ReBreakCaptcha: Breaking Google’s ReCaptcha v2 Using Google
east-ee.com
east-ee.com
For example, one common use of a captcha is, essentially, rate-limiting in a non-spam prevention context. It's arguable that rate-limiting should be implemented differently, but captchas are actually fairly effective for rate-limiting regardless. Websites that feature things like gift card numbers typically put captchas on lookups and validations to prevent people from simply brute-forcing them (especially if they do not use gift card pins). In scenarios like that, you don't want spammers to be able to bypass captchas, but if they fundamentally can, at least it costs them money.
On the other hand, explicitly supporting captcha avoidance as a revenue stream, however, presents malicious users with the same opportunity that parents get if you offer to fine them for being late to pick up their children from daycare. You've just implicitly given them a choice that was not really allowed before, and they'll happily pay you directly instead of the shady API they have to use to get rid of the captcha.
So to sum up - captchas aren't fun, but in principle you really don't want there to be a consistent method for cheaply bypassing them (whether grey market or officially supported) if the expected value of doing so is significantly higher than the cost.
Which presents this, in a comment at the top of the returned js:
Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t
That decodes to: botguard-contact@google.com
http://stackoverflow.com/questions/21762076/why-does-gmail-u...
I get a recaptcha every time I log into hilton to book a hotel room for a trip. That's the only site this happens on; I wonder what I'm doing to trigger it.
The person you're replying to has a different issue. The way the one button captcha works is by using your cookies to try to figure out if you're a real human user or a robot. If you clear your cookies, you'll almost always get the captcha.
Surely, CAPTCHA wasn't replaced with something less dificult for machines to solve.
Have you seen research to indicate this?
Perhaps my grammar wasn't correct there though.
In any case, check out the blackhat presentation about using Google's image recognition to solve the image based captchas. There are a wide variety of fairly advanced image recognition tools but a surprisingly small number of complex text recognition ones.
https://arxiv.org/abs/1312.6082
So humans have to clear higher and higher hurdles to prove themselves human while the computers use the answers from the captchas to get closer to humans' capabilities.
Haven't tried such plugin myself, but I know it exists: https://antcpt.com/eng/home.html
https://motherboard.vice.com/en_us/article/the-man-who-broke...
The EFF and others were pretty dismayed with this, and felt it should have been a civil, and not criminal matter.
Since that time, Congress also passed a "Bots Law" that specifically spells out gaming online tickets as "treated as unfair or deceptive acts or practices under the Federal Trade Commission Act." [2] I suspect this opens a door for larger fines as well.
[1] https://www.wired.com/2010/11/wiseguys-plead-guilty/
[2] https://www.congress.gov/bill/114th-congress/senate-bill/318...
> I’ve testing in 3 examples, and none had the correct answer: first one only detected 3 out of 6 numbers, the seconds had 10 digits, one of them wrong, and the third couldn’t recognise.
> Also, it seams that google implement a max number of retries for audio challenge."custom work (even in the presence of scrambled approaches) and servers instead of mobiles both make this approach problematic.
But, it is not exploitable - when Google identified high volvume attacks, the voice captcha is changed into a more complex voice which cannot be identified via this tool.
A Proof of Concept was already created by AppSec Labs, in Sep 2016: https://www.youtube.com/watch?v=4yec-vxN0BY
Also, does google offer an audio captcha every single time? Even for very high risk profiles?
> Also, does google offer an audio captcha every single
> time? Even for very high risk profiles?
It might be a legal requirement from the ADA.