HN Explorer

Ask HN: Google Captchas on HN

2 points by auslander ↗ HN
I started getting captchas on every login last week. Can embedded Google captcha script access pre-filled login and password values, which are on same login page? If so, is HN potentially leaking this to Google?

I think the only valid place for captchas is account registration page, not login page.

Might be relevant: https://github.com/google/recaptcha/issues/107

6 comments

[ 0.93 ms ] story [ 30.6 ms ] thread
ColinWright
https://news.ycombinator.com/item?id=20977641

https://news.ycombinator.com/item?id=20965682

https://news.ycombinator.com/item?id=20783482

auslander
> jacquesm: Ugh. Apparently this happens when HN is under attack.

> dang: .. We turned it on temporarily because HN was under attack by an account-stealing botnet.

Is HN is still under attack or it was last week? I'm still getting captchas on every login for last few (5) days.

ColinWright
This is a question only the mods can answer, and the guidelines ask that you email them directly rather than posting questions that they might not see.
auslander
Agree. My mistake, I asked wrong question. I'm much more interested in whether Google Captcha's script can access on-same-page form with already filled credentials, so they can link login with IP address. Password is another question.
auslander
I believe HN using Google script / service is very wrong. Google is an Ad company.