Hacker News Reader

Comment by ricg | Hacker News Reader

It's definitely not only relying on cursor movements. A simple $('iframe').contents().find('.recaptcha-checkbox-checkmark').click() proved that I'm not a robot, without me touching the mouse.

View on HN

The cursor movement story seems to be a smokescreen to dilute the fact they're actually running an internet wide monitoring network, tracking users from site to site and building profiles on them.

I was confused about all of this until I read your comment. Makes perfect sense now!

Also makes me think that they can dump the whole charade and provide no security check at all, but that'd probably make the service-providers uncomfortable and they lose the user as a source of human-intelligence for classifying things on google image searches.

I'm not sure where cursor movement was mentioned, other than the comments.

I read it in the wired.com article about this also submitted to HN: "And [Vinay] Shet says even the tiny movements a user’s mouse makes as it hovers and approaches a checkbox can help reveal an automated bot."

Sounds like if I 'Tab' to the field & hit enter I must be a bot....

I guess it's a lot more complicated than it looks at a cursory glance.

It's almost as if Google is playing its cards close to its chest to avoid tipping off people intent on defeating it's captchas!

I tested it a few times in their demo trying hard to to funny things with the mouse pointer. Still I was asked to type in some text all the time.

Then I logged into my gmail account and yes it worked.

So you're probably right about that smoke screen and it has nothing to do at all with mouse movement.

My fx browser deletes cookies at exit and my IP changes frequently and I think that's the true explanation for the outcome of my little test.

To be fair, any service or site - Facebook, Twitter, Google Analytics, etc - that encourages your putting their code or widgets or whatever on your site is doing exactly that in addition to listing out which of your friends "like this".

Which is why Google Analytics is free for site operators.

Makes perfect sense. This is Google's response to the Facebook 'Like' button [tracker]

Then what is Google Analytics?

can be blocked without any impact on the browsing experience.

I tried this demo (https://www.google.com/recaptcha/api2/demo) in a new incognito window. Then in devtools:

  javascript:if(!window.jQuery||confirm('Overwrite\x20current\x20version?\x20v'+jQuery.fn.jquery))(function(d,s){s=d.createElement('script');s.src='https://ajax.googleapis.com/ajax/libs/jquery/1.8/jquery.js';(d.head||d.documentElement).appendChild(s)})(document);
  $('iframe').contents().find('.recaptcha-checkbox-checkmark').click()

I got an extra verification (enter two bits of text)

Probably the incognito window. It seems to rely heavily on cookies (likely linked to their analytics data.)

At best this would be just trigger another arms race with people developing bots to trigger a series of "human-like" mouse events, which I'd imagine is a far-simpler problem than OCR.

Not to mention that it could only be used as a heuristic and not a test; so, eventually the weight of that heuristic will just be reduced to zero once someone publishes humanlike_mouse_driver.js with carefully-tuned-to-look-statistically-human mouse interactions available out of the box.

You know a peculiar thing that humans do? They do things slowly. You know what bot (programmers) hate doing? Doing things slowly. When you've got bots that are diving through thousands of registration forms per minute, and suddenly you need to slow them down to 15 seconds per form, well, that's already an enormous win for the site owners, even if it makes the new captcha fail (if the quoted statistic of 99.8% of captchas being solvable by bots is correct).

Are you logged into Google? If you have their cookies it's one indication you're not a robot.

Wouldn't it be possible to just tune bots easier now instead of having to work with OCR?

I strongly believe it is the bot detection .. They may also added extra checks to already logged users

I wonder if you used a Google account in good standing for a bot, at what point would they start to detect it was a bot? I imagine if you used it for more than a few CAPTCHAs daily you'd probably end up having to do additional validation.

Interestingly I logged out of my Google account in Chrome and immediately got an old style CAPTCHA. But not when I logged out in Safari (I very rarely use Safari).

Edit- Nevermind, it looks like Safari left some google.com cookie lying around while Chrome deleted it. Deleting it gave me the old CAPTCHA.

Which is a bad idea.

I actually have some bots which scrape Google sites (for the purpose of integrating stuff like Google Keep into KRunner), and they just use the Useragent of a regular phone, send normal POST data, etc. Works perfectly fine, and — I just checked — this bot is recognized as normal user by this captcha system. No Captcha input.

I tried it even with a new Google profile and just using cURL to log into Google, then started a new browser session and imported the cookies from cURL. Worked just as well.

I guess this makes it easier for malicious bot-authors...

Reply on news.ycombinator.com