Uncaptcha2: Defeat ReCaptcha with Google Speech2Text • Hacker News Board

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#61

Post by darkpuma » Sat, Jan 05, 2019, 10:43 PM UTC

dessant wrote: post #32

akkartik wrote: post #29

Funny story: I can no longer moderate Disqus on my site because it pops up reCaptcha, and I don't even attempt reCaptcha anymore. And I can't ask for support because it pops up reCaptcha. And I can't export my data and delete my account because -- you guessed it -- it pops up reCaptcha. One of these days I'll gird my loins and go into battle to convince a bot that I'm not a bot. One last time.

Sometimes it won't accept correct answers either and you're just wasting time training their classifier for minutes. I found the audio challenge to be much faster to get past, so I've started switching to it a couple of months ago, then finally decided to automate it with a browser extension. https://github.com/dessant/buster

If you manage to force google to serve you the noscript version, it tends to accept correct answers the first time with no re-challenges. The javascript version of recaptcha won't let me through no matter how many times I give it correct answers.

However websites must specifically allow the noscript version to be used; by default it's disabled for all websites.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#62

Post by darkpuma » Sat, Jan 05, 2019, 10:48 PM UTC

TaylorAlexander wrote: post #53

Semaphor wrote: post #33

Earlier quoted context omitted.

Use Chrome, create a google account, login, allow all cookies and scripts. Login to disqus. Export your data and delete your account.

Dang. I didn’t realize recapcha depended on being logged in. Dark pattern.

They also punish you for blocking cookies, using first party isolation, fingerprinting resistance, etc. ReCaptcha v2 operates much like ReCaptcha v3 (which does away with the question/answer interrogation entirely) without telling users it works that way. v2 will frequently reject correct answers just to punish users who aren't sucking up to the Google surveillance system.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#63

Post by timdierks » Sat, Jan 05, 2019, 10:49 PM UTC

This is irrelevant. Speech-to-text costs $0.006 per invocation (for [1] https://cloud.google.com/speech-to-text/pricing

[2] https://2captcha.com/, the first hit I found with the search [captcha solving serving price]

Disclosure: I work for Google on security and cloud, but not on anything related to captchas or speech to text.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#64

Post by darkpuma » Sat, Jan 05, 2019, 10:55 PM UTC

jayd16 wrote: post #54

tossaccount123 wrote: post #9

Google doesn't care, they just want free training data. The team behind uncaptcha even gave them 6 months notice and Google still did nothing their own sites are protected by additional measures to detect bots like monitoring mouse movement

Isn't the text based ReCaptcha pretty ancient at this point? Google's current version is either the simple checkbox (which I assume is checking various things) or the image based version where you have to click on traffic signs. I like to assume that's a live feed from a Waymo car and I'm saving lives.

> "Isn't the text based ReCaptcha pretty ancient at this point?"

That was v1, they shut it down in March 2018. You won't see it anymore anywhere.

> "Google's current version is either the simple checkbox (which I assume is checking various things) or the image based version where you have to click on traffic signs."

That's v2. v2 will present you with a simple check box if you're very compliant with the google surveillance system, or will present you will image challenges if you're not (or if it's just in the mood.) v2 is very capricious and will reject correct answers from users google wishes to punish for, e.g. using firefox, using adblockers, using resistfingerprinting, blocking google's cookies, etc.

The recently released v3 is the worst of them all; it does away with the image challenges of v2 completely. The user never interacts with it directly, never has an opportunity to persuade v3 that they're a real human by answering any sort of questions. It's nothing more than a measure of how compliant you are with google's surveillance.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#65

Post by darkpuma » Sat, Jan 05, 2019, 11:04 PM UTC

zamadatix wrote: post #13

r3bl wrote: post #5

I'm using Buster[0] for this purpose, and it relies on the same method. Available on Firefox, Chrome and Opera in their respective add-on stores, and no additional steps are needed (like in this project). From my experience, it works perfectly in a default session and not at all in the private browsing mode. I've never bothered to figure out why is that (possibly some other add-on interfering). [0] https://github.com…

reCAPTCHA relies on things like Google cookies to lower the "user is a bot" risk score. Higher risk scores (such as when you go via a blank slate browsing session) result in more/more difficult challenges.

> more difficult challenges.

That's just code for "it rejects correct answers to frustrate you." If you manage to get the noscript version of the captcha with otherwise the same browser state it will accept a correct answer the first time nearly every time. Presumably this is because they didn't bother to implement their "hassle the user" code in the noscript version; it's probably neglected by google since it's disabled by default.

For instance, the sloooow fade in of challenge tiles... what legitimate purpose does that serve? That's not there to make it harder for bots. That's there just to hassle and punish real humans that google dislikes because they don't buy into the google 'ecosystem'. The more they dislike you, the slower the fade in gets. The fade-in can be several seconds long in severe cases.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#66

Post by vfq » Sat, Jan 05, 2019, 11:04 PM UTC

dessant wrote: post #32

akkartik wrote: post #29

Funny story: I can no longer moderate Disqus on my site because it pops up reCaptcha, and I don't even attempt reCaptcha anymore. And I can't ask for support because it pops up reCaptcha. And I can't export my data and delete my account because -- you guessed it -- it pops up reCaptcha. One of these days I'll gird my loins and go into battle to convince a bot that I'm not a bot. One last time.

Sometimes it won't accept correct answers either and you're just wasting time training their classifier for minutes. I found the audio challenge to be much faster to get past, so I've started switching to it a couple of months ago, then finally decided to automate it with a browser extension. https://github.com/dessant/buster

You're the best.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#67

Post by darkpuma » Sat, Jan 05, 2019, 11:09 PM UTC

hhjinks wrote: post #45

Semaphor wrote: post #34

Earlier quoted context omitted.

It barely asks you if you use Chrome and/or are logged into a Google account. ReCaptcha is how you make Firefox and IE/Edge users without a google account hate you. Because believe me, if I get asked to click another 50 cars without good reason, (3 failed logins would be a good reason) I'll blame your site for being dumb and not google.

And here's my anecdotal evidence: I have only been served image captchas since forever. I literally thought the warped text captchas had been phased out. I literally never see anything but image captchas.

> I literally thought the warped text captchas had been phased out.

It has been since March.

https://developers.google.com/recaptcha/docs/versions#v1

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#68

Post by unilynx » Sat, Jan 05, 2019, 11:10 PM UTC

Izkata wrote: post #55

saagarjha wrote: post #44

Earlier quoted context omitted.

I feel that this depends on how fingerprintable your browser is. Signed in to Chrome? You’ll likely see nothing. But logged out and using Safari’s Private Browsing? You will likely have to do it multiple times.

I have the feeling this is also configurable somewhere. A few months ago, my bank added the image-clicking one to its login screen. I've always gotten past that one on the first attempt. But with the same profile on the same Firefox, all other sites always take multiple tries.

The 'owner' of the recaptcha API key can set a slider on a scale from "Easiest for users (some security features turned off)" to "Most secure (all security features turned on)"

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#69

Post by darkpuma » Sat, Jan 05, 2019, 11:13 PM UTC

Izkata wrote: post #55

saagarjha wrote: post #44

Earlier quoted context omitted.

I feel that this depends on how fingerprintable your browser is. Signed in to Chrome? You’ll likely see nothing. But logged out and using Safari’s Private Browsing? You will likely have to do it multiple times.

I have the feeling this is also configurable somewhere. A few months ago, my bank added the image-clicking one to its login screen. I've always gotten past that one on the first attempt. But with the same profile on the same Firefox, all other sites always take multiple tries.

Google allows website operators to configure how sensitive they want v2 or v3 to be, but in practice it makes little difference. The only apparent effect on v2 is that the least sensitive setting permits the use of the noscript version. The least sensitive setting of v2 will still harshly hassle and punish users who aren't in compliance with google, unless they use the noscript version. Then and only then, it lets people through for correct answers every time.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#70

Post by dessant » Sat, Jan 05, 2019, 11:15 PM UTC

timdierks wrote: post #63

This is irrelevant. Speech-to-text costs $0.006 per invocation (for [1] https://cloud.google.com/speech-to-text/pricing [2] https://2captcha.com/ , the first hit I found with the search [captcha solving serving price] Disclosure: I work for Google on security and cloud, but not on anything related to captchas or speech to text.

There are free speech recognition services, such as Wit.ai, and a number of others that have generous free tiers. Also, it's likely that spammers will not bother finding a free public API, and will just use the endpoints of Google Voice Search, or any other similar service from other companies.

The unCaptcha paper and the team's research is very much relevant, because it informs the public about the effectiveness of these security systems, and it helps website admins consider these threats and possibly adapt to them.