1065

Research Findings:

  • reCAPTCHA v2 is not effective in preventing bots and fraud, despite its intended purpose
  • reCAPTCHA v2 can be defeated by bots 70-100% of the time
  • reCAPTCHA v3, the latest version, is also vulnerable to attacks and has been beaten 97% of the time
  • reCAPTCHA interactions impose a significant cost on users, with an estimated 819 million hours of human time spent on reCAPTCHA over 13 years, which corresponds to at least $6.1 billion USD in wages
  • Google has potentially profited $888 billion from cookies [created by reCAPTCHA sessions] and $8.75–32.3 billion per each sale of their total labeled data set
  • Google should bear the cost of detecting bots, rather than shifting it to users

"The conclusion can be extended that the true purpose of reCAPTCHA v2 is a free image-labeling labor and tracking cookie farm for advertising and data profit masquerading as a security service," the paper declares.

In a statement provided to The Register after this story was filed, a Google spokesperson said: "reCAPTCHA user data is not used for any other purpose than to improve the reCAPTCHA service, which the terms of service make clear. Further, a majority of our user base have moved to reCAPTCHA v3, which improves fraud detection with invisible scoring. Even if a site were still on the previous generation of the product, reCAPTCHA v2 visual challenge images are all pre-labeled and user input plays no role in image labeling."

(page 2) 50 comments
sorted by: hot top controversial new old
[-] Etterra@lemmy.world 9 points 4 months ago

We already knew that, but it's nice re to have data.

[-] Blackmist@feddit.uk 9 points 4 months ago

I thought the whole point of reCaptcha was to provide a reliable set of data to train bots. Entering a fuzzy scanned word, identifying bikes and traffic lights, etc.

The fact that they've now got that, and the bots are trained is hardly a surprise.

Without captchas the problem of spambots would still be a million times worse.

[-] sugar_in_your_tea@sh.itjust.works 6 points 4 months ago

Yup. I like Cloudflare's checkbox, it works well and probably catches more bots than reCaptcha while being simple for humans.

load more comments (4 replies)
[-] cley_faye@lemmy.world 8 points 5 months ago

reCAPTCHA v2 visual challenge images are all pre-labeled and user input plays no role in image labeling

That's funny, because when I'm faced with this, I keep adding/removing one of the image randomly and it keeps accepting them as ok.

load more comments (1 replies)
[-] skulkbane@lemmy.world 5 points 5 months ago* (last edited 5 months ago)

Is it only 7200 people solvning reCAPTCHA every hour for the past 13 years? Feels like it should be more?

[-] MonkderVierte@lemmy.ml 5 points 5 months ago
[-] ICastFist@programming.dev 6 points 5 months ago

Judging from the reviews, it doesn't

[-] MonkderVierte@lemmy.ml 4 points 5 months ago

Ah, right, there are reviews too.

[-] ohmyiv@lemmy.world 4 points 5 months ago

I tried it before. It worked for me on one small game website for account creation. After that it was more or less useless on any other site. It has a weird focus thing where it'll try to solve the captcha before you can enter in login details so if by chance the extension works, you'll fail the login anyways.

It still needs work. I think if the dev can work out those issues it could be great. Until then, it's pretty much worthless.

[-] wreckedcarzz@lemmy.world 4 points 5 months ago

I thought this was old news 20 years ago?

[-] TypicalHog@lemm.ee 3 points 5 months ago

I always thought they are just getting the training data for AI using these.

load more comments
view more: ‹ prev next ›
this post was submitted on 24 Jul 2024
1065 points (98.4% liked)

Technology

60052 readers
2902 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 2 years ago
MODERATORS