Hacker News Reader

Comment by klondike_ | Hacker News Reader

People usually use human powered CAPTCHA solving services nowadays

Apparently I'm barely human enough to get through those Captchas.

Exactly, deathbycaptcha is one I’ve seen in action more than 5 years ago. This stuff has been human powered for way longer than that.

how does this work? do they capture the screen and forward the captcha to some service in India?

Here's an example of a captcha-solving API: https://anti-captcha.com/apidoc/methods/createTask

They have a browser extension too, I guess it detects the displayed captcha and submits it to the API

Wow, just wow. This is amazing.

Gotta love adversarial interoperability, productionized

for recaptcha it's even simpler. Because of how it's implemented, all you have to do is send the captcha solving service the site key, and it returns a solved token.

I once heard someone (perhaps jokingly) suggest forwarding the captchas to users of some website you control - e.g. a free porn website where you have to solve a captcha every 10 images.

Recaptchas yield a code when completed succesfully, which can be transfered to a different machine to instantly solve it i think.

Finally repercussions for the sites not updating their recaptcha versions and annoying everyone with v2

"reCAPTCHA v3" despite its name is not a captcha though, it's just a very bad risk-scoring service. Bad because (1) it flags plenty of legit visitors as spammy, in a way that's probably a slamdunk GDPR lawsuit waiting to happen, and (2) apparently the returned token is still replayable - Anti Captcha claims to support v3, you can even select what score you want to have (>= 0.3/0.7/0.9) lol

Reply on news.ycombinator.com