Google's reCAPTCHA v2 just labor exploitation, boffins say
www.theregister.com
Web puzzles don't protect against bots, but humans have spent 819 million unpaid hours solving them

Research Findings:

  • reCAPTCHA v2 is not effective in preventing bots and fraud, despite its intended purpose
  • reCAPTCHA v2 can be defeated by bots 70-100% of the time
  • reCAPTCHA v3, the latest version, is also vulnerable to attacks and has been beaten 97% of the time
  • reCAPTCHA interactions impose a significant cost on users, with an estimated 819 million hours of human time spent on reCAPTCHA over 13 years, which corresponds to at least $6.1 billion USD in wages
  • Google has potentially profited $888 billion from cookies [created by reCAPTCHA sessions] and $8.75–32.3 billion per each sale of their total labeled data set
  • Google should bear the cost of detecting bots, rather than shifting it to users

“The conclusion can be extended that the true purpose of reCAPTCHA v2 is a free image-labeling labor and tracking cookie farm for advertising and data profit masquerading as a security service,” the paper declares.

In a statement provided to The Register after this story was filed, a Google spokesperson said: “reCAPTCHA user data is not used for any other purpose than to improve the reCAPTCHA service, which the terms of service make clear. Further, a majority of our user base have moved to reCAPTCHA v3, which improves fraud detection with invisible scoring. Even if a site were still on the previous generation of the product, reCAPTCHA v2 visual challenge images are all pre-labeled and user input plays no role in image labeling.”

  • Churbleyimyam@lemm.eeEnglish
    1·
    3 months ago

    Getting served a captcha often results in me closing the tab. I’m not doing stupid puzzles for you.

      • tyler@programming.devEnglish
        0·
        3 months ago

        It knows they’re wrong which is why I don’t really think this article is accurate. Is it training if it already has the answers? Probably not.

        • Vox@lemmy.worldEnglish
          0·
          3 months ago

          It’s why they ask you to do multiple, 1-2 of them are the control group, they are training on the others

          • tyler@programming.devEnglish
            0·
            3 months ago

            You’re implying they give you multiple. I hardly ever get multiple, pretty much only if I ‘fail’ the first one.

            • Miaou@jlai.luEnglish
              0·
              3 months ago

              If they have a good fingerprint on you they don’t need the control group. That’s why you get 5+ captchas when using a VPN/tor.

        • MajinBlayze@lemmy.worldEnglish
          0·
          3 months ago

          That’s why it gives you a panel of 9 images. It had a high confidence on some images, and a low confidence on others. When you pick the correct images and don’t pick incorrect ones it uses the ones it’s confident about as “validation” while taking the feedback on low confidence images to update the training data.

          What this means is that only ones actually being “graded” are the ones bots can solve anyway.

        • AmidFuror@fedia.io
          0·
          3 months ago

          My understanding is different from others here. I thought they served the same Captcha to many people at once and use the majority response to decide who is answering correctly.

          • catloaf@lemm.eeEnglish
            0·
            3 months ago

            That’s true, or at least it used to be back when they were using it for OCR. I have no reason to believe it’s changed.

    • snooggums@midwest.socialEnglish
      0·
      3 months ago

      I haven’t done an image one in years for the same reason.

      My general internet usage has plummeted between ads and captchas and all the other modern website bullshit, which is why I am here so much.

  • someguy3@lemmy.worldEnglish
    1·
    3 months ago

    I kinda figured. It was annoying to do one, but then they wanted you to do two or three and that’s absurd. Whenever it comes up now, I usually just close out.

    • Bezier@suppo.fiEnglish
      1·
      3 months ago

      they wanted you to do two or three and that’s absurd

      Yea how about 20

      • LucidNightmare@lemm.eeEnglish
        0·
        3 months ago

        VPN? Google will just go in a loop with these things, so I just stopped using Google completely.

        • Bezier@suppo.fiEnglish
          0·
          3 months ago

          No. But it’s also not like I get 20 constantly, it was just the worst I’ve seen. Usually it’s 2 to 5, I think.

          I assume they’re just collecting data on how many are users willing to do.

          • LucidNightmare@lemm.eeEnglish
            0·
            3 months ago

            One time I did five in a row, because I use VPNs for everything, and realized after the 5th time that it would have been easier to just use bing so I do that first now. Google has turned into my last last resort, which is quite funny, because that’s where Bing used to be. Lmao

        • I Cast Fist@programming.devEnglish
          0·
          3 months ago

          Whenever I’m on a private window the captchas just keep on coming. Trying to reset your Steam password via the program will also trigger an infinite loop of captchas, you HAVE to use a browser.

      • sramder@lemmy.worldEnglish
        0·
        3 months ago

        I tried to order some components on Digikey a few months ago and I’m still mentally scarred. Probably did a few hundred of those things over the course of 2 weeks.

      • Dudewitbow@lemmy.zipEnglish
        0·
        3 months ago

        if you have to do that many, you either have some privacy setting on or on a flagged ip given from a VPN

    • dinckel@lemmy.worldEnglish
      0·
      3 months ago

      At a certain point I did like 10 of them, and then ended up closing the page, cause it never let me in, all because I was on a vpn

    • CosmoNova@lemmy.worldEnglish
      0·
      3 months ago

      Funny thing is they stop asking if you do them really slowly. Almost as if to tell you, you‘re too inefficient to even be an unpaid intern or something. Anyway, if they annoy you, take your time.

    • Fisch@discuss.tchncs.deEnglish
      0·
      3 months ago

      Some captchas have also just gotten obvious AI training. “Click on the living being in this image”, “Select every image of the same object as in this example image”. And the images you have to select look obviously AI generated.

  • kingthrillgore@lemmy.mlEnglish
    0·
    3 months ago

    Remember the good old days when it was just malformed text you have to solve? I miss those days. AI was complete garbage and they had to use farms of eyeballs to solve them for bots, making it a costly operation. We’ve now totally gotten away from all of that.

  • sarmale@lemmy.zipEnglish
    0·
    3 months ago

    I thought it was detecting bots based on how you are moving your mouse, etc to solve it, but if they can be solved by AI do they want their AI trained by other AI?

  • snooggums@midwest.socialEnglish
    0·
    3 months ago

    The conclusion can be extended that the true purpose of reCAPTCHA v2 is a free image-labeling labor and tracking cookie farm for advertising and data profit masquerading as a security service,” the paper declares.

    I thought this was known since it came out. It seemed even more obvious when the images leaned in heavily to traffic related pictures like stoplights.

  • repungnant_canary@lemmy.worldEnglish
    0·
    3 months ago

    It is undoubtedly a new piece of research, but the cause is always the same: corporations exploit people because they are taken out of government and democratic control effectively everywhere.

    Some corporations employ more people and have bigger budgets than some countries and they often influence people’s lives more than the government. Yet they’re effectively electoral monarchies where electors and monarchs are just a bunch of rich assholes who respond to nobody.

    Only when we change that system then those headlines will stop.

  • Sunkblake@lemmy.worldEnglish
    0·
    3 months ago

    Is it only 7200 people solvning reCAPTCHA every hour for the past 13 years? Feels like it should be more?

  • FierySpectre@lemmy.worldEnglish
    0·
    3 months ago

    I mean, duh? With proof of work captchas existing, there’s no reason to have those image selection captchas… Ever…

    How those work is by having the server generate a puzzle. Server side this is cheap to generate, while client side solving is “hard”. The server can even choose the difficulty of the puzzle, and even set it dynamically. This means that when your website is under light load the captcha can be really easy/fast to solve. If your website is under attack however the captcha can be set to take seconds to solve.

    • ohmyiv@lemmy.worldEnglish
      0·
      3 months ago

      I tried it before. It worked for me on one small game website for account creation. After that it was more or less useless on any other site. It has a weird focus thing where it’ll try to solve the captcha before you can enter in login details so if by chance the extension works, you’ll fail the login anyways.

      It still needs work. I think if the dev can work out those issues it could be great. Until then, it’s pretty much worthless.

  • HiramFromTheChi@lemmy.worldEnglish
    0·
    3 months ago

    There’s nothing that can express my disdain for Google’s reCaptcha.

    😒 We’re training its AI models 😒 It’s free labor for Google 😒 Sometimes it wants the corner of an object, sometimes it doesn’t 😒 Wildly inconsistent 😒 Always blurry and hard to see 😒 Seemingly endless 😒 It’s the robot asking us humans if we’re the robots

  • Flying Squid@lemmy.worldEnglish
    0·
    3 months ago

    I had to deal with one yesterday that wouldn’t let me in no matter what I did.

    So it isn’t even good at figuring out who isn’t a robot.

    • icedterminal@lemmy.worldEnglish
      0·
      3 months ago

      Solving too fast. I shit you not. Sometimes you have to go really slow. Like you’re 80 and can’t see very well trying to discern what’s in those boxes.

    • brbposting@sh.itjust.worksEnglish
      0·
      3 months ago

      Finally heard a clear audio CAPTCHA for the first time in my life this past month. It was glorious. There was slight garbling before and after the characters were read, but that’s it.

      Besides that singular experience, all audio CAPTCHAs have been utterly 100% impossible to interpret. Blaring white noise followed by a small squeak of “threeve” or “eleventeen”.

  • cley_faye@lemmy.worldEnglish
    0·
    3 months ago

    reCAPTCHA v2 visual challenge images are all pre-labeled and user input plays no role in image labeling

    That’s funny, because when I’m faced with this, I keep adding/removing one of the image randomly and it keeps accepting them as ok.