Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

github.com

Post reply on HN
Print view View original

41–50 of 98 posts

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#41

Post by alfongj »

From what I can read on the twit and GitHub, the researcher hasn't proven this works at scale.

The point of recaptcha is blocking "captcha farms" or automated bots from abusively creating accounts, buying tickets, etc.

The author hasn't demonstrated that this attack is effective in those scenarios. The only thing he has shown is a very convoluted way for a human to solve a recaptcha (harder for 99.9% of humans than the standard recaptcha experience)

That would explain why Google didn't care about them publishing this.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#44

Post by saagarjha »

jobigoud wrote: post #40
nolok wrote: post #27

Earlier quoted context omitted.

For the record, the one I meant are the second solving: sometimes recaptcha ask you one (I believe it is genuine), and then after you succeed it ask again with another set of picture (sometimes another question), which I believe is for training. I have it semi-regularly (like once or twice a week); but I also have some automated tooling using my account AND I travel quite often so location testing probably flag we as…

"second solving"? I've sometimes been asked ten times in a row to click on the shop fronts or traffic light tiles.

I feel that this depends on how fingerprintable your browser is. Signed in to Chrome? You’ll likely see nothing. But logged out and using Safari’s Private Browsing? You will likely have to do it multiple times.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#45

Post by hhjinks »

Semaphor wrote: post #34
jsnell wrote: post #21

Earlier quoted context omitted.

I have literally never been asked to solve one of those image recognition recaptchas in my main browser profile. (While it happens once a month in incognito windows.) So it's not at all obvious that known humans are being asked to solve captchas just for the purposes of training.

It barely asks you if you use Chrome and/or are logged into a Google account. ReCaptcha is how you make Firefox and IE/Edge users without a google account hate you. Because believe me, if I get asked to click another 50 cars without good reason, (3 failed logins would be a good reason) I'll blame your site for being dumb and not google.

And here's my anecdotal evidence:

I have only been served image captchas since forever. I literally thought the warped text captchas had been phased out. I literally never see anything but image captchas.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#47

Post by hhjinks »

Y_Y wrote: post #6

> Sorry, you are rate-limited. Please wait a few moments and try again. I don't know why twitter blocks my Android Firefox, but I feel as if we both benefit.

This happens to me whenever I use the Galaxy Browser. First request is always "rate-limited". When I immediately reload the page, it goes through. I always thought it was a cheap tactic to have people install their app.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#48

Post by rincebrain »

hhjinks wrote: post #45
Semaphor wrote: post #34

Earlier quoted context omitted.

It barely asks you if you use Chrome and/or are logged into a Google account. ReCaptcha is how you make Firefox and IE/Edge users without a google account hate you. Because believe me, if I get asked to click another 50 cars without good reason, (3 failed logins would be a good reason) I'll blame your site for being dumb and not google.

And here's my anecdotal evidence: I have only been served image captchas since forever. I literally thought the warped text captchas had been phased out. I literally never see anything but image captchas.

I think the warped text ones have been phased out, but AFAIK it's in favor of the ones people mentioned above and some black magic for detecting humans without needing to click things.

(I work for Google, on nothing related to browsers or recaptcha, this is purely my impression from encountering it logged in and out.)

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#50

Post by hartator »

kolanos wrote: post #43

1. In OSX, enable VoiceOver (CMD+F5). 2. Navigate to a RECAPTCHA. 3. Click the "I Am not a bot" checkbox. How is this not an exploit? Is Google doing something extra when it detects a screen reader?

What do you mean? Enabling VoiceOver on OSX is being white-listed by ReCaptchapa?
Post reply on HN