This reCaptcha is suck, each time im use the cafe internet, too many popup pop out from it and asking me to choice. Its like an English class for 2yo baby. But it keep the forum safe from the flood. So unfortunately, we need to deal with it.

On the cost of authority by google.I don't like my  time being wasted by google.Why would I spend 20 seconds of my precious time to prove I'm not a bot when I'm really not.I don't know rant isn't gonna help but just saying since you asked.


Brains ? Let;s way for a day google asks you to solve complex logarithms in the specified amount of time to prove you're a human.


The best alternative is to control that from the server side.

I suspect that the issue is not keeping out bots as such, but preventing bruteforce attempts against luser passwords.  theymos et al., am I right?  Bots need an account for spam.  The forum already charges “evil” IP addresses Bitcoin for new signups.  But most people pick bad passwords; they think that “p4ssw0rd1975” is super-unguessable.  Do the maths.


The CAPTCHA varies its “difficulty” (actually: its tediousness) based on Google’s opinion of the connecting IP address.  Do not assume your experience to be the same as others’.  It isn’t.

For Tor users, this often means page after page of “challenges” which in total take up to a few minutes to solve.  I have not recently done a Google CAPTCHA in less than sixty seconds, and I’ve had plenty of practice.  When I click “Verify”, I get hit with another round; n.b. it does not say my answers are “incorrect”, it just gives me another “challenge”.  Also, as I posted above, Google may even refuse to serve a CAPTCHA.  Google now has the peremptory power to lock people out of bitcointalk.org.

For the past few days, I have been unable to even get a CAPTCHA without changing Tor circuits.  I did some rough testing, hitting “New Identity” in the login page and then changing circuits until I could get a CAPTCHA.  Rinse, repeat.  At worst, I had to try a total of six different circuits before Google would even deign to waste my time clicking pictures.

This brings to mind another thought:  Google could force Tor users to rapidly rebuild circuits to the same endpoint, then potentially watch for any other network activity which could be correlated by timing, size, etc.  Hmmm.  How many Tor nodes are hosted on Google Compute, or otherwise network-visible to Google?  —  Next question:  Does the NSA like to see Tor users rapidly rebuild circuits to the same endpoint?

Those are the sorts of subtle questions which make for papers on anonbib.  Or for attacks.  For a “cloud” provider who hosts many Tor nodes, I think I smell at least the possibility of a guard-discovery attack here.  Tor is known to be weak against an adversary who can observe both endpoints.  If Google forces Tor users to build circuits until they hit a Google-hosted middle node, then I conjecture they could use a similar attack to find the guard (counting the guard as if an “endpoint”).  They then know that a user with guard X logged into bitcointalk.org at dates and times which can, in turn, be correlated with a bitcointalk username (assuming they can’t just use some XSS to grab that off the login page—or share/cross-reference databases with Cloudflare).  Every little bit helps a network observer gathering data for deanonymization.

As an aside, Tor Browser/Torbutton could really use a feature which permits conveniently changing exits without rebuilding the entire circuit.

I use FireFox and it works fine too, so I also don't see a problem or any annoying factor in that.
The only thing that I am still learning to use is the time of log in, it's stays 60 min automatically and I oftenly forget to change it as it suits to me the most (always stay logged in), so it happens that I write a comment, press "post" and come to the page where I need to log in again and that's the most annoying thing to me

Just like the other members, I do not have problem with reCaptcha because it doesn't take much of my time. I understand if it is for the security concerns and will likely support it if it will prevent and stop possible security attacks. It maybe a nuisance for some because if you have a poor connection, it will consume your time in clicking what is required. Anyways, if reCaptcha will also slow down those people who are going against the rule of having multiple accounts, then it is just and right.

Tor user here.  Please see the thread I started after my 17-circuit-change login instance, documented with screenshots of various error messages; my conclusion thus far:


P.S., I suggest that you consider purchasing a Copper Membership.  Your Tor signup fee can be put toward the price; and it will let you embed images as a newbie, among other perqs.

I think Theymos should replace the captcha with a proof of work challenge such as https://coinhive.com/

Reduce Spam AND make the forum some additional money. 

This would (0) require Javascript (as reCAPTCHA does—but worse, IIRC this also requires asm.js/webasm which I disable even when enabling JS), and (1) have a drastically disparate impact on those using fast computers versus slow computers/netbooks/mobile devices.  It is also questionable whether it would answer the threat being staved off by the CAPTCHA.  Admittedly, it would work better against what I suspect the threat to be, rather than against spam.

Vod, do you know the actual purpose of the CAPTCHA?  Everybody seems to assume that it’s there to keep out spambots.[1]  My first hunch is that theymos has a problem with bruteforcing of luser passwords, resulting in stolen accounts.  You may perhaps know for certain, not as a matter of assumptions or speculation.

I would understand if theymos desires that such information not be disclosed.  But I ask because I have wanted to suggest some alternative solutions; and it’s difficult to know whether my ideas are even worth mentioning.

---

1. This common assumption simply does not make sense to me.  An account farmer could easily use human labour (self or others) to log bots into a large numbers of accounts with “stay logged in” checked, then let them stay logged in to make unlimited spam/nonsense/copypaste posts.  It would be trivial; all the bots would need to do is to keep their cookies.  I know this because I myself now stay logged in, on a credential apparently set to expire in the year 2023.  I have not filled out the CAPTCHA since 10 December.  Whereas a password bruteforcer would indeed be stymied by the CAPTCHA.  A bruteforcer would also be slowed down by a POW.  A spambot could complete the POW once, then stay logged in for years or until permabanned.