that's like saying it's pointless to use a secure password online because the NSA could hack you if they wanted to.