w3c / captcha-accessibility

Inaccessibility of CAPTCHA
https://w3c.github.io/captcha-accessibility/
Other
3 stars 4 forks source link

Working Draft Feedback: reCAPTCHA selectively blocks audio challenge #28

Open dessant opened 5 years ago

dessant commented 5 years ago

I've seen your feedback request for the Inaccessibility of CAPTCHA Working Draft, and I'd like to share what I have learned about the reCAPTCHA service while I was working on Buster.

The most prominent issue is that reCAPTCHA selectively blocks the audio challenge, while the visual challenge remains available for solving. This practice discriminates against people with visual disabilities, and prevents them from getting access to services and information on the web.

The reCAPTCHA Google Group and other forums have several threads about people with disabilities looking for a solution because of the blocked audio challenge, this is one of them: https://groups.google.com/forum/#!topic/recaptcha/5TFQ2c4phPU/discussion

https://groups.google.com/forum/?nomobile=true#!searchin/recaptcha/audio%7Csort:date https://www.google.com/search?q=%22audio%22+%22captcha%22+OR+%22recaptcha%22+%22automated+queries%22

People are encountered with this message when they try to access the audio challenge: Your computer or network may be sending automated queries. To protect our users, we can't process your request right now.

This happens because the reCAPTCHA algorithm erronously flags people as bots, and it simply blocks access to the audio challenge instead of offering a challenge that is harder to solve.

The blocking of the reCAPTCHA audio challenge is a regular occurence while browsing the web from residential IP addresses. People have reported some level of success in accessing the audio challenge by switching to Chrome and staying always logged into their Google accounts.

The reCAPTCHA service is also hostile to users connecting from VPNs or anonymizing services such as Tor. The audio challenge is almost always blocked when using Tor, and the visual challenge may be blocked as well, or serves several challenges in a row and refuses to accept correct solutions.

Because of the dominance of the reCAPTCHA service, people seeking privacy are effectively prevented from accessing large portions of the web.

JaninaSajka commented 5 years ago

Thank you for your comment and the pointers you provide. We've edited our discussion of reCAPTCHA to incorporate this observation. The draft edits are here:

https://raw.githack.com/w3c/apa/editorial2-captcha/captcha/index.html

Best,

Janina

Armin Sebastian writes:

I've seen your feedback request for the Inaccessibility of CAPTCHA Working Draft, and I'd like to share what I have learned about the reCAPTCHA service while I was working on Buster.

The most prominent issue is that reCAPTCHA selectively blocks the audio challenge, while the visual challenge remains available for solving. This practice discriminates against people with visual disabilities, and blocks them from getting access to services and information on the web.

The reCAPTCHA Google Group and other forums have several threads about people with disabilities looking for a solution because of the blocked audio challenge, this is one of them: https://groups.google.com/forum/#!topic/recaptcha/5TFQ2c4phPU/discussion

https://groups.google.com/forum/?nomobile=true#!searchin/recaptcha/audio%7Csort:date https://www.google.com/search?q=%22audio%22+%22captcha%22+OR+%22recaptcha%22+%22automated+queries%22

This is the message people are encountered with when they try to access the audio challenge: Your computer or network may be sending automated queries. To protect our users, we can't process your request right now.

This happens because the reCAPTCHA algorithm erronously flags real people as bots, and it simply blocks access to the audio challenge instead of offering a challenge that is harder to solve.

The blocking of the reCAPTCHA audio challenge is a regular occurence while browsing the web from residential IP addresses. People have reported some level of success in accessing the audio challenge by switching to Chrome and staying always logged into their Google accounts.

The reCAPTCHA service is also hostile to users connecting from VPNs or anonymizing services such as Tor. The audio challenge is almost always blocked when using Tor, and the visual challenge may be blocked as well, or serves several challenges in a row and refuses to accept correct solutions.

Because of the dominance of the reCAPTCHA service, people seeking privacy are effectively prevented from accessing large portions of the web.

-- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: w3c/captcha-accessibility#28

--

Janina Sajka

Linux Foundation Fellow Executive Chair, Accessibility Workgroup: http://a11y.org

The World Wide Web Consortium (W3C), Web Accessibility Initiative (WAI) Chair, Accessible Platform Architectures http://www.w3.org/wai/apa

chancecarey commented 5 years ago

@JaninaSajka It seems that link 404s.

JaninaSajka commented 5 years ago

Thanks for the heads up. Just checked all links with linkchecker and fixed the one bad href. One is certainly too many!

Janina

cmcarey writes:

@JaninaSajka It seems that link 404s.

-- You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub: w3c/captcha-accessibility#28

--

Janina Sajka

Linux Foundation Fellow Executive Chair, Accessibility Workgroup: http://a11y.org

The World Wide Web Consortium (W3C), Web Accessibility Initiative (WAI) Chair, Accessible Platform Architectures http://www.w3.org/wai/apa

chancecarey commented 5 years ago

Still 404s for me. Referring to the draft link.

On Thu, 20 Jun 2019, 00:49 JaninaSajka, notifications@github.com wrote:

Thanks for the heads up. Just checked all links with linkchecker and fixed the one bad href. One is certainly too many!

Janina

cmcarey writes:

@JaninaSajka It seems that link 404s.

-- You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub: w3c/captcha-accessibility#28

--

Janina Sajka

Linux Foundation Fellow Executive Chair, Accessibility Workgroup: http://a11y.org

The World Wide Web Consortium (W3C), Web Accessibility Initiative (WAI) Chair, Accessible Platform Architectures http://www.w3.org/wai/apa

— You are receiving this because you commented. Reply to this email directly, view it on GitHub <w3c/captcha-accessibility#28?email_source=notifications&email_token=AHXL4IXQ5P7IAZTD4ZBXXN3P3KSWHA5CNFSM4HATDKD2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODYDMGSQ#issuecomment-503759690>, or mute the thread https://github.com/notifications/unsubscribe-auth/AHXL4IQ7MQCYN5LIVFBT5YTP3KSWHANCNFSM4HATDKDQ .

sumodx commented 5 years ago

404 because that branch/tag no longer exists?

Alternatives that may or may not be reflecting the update:

Branch "Editorial" - https://raw.githack.com/w3c/apa/editorial/captcha/index.html Branch "master" - https://raw.githack.com/w3c/apa/master/captcha/index.html

dessant commented 5 years ago

The updated draft has been published: https://www.w3.org/TR/turingtest/

nukeop commented 5 years ago

Thank you for this, recaptcha is probably the most evil tool Google employs in order to subjugate users seeking privacy, all the while trying to exploit plausible deniability that they're only doing this to capture bot traffic. The new version is going to be even more evil, demanding to spy on all user actions across the entire website: https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side