0

Sometimes Stack Exchange thinks I'm a robot and it asks me to do some reCAPTCHA but the reCAPTCHA doesn't load and I get this in my logs:

The resource at “https://www.google.com/recaptcha/api.js?onload=onloadCallback&render=explicit&hl=en” was blocked because tracking protection is enabled.

What can I do in this case?

Please note that I don't want to disable this. I don't want to load the reCAPTCHA but I'd prefer to prove that I'm not a robot in other ways.

Also note that users in China cannot prove that they aren't a robot, since the Great Firewall of China blocks all Google resources.

Btw I get this problem whenever I use the setupVPN firefox extension. (No other website asks me for captcha when I use that extension unlike tor which usually gets me in trouble.)

Edited:

This question was borne out of personal frustration, I felt strongly that this issue deserved to be discussed, hence the discussion tag. But now that I've given it some thought and some great people have made some great comments, I would like to say how I feel about it now.

  • This question is not about me and my preferences.
  • It is neither asking SE to change all their code now because a few problematic folks have some obsession (I have nothing against @Journeyman Geek and this is not targeted at him, it's a summary of how I see privacy concerned people getting addressed on other questions with the "tracking" tag).

It is more about why when the initial codes were being written nobody had taken into consideration that perhaps some people prefer not to be forced into being tracked by google. One might say there are so many other things like imgur etc. which I personally disagree with but that's offtopic here.

The difference, however, between imgur and reCAPTCHA is that although imgur is bad, one can still use tor and feel a little safer (although not fully because I can imagine that one might be able to discover someone's identity behind each account if they try hard enough) but at least the UX remains the same. On the other hand, with reCAPTCHA if you want to use tor your UX is ruined because it's very long and has intrusive pop ups of its own.

Everything becomes much worse if you have the feeling that google is using the "free" reCAPTCHA service to force people to label images for them so they can use those labeled images to train their neural networks. You might say it's a conspiracy theory but if you are not paying for something and you don't know exactly how that thing is being paid for and what is going on behind the scenes you are not the customer but the product being sold/or the slave working for free.

Another general problem I have with SE is that it feels free to force us to trust other companies. This is so unfair. We trust SE not because of that stupid legal privacy policy notice. We trust SE because of its transparency and the community. And it's so unfair that SE is trusting other companies just because of their claimed privacy policy on behalf of us. SE is free to do that from a legal perspective. But not from a moral perspective.

Bottom line

If we trust SE, it doesn't mean that we trust SE to trust other people for us and create a long chain of trust which is doomed to be broken because of the second law of thermodynamics.

What I'm asking here is not for a change in any code. But rather a change of policy. What I'm saying is that SE should care about every single member of the community that is voluntarily working to make SE better and help the rest of the community.

We trust SE and we fill in long surveys for SE because we see this company as “us” and we feel that SE cares about every single one of us. Of course SE can't make every single one of us happy but it can care about every user and it should have every one of its users in mind while making decisions.

In the case of reCAPTCHA I think SE could have chosen a different solution that would have kept more people happy without losing much.

Or maybe I've misunderstood the whole thing. Maybe SE is just another company that doesn't care about making as many people as possible safe but keeping the majority happy.

  • related? support.mozilla.org/en-US/questions/1211390 Not really a Stack Exchange problem. – Kevin B Sep 25 '18 at 17:55
  • 4
    Kevin I don't want to use recaptcha. I don't want to be tracked by google. I don't really think using recaptcha is really a necessity for stackexchange. I shouldn't be forced to use recaptcha. using google CDNs is fine because one can find ways to get around it but I think it's impossible to get around recaptcha. – yukashima huksay Sep 25 '18 at 17:59
  • 2
    Then you'll just have to deal with the reality of not being able to access content that is protected by a google recaptcha. – Kevin B Sep 25 '18 at 17:59
  • 4
    Kevin Because stackexchange believes that it's users should be forced to get tracked by google? – yukashima huksay Sep 25 '18 at 18:08
  • 3
    likely moreso because it is cost effective and does a well enough job at its intended purpose. your tools blocking recaptcha is a bug. – Kevin B Sep 25 '18 at 18:10
  • 3
    There are a few tricks to prevent getting a recaptcha. The most important point is to not answer too fast. I often compose answers in an external editor and copy and paste it in the answer field. If I submit too quickly I get this dreaded thing. Better wait 5 seconds between starting an answer and submitting. I also have the impression that code only answers are more likely to trigger a recaptcha. – aloneprism Sep 25 '18 at 21:57
  • 2
    Possible duplicate of The Complete Rate-Limiting Guide – Sonic the Bracketed Hedgehog Sep 25 '18 at 22:41
  • 1
    @Sonic @ blub I usually get this when I forget to disable my VPN. but it's just a normal VPN and I don't need to do a captcha anywhere else for using this VPN unlike Tor that usually gets me in trouble everywhere. – yukashima huksay Sep 26 '18 at 4:01
  • 1
    Kevin What's more cost effective is for SE to sell all our data away. And by principle captcha is not something that is happening all the time to everyone so I wouldn't consider it to have a heavy overhead really if done locally. Also because of it's structure SE is not really such a good target for bots to post tons of nonsense questions.(gaining reputation takes much time and question/answers from new users are quickly reviewed. For that I believe such a long AI resistant external captcha is not really needed for SE and it's just annoying and too long. And it also exposes users to google. – yukashima huksay Sep 26 '18 at 4:09
  • 1
    @yukashimahuksay An amazing amount of spam gets stopped before it hits the site. And an amazing amount still gets cleared afterwords. And not all sites have active enough communities to get rid of things that quickly without help. On the other hand, this is a possibly valid concern so not really a fan of the closevotes either, – Journeyman Geek Sep 26 '18 at 5:34
  • 2
    @Journeyman: My point is that if SE was hosting a captcha service itself not much would change. And still almost the same amazing amount of spam would be stopped. And not much extra load would be added and also users would be happier because reCAPTCHA is so long and annoying. It's usually like 5-6 times longer than a normal captcha. It's not like so many companies are sitting with much resources to bypass the normal captchas with their AI if SE is using them. Because it's not really worth it in SE because they have to work so hard and even if they succeed they won't bypass the community. – yukashima huksay Sep 26 '18 at 5:42
  • Please do not use code block for anything that is not actual code. It interferes with supportive technology and makes especially longer quotes impossible to read as a single piece. – Nij Sep 27 '18 at 11:07
  • 2
    "If we trust SE it doesn't mean that we trust SE to trust other people for us and create a long trust chain which is doomed to be broken because of the second law of thermodynamics." Well, it kind of does, actually. That's how society works, and has to. Where does SE get its hardware? How about its .NET builds? Its OS? Its network connections? Its database server? Those are all from trusted third parties that are capable in principle of messing things up. Supply chain attacks can't be avoided just by saying "don't trust anyone", because you can't actually make that work. – Nathan Tuggy Sep 28 '18 at 2:51
  • @Mari-LouA My mistake, an (embarrassing) typo. Fixed. Double negatives are just confusing ;) – Sonic the Bracketed Hedgehog Sep 28 '18 at 5:40
  • @SonictheInclusiveWerehog Good to know! Still you haven't answered where you got this line from. I couldn't find it among the comments. – Mari-Lou A Sep 28 '18 at 5:41
8

Btw I get this problem whenever I use the setupVPN firefox extension.(No other website asks me for captcha when I use that extension unlike tor which usually get's me in trouble.)

Might be the core of your issue.

Now, its no secret that there's a bunch of clever things in the backend meant to stop spam. Here's a slightly outdated post on the official methods, which are the important thing here. You don't see spam precisely cause of these measures.

I'd guess that (and there's no way for me to check - and even if I could, I couldn't share this information) that there's some other user on the same VPN or proxy that's set off SE's spam detection thresholds. Not enough that they think you're a spammer, but enough that it might be worth slowing things down a little.

On the other hand, if it's a work VPN - you're trusting your workplace with your data. Otherwise, unless you run it yourself you're trusting a third (fourth?) party with the data.

There's a great reason why everyone uses some third party services for things like this.

They work. They basically save time that could be put into better Q&A sites or products that, well, make SE money.

SE also uses Imgur for image hosting - and SE uses them because once again, its something they have historically done well, and on terms that SE's pretty happy with.

Spammers ruin it for everyone don't they?

So in this specific circumstance - I really don't think there's a compromise that involves SE yanking out a pretty big part of their spam reduction strategy and rewriting it cause a few folks don't trust mega-corporations.

  • Please consider seeing the edit if you had time. I tried to clarify things a little. – yukashima huksay Sep 27 '18 at 5:14
  • Users in China cannot solve the reCAPTCHA because all Google resources are blocked. – Sonic the Bracketed Hedgehog Sep 28 '18 at 1:51
  • 2
    See, that's an entirely different issue - but OP might either consider doing the recaptcha or finding a VPN that's not setting off the captcha. Or maybe the extension. – Journeyman Geek Sep 28 '18 at 4:58
  • @Journey It's not an entirely different issue. My point with this question is disagreeing with outsourcing captcha service. My point is that captcha is something that is not so easy to bypass and it can easily ruin the privacy of people. so it's better if SE either does it from it's own servers. And there are various reasons for it. As I've stated in my edit. this question is not at all about "me" or "my vpn" it's about privacy and UX of everyone using SE. For that the UX of 1.4B people that might want to access SE from china is of course of a very high value. – yukashima huksay Sep 30 '18 at 7:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .