3 ms·

Fascinating. You'd think the captcha would have implemented a check to ensure it was completed out on the same device.

KirillPanov 5y ago
The captcha-solving services reverse-proxy requests from the human-for-hire through the botmaster's headless browser. In other words, all the javascript runs on the botmaster's machine. Only the images (or screenshots) are sent to the human-for-hire, and clicks/screenshots are sent back from the human-for-hire to the botmaster. This is the whole point of this article: device detection is generally a false sense of security.
- toast0 5y ago
  These sorts of things increase the cost (you had to pay humans to do captchas and to setup the system), which can help. It really depends on what the benefits of bypassing the detection are and if those benefits can be had elsewhere at lower cost. For ticket sales or limited run product sales or similar things, the benefits of buying (and presumbably reselling) the limited item is high, and there's a limit to what you can do to detect humans (and as you've described it can be counter productive). For spam prevention, making it cost more to spam means spammers are encouraged to find somewhere else to spam, which is good for your users (while using your product anyway). But it won't stop everything, some people are going to manually type their spams, and some people will build robots to tap out their spams more like a person; and if you ruin the experience for users (especially new users) that doesn't work either; a network with zero messages is spam free, but doesn't help anyone.
  - coldacid 5y ago
    If you know where to look, the human labour is almost free compared to the profit you could be making.
    - 867-5309 5y ago
      indeed. ~$0.15 per captcha for >$200 sneakers is nothing. it may be shady but people are making a living filling out captchas all day. "Want easy stable income? All you need is a computer!"

The captcha-solving services reverse-proxy requests from the human-for-hire through the botmaster's headless browser. In other words, all the javascript runs on the botmaster's machine. Only the images (or screenshots) are sent to the human-for-hire, and clicks/screenshots are sent back from the human-for-hire to the botmaster. This is the whole point of this article: device detection is generally a false sense of security.

toast0 5y ago
These sorts of things increase the cost (you had to pay humans to do captchas and to setup the system), which can help. It really depends on what the benefits of bypassing the detection are and if those benefits can be had elsewhere at lower cost. For ticket sales or limited run product sales or similar things, the benefits of buying (and presumbably reselling) the limited item is high, and there's a limit to what you can do to detect humans (and as you've described it can be counter productive). For spam prevention, making it cost more to spam means spammers are encouraged to find somewhere else to spam, which is good for your users (while using your product anyway). But it won't stop everything, some people are going to manually type their spams, and some people will build robots to tap out their spams more like a person; and if you ruin the experience for users (especially new users) that doesn't work either; a network with zero messages is spam free, but doesn't help anyone.
- coldacid 5y ago
  If you know where to look, the human labour is almost free compared to the profit you could be making.
  - 867-5309 5y ago
    indeed. ~$0.15 per captcha for >$200 sneakers is nothing. it may be shady but people are making a living filling out captchas all day. "Want easy stable income? All you need is a computer!"