Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

github.com

Post reply on HN
Print view View original

21–30 of 98 posts

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#21

Post by jsnell »

nolok wrote: post #17
akerro wrote: post #12

I've seen this a week ago on reddit. The researched told google about this vulnerability and Google doesnt care about it, they are totally OK with it. You can see here that captcha doesn't block robots, but blocks people and makes browsing inconvenient. reCaptcha is a way google mines data from us for free.

Oh please, what a total joke of a comment. > Google doesnt care about it, they are totally OK with it Google hasn't said they don't care about it, where did you see any of that ? They merely allowed the code to be released despite it still working against the current. Previous experience (namely the original uncaptcha) prove that they intend to find a way to fix it. > You can see here that captcha doesn't block robot…

I have literally never been asked to solve one of those image recognition recaptchas in my main browser profile. (While it happens once a month in incognito windows.)

So it's not at all obvious that known humans are being asked to solve captchas just for the purposes of training.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#22

Post by swsieber »

Boulth wrote: post #18
nolok wrote: post #17

Earlier quoted context omitted.

Oh please, what a total joke of a comment. > Google doesnt care about it, they are totally OK with it Google hasn't said they don't care about it, where did you see any of that ? They merely allowed the code to be released despite it still working against the current. Previous experience (namely the original uncaptcha) prove that they intend to find a way to fix it. > You can see here that captcha doesn't block robot…

>> Google doesnt care about it, they are totally OK with it > Google hasn't said they don't care about it, where did you see any of that ? Check this out: > The Recaptcha team is aware of this attack vector, and have confirmed they are okay with us releasing this code, despite its current success rate. Source: https://github.com/ecthros/uncaptcha2/blob/master/README.md

The parent addressed that in the next line.

> They merely allowed the code to be released despite it still working against the current. Previous experience (namely the original uncaptcha) prove that they intend to find a way to fix it.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#23

Post by ilovetux »

Memosyne wrote: post #7

I'm guessing Google will start using some sort of steganography to prevent this from happening.

I think a simpler solution would be to check if a text to speech API request resulted in the correct answer as part of validating a captcha submission.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#24

Post by nolok »

avian wrote: post #19
nolok wrote: post #17

Earlier quoted context omitted.

Oh please, what a total joke of a comment. > Google doesnt care about it, they are totally OK with it Google hasn't said they don't care about it, where did you see any of that ? They merely allowed the code to be released despite it still working against the current. Previous experience (namely the original uncaptcha) prove that they intend to find a way to fix it. > You can see here that captcha doesn't block robot…

> if what you claim was indeed true we wouldn't be using it Not saying this is the case here, but cargo culting does exist in tech, so this is quite a weak argument in my opinion.

I 100% agree but it's not like captcha are a complicated things or that we didn't all more or less switch to it from something else.

I can say for my current needs right now that if created a non-subscriber posting content page tomorrow I would use a captcha because it removes enough bot to be worth it, and I would go with recaptcha because I find it the better one for end users (I as a user prefer to see it on websites compared to other solution).

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#26

Post by desas »

ilovetux wrote: post #23
Memosyne wrote: post #7

I'm guessing Google will start using some sort of steganography to prevent this from happening.

I think a simpler solution would be to check if a text to speech API request resulted in the correct answer as part of validating a captcha submission.

There are other free text to speech APIs.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#27

Post by nolok »

jsnell wrote: post #21
nolok wrote: post #17

Earlier quoted context omitted.

Oh please, what a total joke of a comment. > Google doesnt care about it, they are totally OK with it Google hasn't said they don't care about it, where did you see any of that ? They merely allowed the code to be released despite it still working against the current. Previous experience (namely the original uncaptcha) prove that they intend to find a way to fix it. > You can see here that captcha doesn't block robot…

I have literally never been asked to solve one of those image recognition recaptchas in my main browser profile. (While it happens once a month in incognito windows.) So it's not at all obvious that known humans are being asked to solve captchas just for the purposes of training.

For the record, the one I meant are the second solving: sometimes recaptcha ask you one (I believe it is genuine), and then after you succeed it ask again with another set of picture (sometimes another question), which I believe is for training.

I have it semi-regularly (like once or twice a week); but I also have some automated tooling using my account AND I travel quite often so location testing probably flag we as weird.

Remember that the original recaptcha also did that with text to help train OCR (it would send a known word and a unknown word, if you succeeded at the known word it would record the answer for the unknown one, and after enough people gave the same one train it as the proper OCR'ed text).

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#28

Post by dwd »

Memosyne wrote: post #7

I'm guessing Google will start using some sort of steganography to prevent this from happening.

You would think they could apply a hidden track at a certain frequency that is inperceptable to a human or a pattern of changes in volume to prevent it being passed through their API.

Of course the next step will be to resample the sound to remove the steganography...and the arms race continues.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#29

Post by akkartik »

Funny story: I can no longer moderate Disqus on my site because it pops up reCaptcha, and I don't even attempt reCaptcha anymore. And I can't ask for support because it pops up reCaptcha. And I can't export my data and delete my account because -- you guessed it -- it pops up reCaptcha.

One of these days I'll gird my loins and go into battle to convince a bot that I'm not a bot. One last time.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#30

Post by vowelless »

Here is a similar attempt from 7 years ago (LayerOne 2012). Reveals how 'simple' life was back then.

Bonus: the talk is HIGHLY entertaining. Their approach gets counter measured by Google an hour before the talk and so they can’t demo it anymore.

https://youtu.be/Mj3thHKeKyg

Post reply on HN