4 ms·
A lot of comments here talk about recaptcha having a distinctive traffic signature, but I don't understand this. Why does recaptcha have a distinct signature a
by Illniyar 10y ago
A lot of comments here talk about recaptcha having a distinctive traffic signature, but I don't understand this.
Why does recaptcha have a distinct signature and if it does couldn't an attacker just make a distinct signature without recaptcha?
And why does recaptcha have a traffic signature that can distinguish between users?
I mean how does a simple request response create a distinct traffic?
- captainmuon 10y agoRight, include Javascript (or heck, just a bunch of images of different sizes) that open requests in Morse code. Long request, long request, short request, long request... Or, my favorite, the binary search (assuming you control the server / the network in front of the server / some exit nodes, and can monitor the traffic of your targeted user): have sites that cause transmissions for some time (long running JS / requests, or just a lot of content the user interacts with). Freeze 50% of the servers connections. Is the user still connecting? Then s/he is in the 50%. If not, in the other. Repeat until the is user matched to activity on the server.
- mr_potato_face 10y agoOne issue here is that recaptcha's traffic signature allows for a passive attacker. So instead of needing to modify the website a user visits, or trick them into going to a domain you control, you are able to just look at the traffic logs and identify them without them knowing. I'm not too sure about what defines the "distinctive" signature of recaptcha, but I expect timing of when packets of certain sizes were sent (e.g. loading 9 images in quick succession will generate larger packets, and then you often get the incremental couple images with human-length delays between them).