Research Findings:
- reCAPTCHA v2 is not effective in preventing bots and fraud, despite its intended purpose
- reCAPTCHA v2 can be defeated by bots 70-100% of the time
- reCAPTCHA v3, the latest version, is also vulnerable to attacks and has been beaten 97% of the time
- reCAPTCHA interactions impose a significant cost on users, with an estimated 819 million hours of human time spent on reCAPTCHA over 13 years, which corresponds to at least $6.1 billion USD in wages
- Google has potentially profited $888 billion from cookies [created by reCAPTCHA sessions] and $8.75–32.3 billion per each sale of their total labeled data set
- Google should bear the cost of detecting bots, rather than shifting it to users
“The conclusion can be extended that the true purpose of reCAPTCHA v2 is a free image-labeling labor and tracking cookie farm for advertising and data profit masquerading as a security service,” the paper declares.
In a statement provided to The Register after this story was filed, a Google spokesperson said: “reCAPTCHA user data is not used for any other purpose than to improve the reCAPTCHA service, which the terms of service make clear. Further, a majority of our user base have moved to reCAPTCHA v3, which improves fraud detection with invisible scoring. Even if a site were still on the previous generation of the product, reCAPTCHA v2 visual challenge images are all pre-labeled and user input plays no role in image labeling.”
I kinda figured. It was annoying to do one, but then they wanted you to do two or three and that’s absurd. Whenever it comes up now, I usually just close out.
if you have to do that many, you either have some privacy setting on or on a flagged ip given from a VPN
Or google knows you will out up with it and want the most interaction it can get from you.
VPN? Google will just go in a loop with these things, so I just stopped using Google completely.
No. But it’s also not like I get 20 constantly, it was just the worst I’ve seen. Usually it’s 2 to 5, I think.
I assume they’re just collecting data on how many are users willing to do.
Some captchas have also just gotten obvious AI training. “Click on the living being in this image”, “Select every image of the same object as in this example image”. And the images you have to select look obviously AI generated.
Heh, I got one just the other day “Select the images containing structures built by people” lmao
Im surprised that this is in the news right now. This has been acknowledged as fact for a decade or so.
I still don’t get this one even after being linked to it so many times 😌🤣
Getting served a captcha often results in me closing the tab. I’m not doing stupid puzzles for you.
It knows they’re wrong which is why I don’t really think this article is accurate. Is it training if it already has the answers? Probably not.
It’s why they ask you to do multiple, 1-2 of them are the control group, they are training on the others
That’s why it gives you a panel of 9 images. It would have a high confidence on some images, and a low confidence on others. When you pick the correct images and don’t pick incorrect ones it uses the ones it’s confident about as “validation” while taking the feedback on low confidence images to update the training data.
What this does mean in practice is that only ones actually being “graded” are the ones bots can solve anyway.
If they gave two captchas, one which they knew the answer and one which they didn’t, they could use the second for training. (Even if you’re paying someone, you want to do that sort of thing when crowdsourcing data, because you never know if the paid person is just screwing around.)
My understanding is different from others here. I thought they served the same Captcha to many people at once and use the majority response to decide who is answering correctly.
Google should bear the cost of detecting bots, rather than shifting it to users
how?
Considering the article states that reCAPTCHA v2 and v3 can be broken/bypassed by bots 70-100% of the time, they are obviously not the solution.
how do you get the metric of 70-100% of the time?
the best bots doing it 70-100% of the time is very different to the kind of bot your average spammer will have access to
“Google should bear the cost”
Google should shut it down and make sites roll their own verification. Give everyone a month to implement a new solution on millions of websites.
This is bullshit. Author is literally insane.
I bypassed 35000 google recaptcha v2 using bots. Don’t ever rely on this for security
Except, that’s most of its ad copy on Google’s own website?
reCAPTCHA uses an advanced risk analysis engine and adaptive challenges to keep malicious software from engaging in abusive activities on your website. Meanwhile, legitimate users will be able to login, make purchases, view pages, or create accounts and fake users will be blocked.
It’s literally billed as a security measure for a website.
I see your perspective, but I don’t consider that security in the context of software, which may also explain why they don’t use that word, though I readily admit that it is technically security of a sort. The term usually implies authentication, authorization, and isolation.
I just spent 3$ worth of bitcoin on NoCaptchaAI. I used their web extension on a server which had a browser opened and controlled by a custom webextension I made so that a solved challenge would be returned to a swarm of clients upon request
