6 ms·

Interesting. Two things that I found interesting: 1) ip addresses he uses have probably really good reputation, because even with rather bad image recognition

by Hitton 6y ago

Interesting. Two things that I found interesting: 1) ip addresses he uses have probably really good reputation, because even with rather bad image recognition ability it still lets him in. 2) surprisingly enough google's captcha apparently doesn't consider mouse movements at all - the bot selects images rapidly one immediately after another and always clicks in the same place of image.

comboy 6y ago
If I were Google, I would let it pass (at least where it's not in my own services, not in crucial places), and use that obviously simple heuristic for machine learning so that distinction between human and robot can be taught using many other available variables. Well, I wouldn't really do that if I were Google. But I think it could be happening.
- gnopgnip 6y ago
  Google doesn't pass or fail, it gives a score and leaves it up to the site operator.
  - comboy 6y ago
    s/let it pass/give lower score Although I admit my idea looks less probable this way. It's still less ridiculous to me that not using keyboard or mouse data. But on the other hand they may be afraid of people screaming "Google is sending your keystrokes to their servers" etc.
  - saagarjha 6y ago
    They only did that so they could shift the blame/responsibility of making the classification to website operators instead of themselves.
    - chris_va 6y ago
      It's a library for web developers... Is it so terrible to return a float instead of a bool?
      - saagarjha 6y ago
        Yes, because it's going to return a small float for anything that Google thinks is "suspicious" (including using Safari or Firefox) and websites will block it as if Google returned "no", except Google is absolved of the criticism that they return bad results for people who value their privacy ("if you don't like it, you should set your confidence lower…")
  - chrismorgan 6y ago
    You’re dealing with two different things. reCAPTCHA v2 and the badly named Invisible reCAPTCHA¹ assess the user and either let them in, or gate them on puzzle solving. So, it does pass or fail you, where fail means trap you in purgatory indefinitely (though some hold it’s actually hell rather than purgatory). reCAPTCHA v3 never presents a CAPTCHA for you to solve, but decides a score (in practice, I’ve only seen 0.1, 0.3, 0.7 and 0.9) where higher means it’s feeling more friendly towards you, and it’s up to the site operator to decide what to do with it. (You should provide alternative means, e.g. if you’re doing fraud prevention for signup, fall back to SMS verification. Too many sites provide no recourse for a low score, which is illegal to do in various countries on accessibility grounds. With reCAPTCHA v2 and Invisible reCAPTCHA the site owners can at least blame Google, not that that gets them off the hook.) Given the use of Rekognition here, I presume this project is breaking reCAPTCHA v2 and possibly Invisible reCAPTCHA, and not reCAPTCHA v3. ——— ¹ I call Invisible reCAPTCHA badly named because it’s only invisible on the happy path—all it’s doing is hiding the “I’m not a robot” widget, effectively having the code “click” it when submitting. And given that reCAPTCHA v3 is then invisible, never showing anything to the user… yeah, it’s confusing. Arguably reCAPTCHA v3 isn’t even a CAPTCHA any more either, so… yeah, the names are all a bit of a mess.
    - notatoad 6y ago
      your comment is reasonable, using rekognition for recaptcha v3 wouldn't seem to make sense. but the linked source code is pretty clearly interpreting scores and referencing recaptcha v3, so i'm not sure what images they're running rekognition on. (unless there's a bunch of stuff going on in this repo and this file is unrelated to the title) https://bitbucket.org/Pirates-of-Silicon-Hills/voightkampff/src/master/checkScore.sh https://bitbucket.org/Pirates-of-Silicon-Hills/voightkampff/...
      - chrismorgan 6y ago
        It seems to be using the reCAPTCHA v3 score to guess how reCAPTCHA v2 will behave, and therefore influence its behaviour so it doesn’t dig itself into a ditch. (c.f. main.sh lines 755–758, notabot.sh lines 47–57.)
    - deleted 6y ago
  - notatoad 6y ago
    they suggest a default 0.5 threshold in their documentation. if you're testing "passing" their captcha, it'd be pretty reasonable to consider anything below that a fail.
lights0123 6y ago
> surprisingly enough google's captcha apparently doesn't consider mouse movements at all - the bot selects images rapidly one immediately after another and always clicks in the same place of image Yep, it's Google cookie based, not behavior on the page. You can only use the tab and enter key to successfully complete the captcha if you have enough Google cookies.
- jb_s 6y ago
  isnt it ultimately just a series of API calls to solve the captchas? whats to stop someone hooking the javascript, solving the images and then raising the right event ?
  - milankragujevic 6y ago
    I would assume Google would send all mouse events to the server, then compare them with all other mouse events from all users who solve reCaptchas and then decide on a "humanness rating" of the data internally and use that alongside all other parameters to decide the probability the user is or is not a bot. You can't fake that, you can send fake events but you can't trick Google for long enough, sooner or later it would figure out a pattern and mark that pattern as a bot. Well, if it did track mouse movements, which it apparently does not. But it can start at any time.
    - guru4consulting 6y ago
      probably Google is already working on it. But what if the device is mobile or tablet (or touch screen laptop) where captchas are solved without mouse movement? I guess that could be the reason why Google has not implemented it yet.
      - milankragujevic 6y ago
        Possibly. They could also track device information like motion sensors, which are available without a prompt by default on Chrome, and use the motion information from the device to decide on the randomness of the movement. In the worst case, they can just show you 5 walls of captchas and pass you.

by Hitton 6y ago

comboy 6y ago

If I were Google, I would let it pass (at least where it's not in my own services, not in crucial places), and use that obviously simple heuristic for machine learning so that distinction between human and robot can be taught using many other available variables. Well, I wouldn't really do that if I were Google. But I think it could be happening.

gnopgnip 6y ago
Google doesn't pass or fail, it gives a score and leaves it up to the site operator.
- comboy 6y ago
  s/let it pass/give lower score Although I admit my idea looks less probable this way. It's still less ridiculous to me that not using keyboard or mouse data. But on the other hand they may be afraid of people screaming "Google is sending your keystrokes to their servers" etc.
- saagarjha 6y ago
  They only did that so they could shift the blame/responsibility of making the classification to website operators instead of themselves.
  - chris_va 6y ago
    It's a library for web developers... Is it so terrible to return a float instead of a bool?
    - saagarjha 6y ago
      Yes, because it's going to return a small float for anything that Google thinks is "suspicious" (including using Safari or Firefox) and websites will block it as if Google returned "no", except Google is absolved of the criticism that they return bad results for people who value their privacy ("if you don't like it, you should set your confidence lower…")
- chrismorgan 6y ago
  You’re dealing with two different things. reCAPTCHA v2 and the badly named Invisible reCAPTCHA¹ assess the user and either let them in, or gate them on puzzle solving. So, it does pass or fail you, where fail means trap you in purgatory indefinitely (though some hold it’s actually hell rather than purgatory). reCAPTCHA v3 never presents a CAPTCHA for you to solve, but decides a score (in practice, I’ve only seen 0.1, 0.3, 0.7 and 0.9) where higher means it’s feeling more friendly towards you, and it’s up to the site operator to decide what to do with it. (You should provide alternative means, e.g. if you’re doing fraud prevention for signup, fall back to SMS verification. Too many sites provide no recourse for a low score, which is illegal to do in various countries on accessibility grounds. With reCAPTCHA v2 and Invisible reCAPTCHA the site owners can at least blame Google, not that that gets them off the hook.) Given the use of Rekognition here, I presume this project is breaking reCAPTCHA v2 and possibly Invisible reCAPTCHA, and not reCAPTCHA v3. ——— ¹ I call Invisible reCAPTCHA badly named because it’s only invisible on the happy path—all it’s doing is hiding the “I’m not a robot” widget, effectively having the code “click” it when submitting. And given that reCAPTCHA v3 is then invisible, never showing anything to the user… yeah, it’s confusing. Arguably reCAPTCHA v3 isn’t even a CAPTCHA any more either, so… yeah, the names are all a bit of a mess.
  - notatoad 6y ago
    your comment is reasonable, using rekognition for recaptcha v3 wouldn't seem to make sense. but the linked source code is pretty clearly interpreting scores and referencing recaptcha v3, so i'm not sure what images they're running rekognition on. (unless there's a bunch of stuff going on in this repo and this file is unrelated to the title) https://bitbucket.org/Pirates-of-Silicon-Hills/voightkampff/src/master/checkScore.sh https://bitbucket.org/Pirates-of-Silicon-Hills/voightkampff/...
    - chrismorgan 6y ago
      It seems to be using the reCAPTCHA v3 score to guess how reCAPTCHA v2 will behave, and therefore influence its behaviour so it doesn’t dig itself into a ditch. (c.f. main.sh lines 755–758, notabot.sh lines 47–57.)
  - deleted 6y ago
- notatoad 6y ago
  they suggest a default 0.5 threshold in their documentation. if you're testing "passing" their captcha, it'd be pretty reasonable to consider anything below that a fail.

lights0123 6y ago

> surprisingly enough google's captcha apparently doesn't consider mouse movements at all - the bot selects images rapidly one immediately after another and always clicks in the same place of image Yep, it's Google cookie based, not behavior on the page. You can only use the tab and enter key to successfully complete the captcha if you have enough Google cookies.

jb_s 6y ago
isnt it ultimately just a series of API calls to solve the captchas? whats to stop someone hooking the javascript, solving the images and then raising the right event ?
- milankragujevic 6y ago
  I would assume Google would send all mouse events to the server, then compare them with all other mouse events from all users who solve reCaptchas and then decide on a "humanness rating" of the data internally and use that alongside all other parameters to decide the probability the user is or is not a bot. You can't fake that, you can send fake events but you can't trick Google for long enough, sooner or later it would figure out a pattern and mark that pattern as a bot. Well, if it did track mouse movements, which it apparently does not. But it can start at any time.
  - guru4consulting 6y ago
    probably Google is already working on it. But what if the device is mobile or tablet (or touch screen laptop) where captchas are solved without mouse movement? I guess that could be the reason why Google has not implemented it yet.
    - milankragujevic 6y ago
      Possibly. They could also track device information like motion sensors, which are available without a prompt by default on Chrome, and use the motion information from the device to decide on the randomness of the movement. In the worst case, they can just show you 5 walls of captchas and pass you.