4 ms·

Seems like bullshit. I know there are some pieces of software that can bypass CAPTCHA at a low success rate but certainly not at a high enough rate to be a both

Seems like bullshit. I know there are some pieces of software that can bypass CAPTCHA at a low success rate but certainly not at a high enough rate to be a bother, especially when the CAPTCHA settings are turned up (e.g. multiple challenges in a row).

klondike_ 5y ago
People usually use human powered CAPTCHA solving services nowadays
- paranorman 5y ago
  Exactly, deathbycaptcha is one I’ve seen in action more than 5 years ago. This stuff has been human powered for way longer than that.
- bstar77 5y ago
  Apparently I'm barely human enough to get through those Captchas.
- mrkentutbabi 5y ago
  how does this work? do they capture the screen and forward the captcha to some service in India?
  - flotzam 5y ago
    Here's an example of a captcha-solving API: https://anti-captcha.com/apidoc/methods/createTask https://anti-captcha.com/apidoc/methods/createTask They have a browser extension too, I guess it detects the displayed captcha and submits it to the API
    - mrkentutbabi 5y ago
      Wow, just wow. This is amazing.
      - flotzam 5y ago
        Gotta love adversarial interoperability, productionized
  - deleted 5y ago
    [deleted]
  - gruez 5y ago
    for recaptcha it's even simpler. Because of how it's implemented, all you have to do is send the captcha solving service the site key, and it returns a solved token.
  - michaelt 5y ago
    I once heard someone (perhaps jokingly) suggest forwarding the captchas to users of some website you control - e.g. a free porn website where you have to solve a captcha every 10 images.
  - schleck8 5y ago
    Recaptchas yield a code when completed succesfully, which can be transfered to a different machine to instantly solve it i think. Finally repercussions for the sites not updating their recaptcha versions and annoying everyone with v2
    - flotzam 5y ago
      "reCAPTCHA v3" despite its name is not a captcha though, it's just a very bad risk-scoring service. Bad because (1) it flags plenty of legit visitors as spammy, in a way that's probably a slamdunk GDPR lawsuit waiting to happen, and (2) apparently the returned token is still replayable - Anti Captcha claims to support v3, you can even select what score you want to have (>= 0.3/0.7/0.9) lol
the_only_law 5y ago
Just ran through their job site sign up. Didn’t encounter a captcha or email verification to get to a job application form. I did encounter a password field bad enough that password management software generated passwords aren’t allowed but “Password12345” is.
michaelt 5y ago
I can believe the developer found the job application form didn't have a CAPTCHA or IP rate limit at the time. Presumably it will soon gain one, if it hasn't already.
sdfaksdfjalj 5y ago
They're using SAP SuccessFactors saas. I'm not sure about the features that platform has, but other easy ways to block the spam would be email verification, shadowban with silent captcha, or turning up cloudflare anti-bot to maximum.
mumphster 5y ago
You can solve 1k captchas for $1 at 80% success, they're trivial to bypass

klondike_ 5y ago

People usually use human powered CAPTCHA solving services nowadays

paranorman 5y ago
Exactly, deathbycaptcha is one I’ve seen in action more than 5 years ago. This stuff has been human powered for way longer than that.
bstar77 5y ago
Apparently I'm barely human enough to get through those Captchas.
mrkentutbabi 5y ago
how does this work? do they capture the screen and forward the captcha to some service in India?
- flotzam 5y ago
  Here's an example of a captcha-solving API: https://anti-captcha.com/apidoc/methods/createTask https://anti-captcha.com/apidoc/methods/createTask They have a browser extension too, I guess it detects the displayed captcha and submits it to the API
  - mrkentutbabi 5y ago
    Wow, just wow. This is amazing.
    - flotzam 5y ago
      Gotta love adversarial interoperability, productionized
- deleted 5y ago
  [deleted]
- gruez 5y ago
  for recaptcha it's even simpler. Because of how it's implemented, all you have to do is send the captcha solving service the site key, and it returns a solved token.
- michaelt 5y ago
  I once heard someone (perhaps jokingly) suggest forwarding the captchas to users of some website you control - e.g. a free porn website where you have to solve a captcha every 10 images.
- schleck8 5y ago
  Recaptchas yield a code when completed succesfully, which can be transfered to a different machine to instantly solve it i think. Finally repercussions for the sites not updating their recaptcha versions and annoying everyone with v2
  - flotzam 5y ago
    "reCAPTCHA v3" despite its name is not a captcha though, it's just a very bad risk-scoring service. Bad because (1) it flags plenty of legit visitors as spammy, in a way that's probably a slamdunk GDPR lawsuit waiting to happen, and (2) apparently the returned token is still replayable - Anti Captcha claims to support v3, you can even select what score you want to have (>= 0.3/0.7/0.9) lol

the_only_law 5y ago

Just ran through their job site sign up. Didn’t encounter a captcha or email verification to get to a job application form. I did encounter a password field bad enough that password management software generated passwords aren’t allowed but “Password12345” is.

michaelt 5y ago

I can believe the developer found the job application form didn't have a CAPTCHA or IP rate limit at the time. Presumably it will soon gain one, if it hasn't already.

sdfaksdfjalj 5y ago

They're using SAP SuccessFactors saas. I'm not sure about the features that platform has, but other easy ways to block the spam would be email verification, shadowban with silent captcha, or turning up cloudflare anti-bot to maximum.

mumphster 5y ago

You can solve 1k captchas for $1 at 80% success, they're trivial to bypass