3 ms·
Back in 2008 (high school) I discovered this exact method enabled automatic creation of google accounts from many different visitor ip addresses, because google
by chatmasta 10y ago
Back in 2008 (high school) I discovered this exact method enabled automatic creation of google accounts from many different visitor ip addresses, because google signup form did not have csrf protection. It was possible to hide all (pre-filled) form values except the captcha from the user. So to the user it looked like they were just filling out a captcha on a random website, but actually they were creating a new google account (using their IP address).
I hadn't heard of responsible disclosure at the time. ¯\_(ツ)_/¯
- stevekemp 10y agoOnce upon a time I wrote a java applet, which looked like it was showing an animation, but was secretly calculating digits of PI. Over a period of a few months I got quite a decent result from people who'd just happened to visit my website. Not quite as malicious as your story but equally nefarious.