4 ms·
Sorry Google, No CAPTCHA ReCAPTCHA Doesn’t Stop Bots
- atoponce 12y agoThis isn't surprising, actually. If you want to prove data is coming from a human, then you need to involve a proof of work system, like the guided tour puzzle or a Hashcash-like implementation, or both.
- uptown 12y agoEncountered one yesterday that required me to assemble a jigsaw puzzle. Approached the threshold of not being worth the effort.
- towelguy 12y agoGoogle's NoCaptcha required me once to select the cakes in a grid of 9 images. Only once, never again. I wonder if they were testing it or they have a rate between using text and images.
- uxp 12y agoI just saw this new recaptcha implementation on another site and spent about a full minute playing with it. If you mouse over the checkbox and click it, if you move your mouse while the spinner is "working" it magically confirms that you are a human. If you click it and don't move, it asks you to solve an image captcha, presumably to detect programatic click events. Coupled with the cookie store, I don't see how this is any better. I give it 2 weeks before it's just another hoop for bots and two more hoops for humans to deal with.
- steventhedev 12y agoSounds like Google isn't doing any validation beyond checking that the token is valid. At the very least, they should consider adding validation against various accounts (if any), the IPs associated with the token, and a few others. It sounds like it would help to reduce the false positive rate. As for a bot getting a human to "seed" it, there isn't much they can do aside from throttling the rate of automatic passes to once every 20 seconds or so. They could tune that parameter to balance between usability and bot detection.
- vld 12y agoActual info about the new ReCAPTCHA at https://github.com/neuroradiology/InsideReCaptcha https://github.com/neuroradiology/InsideReCaptcha (original discussion: https://news.ycombinator.com/item?id=8722846 https://news.ycombinator.com/item?id=8722846)
- taksintik 12y agoNothing can stop a persistent threat. This version is supposed to slow down threats without being annoying to 'real' humans. Prefer v2 over v1 all day.
- miralabs 12y ago"What does this mean for bots? Now bots can use an OCR tool to solve the information or require somebody to solve the image initially, post which, the bot can retain the cookies and continue scraping!" They did not tried if this works though. I mean the team that implemented the new Google captcha won't be that dumb. They would have known this as a flaw..
- nieve 12y agoSadly the idea that some set of people won't have been dumb enough to make a fundamental security mistake is almost never useful. Security is too complex, people are too prone to overlooking aspects other than what they're working on, and the likelihood of a group of developers or researchers spotting a flaw in their own work doesn't scale even close to linearly. It's a bit like presuming no-one needs prose copyedited because they'll pay attention - you'll overlook some mistakes in your own writing because you see what you know must be there, not what you actually typed. Assuming people have written secure code because they're the kind of people who wouldn't make a mistake is a sucker bet.
- homakov 12y agoNice copypaste of my article :)
- hobs 12y agoWhat/where is your article?
- homakov 12y agoThis one http://homakov.blogspot.com/2014/12/the-no-captcha-problem.html http://homakov.blogspot.com/2014/12/the-no-captcha-problem.h... they also link my PoC in the end. Instead of linking "the source"?
- hobs 12y agoThanks for the link, I must have missed it in the above post. Nice work, Egor.
- CapitalistCartr 12y agohttp://homakov.blogspot.com/2014/12/the-no-captcha-problem.html http://homakov.blogspot.com/2014/12/the-no-captcha-problem.h...
- orf 12y agohttp://homakov.blogspot.co.uk/2014/12/the-no-captcha-problem.html http://homakov.blogspot.co.uk/2014/12/the-no-captcha-problem... It's not exactly a copy-paste though.
- homakov 12y agoBTW, clickjacking was fixed few weeks ago and http://homakov.github.io/nocaptcha.html http://homakov.github.io/nocaptcha.html isn't working anymore.
- ssuser 12y agoHi Homakov, Our post was inspired from yours. We have added to the link to your original blog post now. Good one! Updated here: http://www.shieldsquare.com/blog/sorry-google-captcha-recaptcha-doesnt-stop-bots/ http://www.shieldsquare.com/blog/sorry-google-captcha-recapt...
- ocfx 12y agoI still think the burden of spam prevention should be on the person who developed/maintains the website. Putting that burden on the end user not only annoys people, but if a person can solve it apparently a bot will solve it eventually so its only a temporary solution.
- towelguy 12y ago> * The next time you visit the page, or any page which requires you to pass reCAPTCHA, the information from these cookies is used to identify whether you have passed the test before. This is wrong. Try posting a few times in 4chan, even if it recognizes you as a human, after posting a bit more it will ask for the captcha anyway.
- SoftwareMaven 12y agoThat removing the cookie resets the captcha is hardly evidence only the cookie is being used as evidence. They were humans using the captcha and Google recognized it. I would imagine a few bot requests would be allowed to follow a human solution since you've raised the "I'm a human" value pretty high, but that value would decrease on every request.