8
24
Fork
You've already forked nuMatrix
4

Add cookie-less Google Captcha ruleset into defaults? #1109

Open
opened 2023年10月29日 11:59:08 +01:00 by arek · 7 comments
Owner
Copy link

Submitted by: Kein
Submitted at: 2020年08月13日T06:13:38Z

Current Google Captcha ruleset in default recipes is as follows:
github.com/uBlockOrigin/uAssets@1becdb3962/recipes/recipes_en.txt (L116) 

Google reCaptcha
	* www.google.com
		_ www.google.com *
		_ www.google.com script
		_ www.google.com frame
		_ www.gstatic.com *
		_ www.gstatic.com script

I've been extensively testing a version of the ruleset where cookies always blocked and it never resulted in any failure or inconvenience. Google has few thousands more way to track you and your session, which it demonstrated multiple ways by silently passing Captcha for me (in fact without even allowing it fully with web-workers) on a completely different resource just because I had high completion rate elsewhere.
May be something like Google reCaptcha No Cookies in addition just like there are YT No Account and YT with Account

Submitted by: [Kein](https://github.com/Kein) Submitted at: [2020年08月13日T06:13:38Z](https://github.com/uBlockOrigin/uMatrix-issues/issues/285) ----- Current Google Captcha ruleset in default recipes is as follows: https://github.com/uBlockOrigin/uAssets/blob/1becdb39620374698e131341fbb504a3630a2267/recipes/recipes_en.txt#L116 ``` Google reCaptcha * www.google.com _ www.google.com * _ www.google.com script _ www.google.com frame _ www.gstatic.com * _ www.gstatic.com script ``` I've been extensively testing a version of the ruleset where cookies always blocked and it never resulted in any failure or inconvenience. Google has few thousands more way to track you and your session, which it demonstrated multiple ways by silently passing Captcha for me (in fact without even allowing it fully with web-workers) on a completely different resource just because I had high completion rate elsewhere. May be something like `Google reCaptcha No Cookies` in addition just like there are `YT No Account` and `YT with Account`
Author
Owner
Copy link

Submitted by: gwarser
Submitted at: 2020年08月15日T08:38:08Z

Sadly no one is reviewing recipes, and updates stalled for long now.

Submitted by: [gwarser](https://github.com/gwarser) Submitted at: [2020年08月15日T08:38:08Z](https://github.com/uBlockOrigin/uMatrix-issues/issues/285#issuecomment-674369045) ----- Sadly no one is reviewing recipes, and updates stalled for long now.
Author
Owner
Copy link

Submitted by: Kein
Submitted at: 2020年08月15日T08:42:59Z

Who is supposed to review them and if he is no longer capable of doing it then may be someone else can take on it?

Submitted by: [Kein](https://github.com/Kein) Submitted at: [2020年08月15日T08:42:59Z](https://github.com/uBlockOrigin/uMatrix-issues/issues/285#issuecomment-674369450) ----- Who is supposed to review them and if he is no longer capable of doing it then may be someone else can take on it?
Author
Owner
Copy link

Submitted by: madduck
Submitted at: 2020年08月20日T01:37:03Z

@Kein go ahead and fork, and convince people to migrate. If you prove that you'll be better, I'll switch.

Submitted by: [madduck](https://github.com/madduck) Submitted at: [2020年08月20日T01:37:03Z](https://github.com/uBlockOrigin/uMatrix-issues/issues/285#issuecomment-676845387) ----- @Kein go ahead and fork, and convince people to migrate. If you prove that you'll be better, I'll switch.
Author
Owner
Copy link

Submitted by: Kein
Submitted at: 2020年08月20日T09:57:33Z

go ahead and fork, and convince people to migrate.

You know the irony is lost here because this almost (0.001%) never happens?

Submitted by: [Kein](https://github.com/Kein) Submitted at: [2020年08月20日T09:57:33Z](https://github.com/uBlockOrigin/uMatrix-issues/issues/285#issuecomment-677501622) ----- > go ahead and fork, and convince people to migrate. You know the irony is lost here because this almost (0.001%) never happens?
Author
Owner
Copy link

Submitted by: gorhill
Submitted at: 2020年08月20日T10:44:52Z

Another option is to create and maintain a recipes file, and if it's good users will be motivated to import it. Just like filter lists in uBO, recipes in uMatrix can be from external contributions.

Submitted by: [gorhill](https://github.com/gorhill) Submitted at: [2020年08月20日T10:44:52Z](https://github.com/uBlockOrigin/uMatrix-issues/issues/285#issuecomment-677521417) ----- Another option is to create and maintain a recipes file, and if it's good users will be motivated to import it. Just like filter lists in uBO, recipes in uMatrix can be from external contributions.
Author
Owner
Copy link

Submitted by: Kein
Submitted at: 2020年08月20日T11:10:22Z

What the issue maintaining built-in by default solution and have nice things instead of spreading the requirements for extensions across multiple sources and projects. At this point Ubuntu installation process is more streamlined then a single browser extensions, jesus christ.

Why it always have to be such a mess.

Submitted by: [Kein](https://github.com/Kein) Submitted at: [2020年08月20日T11:10:22Z](https://github.com/uBlockOrigin/uMatrix-issues/issues/285#issuecomment-677535112) ----- What the issue maintaining built-in by default solution and have nice things instead of spreading the requirements for extensions across multiple sources and projects. At this point Ubuntu installation process is more streamlined then a single browser extensions, jesus christ. Why it always have to be such a mess.
Author
Owner
Copy link

Submitted by: Kein
Submitted at: 2020年08月20日T14:30:14Z

And by the way, rulesets are bugged. Here is my custom ruleset as per recipe:

Google New ReCaptcha
	* www.google.com
		_ www.gstatic.com script
		_ www.gstatic.com css
		_ www.gstatic.com image
		_ www.google.com frame
		_ www.google.com script
		_ www.google.com xhr
		_ www.google.com image
		_ www.google.com css
		no-workers: _ false

Here is how it looks like when suggested (not applied) and in the uMatrix dashboard my manual rule setup for the domain:
image

If I reset my rules for the domain and try to apply my ruleset which clearly does not allow cookies I get this:
image

It allowed cookies.

What's being applied by ruleset:

no-workers: domaintools.com false
domaintools.com www.google.com * allow
domaintools.com www.google.com frame allow
domaintools.com www.google.com script allow
domaintools.com www.gstatic.com css allow
domaintools.com www.gstatic.com image allow
domaintools.com www.gstatic.com script allow

What should be applied:

no-workers: domaintools.com false
domaintools.com www.google.com css allow
domaintools.com www.google.com fetch allow
domaintools.com www.google.com frame allow
domaintools.com www.google.com image allow
domaintools.com www.google.com script allow
domaintools.com www.gstatic.com css allow
domaintools.com www.gstatic.com image allow
domaintools.com www.gstatic.com script allow
Submitted by: [Kein](https://github.com/Kein) Submitted at: [2020年08月20日T14:30:14Z](https://github.com/uBlockOrigin/uMatrix-issues/issues/285#issuecomment-677701222) ----- And by the way, rulesets are bugged. Here is my custom ruleset as per recipe: ``` Google New ReCaptcha * www.google.com _ www.gstatic.com script _ www.gstatic.com css _ www.gstatic.com image _ www.google.com frame _ www.google.com script _ www.google.com xhr _ www.google.com image _ www.google.com css no-workers: _ false ``` Here is how it looks like when suggested (**not applied**) and in the uMatrix dashboard my manual rule setup for the domain: ![image](https://user-images.githubusercontent.com/623756/90784838-5d236400-e30a-11ea-83a5-95b35fed37c9.png) If I reset my rules for the domain and try to apply my ruleset which clearly does not allow cookies I get this: ![image](https://user-images.githubusercontent.com/623756/90785218-c60adc00-e30a-11ea-9dd7-05bc5173f46c.png) It allowed cookies. What's being applied by ruleset: ``` no-workers: domaintools.com false domaintools.com www.google.com * allow domaintools.com www.google.com frame allow domaintools.com www.google.com script allow domaintools.com www.gstatic.com css allow domaintools.com www.gstatic.com image allow domaintools.com www.gstatic.com script allow ``` What should be applied: ``` no-workers: domaintools.com false domaintools.com www.google.com css allow domaintools.com www.google.com fetch allow domaintools.com www.google.com frame allow domaintools.com www.google.com image allow domaintools.com www.google.com script allow domaintools.com www.gstatic.com css allow domaintools.com www.gstatic.com image allow domaintools.com www.gstatic.com script allow ```
arek added this to the (deleted) project 2023年11月06日 21:33:30 +01:00
arek added this to the (deleted) project 2026年06月19日 10:25:42 +02:00
Sign in to join this conversation.
No Branch/Tag specified
master
dev
v0.1.2
v0.1
0.0.0.8b
0.0.0.7b
0.0.0.5b
0.0.0.4b
0.0.0.3b
0.0.0.2b
0.0.0.1b
1.4.3b0
1.4.2
1.4.1b6
1.4.1b5
1.4.1b4
1.4.0
1.3.17b2
1.3.17b1
1.3.16
1.3.14
1.3.12
1.3.10
1.3.8
1.3.6
1.3.4
1.3.3b9
1.3.3b8
1.3.2
1.3.0
1.2.0
1.1.20
1.1.18
1.1.16
1.1.14
1.1.12
1.1.11b0
1.1.10
1.1.8
1.1.7rc0
1.1.7b0
1.1.6
1.1.4
1.1.0
1.0.0
0.9.3.6
0.9.3.4
0.9.3.3
0.9.3.2
0.9.3.1
0.9.3.0
0.9.2.1
0.9.2.0
0.9.1.2
0.9.1.1
0.9.1.0
0.9.0.1
0.9.0.0
0.8.1.4
0.8.1.3
0.8.1.1
0.8.1.0
0.8.0.1
0.8.0.0
0.8.0.0-rc.2
0.8.0.0-rc.1
0.8.0.0-rc.0
0.8.0.0-alpha.19
0.8.0.0-alpha.18
0.8.0.0-alpha.17
0.8.0.0-alpha.16
0.8.0.0-alpha.15
0.8.0.0-alpha.14
0.8.0.0-alpha.11
0.8.0.0-alpha.10
0.8.0.0-alpha.9
0.8.0.0-alpha.8
0.8.0.0-alpha.7
0.8.0.0-alpha.6
0.8.0.0-alpha.4
0.8.0.0-alpha.3
0.8.0.0-alpha.2
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
arek/nuMatrix#1109
Reference in a new issue
arek/nuMatrix
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?