5 ms·

It's definitely not only relying on cursor movements. A simple $('iframe').contents().find('.recaptcha-checkbox-checkmark').click() proved that I'm not a robot,

by ricg 12y ago

It's definitely not only relying on cursor movements. A simple $('iframe').contents().find('.recaptcha-checkbox-checkmark').click() proved that I'm not a robot, without me touching the mouse.

1Hz 12y ago
The cursor movement story seems to be a smokescreen to dilute the fact they're actually running an internet wide monitoring network, tracking users from site to site and building profiles on them.
- ifdefdebug 12y ago
  I tested it a few times in their demo trying hard to to funny things with the mouse pointer. Still I was asked to type in some text all the time. Then I logged into my gmail account and yes it worked. So you're probably right about that smoke screen and it has nothing to do at all with mouse movement. My fx browser deletes cookies at exit and my IP changes frequently and I think that's the true explanation for the outcome of my little test.
- gravity13 12y ago
  I was confused about all of this until I read your comment. Makes perfect sense now! Also makes me think that they can dump the whole charade and provide no security check at all, but that'd probably make the service-providers uncomfortable and they lose the user as a source of human-intelligence for classifying things on google image searches.
- echeese 12y ago
  I'm not sure where cursor movement was mentioned, other than the comments.
  - ifdefdebug 12y ago
    I read it in the wired.com article about this also submitted to HN: "And [Vinay] Shet says even the tiny movements a user’s mouse makes as it hovers and approaches a checkbox can help reveal an automated bot."
    - tunap 12y ago
      Sounds like if I 'Tab' to the field & hit enter I must be a bot....
    - echeese 12y ago
      I guess it's a lot more complicated than it looks at a cursory glance.
      - deleted 12y ago
        [deleted]
      - nb4hnp 12y ago
        you seem to be looking for reddit. it can be found here -> www.reddit.com
      - enneff 12y ago
        It's almost as if Google is playing its cards close to its chest to avoid tipping off people intent on defeating it's captchas!
- Jgrubb 12y ago
  To be fair, any service or site - Facebook, Twitter, Google Analytics, etc - that encourages your putting their code or widgets or whatever on your site is doing exactly that in addition to listing out which of your friends "like this".
- uptown 12y ago
  Which is why Google Analytics is free for site operators.
- heroh 12y ago
  Makes perfect sense. This is Google's response to the Facebook 'Like' button [tracker]
  - ceph_ 12y ago
    Then what is Google Analytics?
    - heroh 12y ago
      can be blocked without any impact on the browsing experience.
junto 12y ago
I tried this demo (https://www.google.com/recaptcha/api2/demo https://www.google.com/recaptcha/api2/demo) in a new incognito window. Then in devtools: javascript:if(!window.jQuery||confirm('Overwrite\x20current\x20version?\x20v'+jQuery.fn.jquery))(function(d,s){s=d.createElement('script');s.src='https://ajax.googleapis.com/ajax/libs/jquery/1.8/jquery.js';(d.head||d.documentElement).appendChild(s)})(document); $('iframe').contents().find('.recaptcha-checkbox-checkmark').click() I got an extra verification (enter two bits of text)
- JoblessWonder 12y ago
  Probably the incognito window. It seems to rely heavily on cookies (likely linked to their analytics data.)
- deleted 12y ago
  [deleted]
raverbashing 12y ago
Are you logged into Google? If you have their cookies it's one indication you're not a robot.
- mralvar 12y ago
  Wouldn't it be possible to just tune bots easier now instead of having to work with OCR?
- _lce0 12y ago
  I strongly believe it is the bot detection .. They may also added extra checks to already logged users
- Xorlev 12y ago
  I wonder if you used a Google account in good standing for a bot, at what point would they start to detect it was a bot? I imagine if you used it for more than a few CAPTCHAs daily you'd probably end up having to do additional validation.
- sesutton 12y ago
  Interestingly I logged out of my Google account in Chrome and immediately got an old style CAPTCHA. But not when I logged out in Safari (I very rarely use Safari). Edit- Nevermind, it looks like Safari left some google.com cookie lying around while Chrome deleted it. Deleting it gave me the old CAPTCHA.
- kuschku 12y ago
  Which is a bad idea. I actually have some bots which scrape Google sites (for the purpose of integrating stuff like Google Keep into KRunner), and they just use the Useragent of a regular phone, send normal POST data, etc. Works perfectly fine, and — I just checked — this bot is recognized as normal user by this captcha system. No Captcha input. I tried it even with a new Google profile and just using cURL to log into Google, then started a new browser session and imported the cookies from cURL. Worked just as well. I guess this makes it easier for malicious bot-authors...
dantillberg 12y ago
At best this would be just trigger another arms race with people developing bots to trigger a series of "human-like" mouse events, which I'd imagine is a far-simpler problem than OCR. Not to mention that it could only be used as a heuristic and not a test; so, eventually the weight of that heuristic will just be reduced to zero once someone publishes humanlike_mouse_driver.js with carefully-tuned-to-look-statistically-human mouse interactions available out of the box.
- puzzl 12y ago
  You know a peculiar thing that humans do? They do things slowly. You know what bot (programmers) hate doing? Doing things slowly. When you've got bots that are diving through thousands of registration forms per minute, and suddenly you need to slow them down to 15 seconds per form, well, that's already an enormous win for the site owners, even if it makes the new captcha fail (if the quoted statistic of 99.8% of captchas being solvable by bots is correct).

by ricg 12y ago

It's definitely not only relying on cursor movements. A simple $('iframe').contents().find('.recaptcha-checkbox-checkmark').click() proved that I'm not a robot, without me touching the mouse.

1Hz 12y ago

The cursor movement story seems to be a smokescreen to dilute the fact they're actually running an internet wide monitoring network, tracking users from site to site and building profiles on them.

ifdefdebug 12y ago
I tested it a few times in their demo trying hard to to funny things with the mouse pointer. Still I was asked to type in some text all the time. Then I logged into my gmail account and yes it worked. So you're probably right about that smoke screen and it has nothing to do at all with mouse movement. My fx browser deletes cookies at exit and my IP changes frequently and I think that's the true explanation for the outcome of my little test.
gravity13 12y ago
I was confused about all of this until I read your comment. Makes perfect sense now! Also makes me think that they can dump the whole charade and provide no security check at all, but that'd probably make the service-providers uncomfortable and they lose the user as a source of human-intelligence for classifying things on google image searches.
echeese 12y ago
I'm not sure where cursor movement was mentioned, other than the comments.
- ifdefdebug 12y ago
  I read it in the wired.com article about this also submitted to HN: "And [Vinay] Shet says even the tiny movements a user’s mouse makes as it hovers and approaches a checkbox can help reveal an automated bot."
  - tunap 12y ago
    Sounds like if I 'Tab' to the field & hit enter I must be a bot....
  - echeese 12y ago
    I guess it's a lot more complicated than it looks at a cursory glance.
    - deleted 12y ago
      [deleted]
    - nb4hnp 12y ago
      you seem to be looking for reddit. it can be found here -> www.reddit.com
    - enneff 12y ago
      It's almost as if Google is playing its cards close to its chest to avoid tipping off people intent on defeating it's captchas!
Jgrubb 12y ago
To be fair, any service or site - Facebook, Twitter, Google Analytics, etc - that encourages your putting their code or widgets or whatever on your site is doing exactly that in addition to listing out which of your friends "like this".
uptown 12y ago
Which is why Google Analytics is free for site operators.
heroh 12y ago
Makes perfect sense. This is Google's response to the Facebook 'Like' button [tracker]
- ceph_ 12y ago
  Then what is Google Analytics?
  - heroh 12y ago
    can be blocked without any impact on the browsing experience.

junto 12y ago

I tried this demo (https://www.google.com/recaptcha/api2/demo https://www.google.com/recaptcha/api2/demo) in a new incognito window. Then in devtools: javascript:if(!window.jQuery||confirm('Overwrite\x20current\x20version?\x20v'+jQuery.fn.jquery))(function(d,s){s=d.createElement('script');s.src='https://ajax.googleapis.com/ajax/libs/jquery/1.8/jquery.js';(d.head||d.documentElement).appendChild(s)})(document); $('iframe').contents().find('.recaptcha-checkbox-checkmark').click() I got an extra verification (enter two bits of text)

JoblessWonder 12y ago
Probably the incognito window. It seems to rely heavily on cookies (likely linked to their analytics data.)
deleted 12y ago
[deleted]

raverbashing 12y ago

Are you logged into Google? If you have their cookies it's one indication you're not a robot.

mralvar 12y ago
Wouldn't it be possible to just tune bots easier now instead of having to work with OCR?
_lce0 12y ago
I strongly believe it is the bot detection .. They may also added extra checks to already logged users
Xorlev 12y ago
I wonder if you used a Google account in good standing for a bot, at what point would they start to detect it was a bot? I imagine if you used it for more than a few CAPTCHAs daily you'd probably end up having to do additional validation.
sesutton 12y ago
Interestingly I logged out of my Google account in Chrome and immediately got an old style CAPTCHA. But not when I logged out in Safari (I very rarely use Safari). Edit- Nevermind, it looks like Safari left some google.com cookie lying around while Chrome deleted it. Deleting it gave me the old CAPTCHA.
kuschku 12y ago
Which is a bad idea. I actually have some bots which scrape Google sites (for the purpose of integrating stuff like Google Keep into KRunner), and they just use the Useragent of a regular phone, send normal POST data, etc. Works perfectly fine, and — I just checked — this bot is recognized as normal user by this captcha system. No Captcha input. I tried it even with a new Google profile and just using cURL to log into Google, then started a new browser session and imported the cookies from cURL. Worked just as well. I guess this makes it easier for malicious bot-authors...

dantillberg 12y ago

At best this would be just trigger another arms race with people developing bots to trigger a series of "human-like" mouse events, which I'd imagine is a far-simpler problem than OCR. Not to mention that it could only be used as a heuristic and not a test; so, eventually the weight of that heuristic will just be reduced to zero once someone publishes humanlike_mouse_driver.js with carefully-tuned-to-look-statistically-human mouse interactions available out of the box.

puzzl 12y ago
You know a peculiar thing that humans do? They do things slowly. You know what bot (programmers) hate doing? Doing things slowly. When you've got bots that are diving through thousands of registration forms per minute, and suddenly you need to slow them down to 15 seconds per form, well, that's already an enormous win for the site owners, even if it makes the new captcha fail (if the quoted statistic of 99.8% of captchas being solvable by bots is correct).