4 ms·
If I'm being honest, I was being charitable to the paper in the spirit of HN guidelines. Figure 1 and Figure 2 clearly shows interaction with reCAPTCHA v2. The
by runnerup 4y ago
If I'm being honest, I was being charitable to the paper in the spirit of HN guidelines. Figure 1 and Figure 2 clearly shows interaction with reCAPTCHA v2. The language of the paper also evokes reCAPTCHA v2 and suggests that those figures were not just for reader enrichment:
> Abstract: We present a Reinforcement Learning (RL) methodology to bypass Google reCAPTCHA v3. We formulate the problem as a grid world where the agent learns how to move the mouse and click on the reCAPTCHA button to receive a high score.
> 2.2 Settings: To pass the reCAPTCHA test, a human user will move his mouse starting from an initial position, perform a sequence of steps until reaching the reCAPTCHA check-box and clicking on it.
So I was responding for reCAPTCHA v2 where you'd call:
grecaptcha.render('recaptcha-container', {
'sitekey': 'your_site_key',
'theme': 'light'
});
But like honestly there are so many methods not discussed in this paper that sort of invalidate the conclusion. They don't "contradict" it, they just dont validate it. One critical one is how they chose their sitekey(s).
Because when a sitekey is first created, it gives 0.9/0.7 scores very often. Then over time, it adapts to the "normal" traffic for that sitekey. If they used a sitekey from an actual site with real traffic (bots and human), then they would need cooperation for that sites recap admin panel. Which they didn't document, so they probably made a fresh sitekey.