Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

github.com

Post reply on HN
Print view View original

71–80 of 98 posts

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#71

Post by bennofs »

zamadatix wrote: post #13
r3bl wrote: post #5

I'm using Buster[0] for this purpose, and it relies on the same method. Available on Firefox, Chrome and Opera in their respective add-on stores, and no additional steps are needed (like in this project). From my experience, it works perfectly in a default session and not at all in the private browsing mode. I've never bothered to figure out why is that (possibly some other add-on interfering). [0] https://github.com…

reCAPTCHA relies on things like Google cookies to lower the "user is a bot" risk score. Higher risk scores (such as when you go via a blank slate browsing session) result in more/more difficult challenges.

If your score is too low, you aren't allowed to do the audio challenge at all

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#72

Post by kolanos »

hartator wrote: post #50
kolanos wrote: post #43

1. In OSX, enable VoiceOver (CMD+F5). 2. Navigate to a RECAPTCHA. 3. Click the "I Am not a bot" checkbox. How is this not an exploit? Is Google doing something extra when it detects a screen reader?

What do you mean? Enabling VoiceOver on OSX is being white-listed by ReCaptchapa?

Yes. Or at least it appears that way.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#73

Post by contravariant »

darkpuma wrote: post #61
dessant wrote: post #32

Earlier quoted context omitted.

Sometimes it won't accept correct answers either and you're just wasting time training their classifier for minutes. I found the audio challenge to be much faster to get past, so I've started switching to it a couple of months ago, then finally decided to automate it with a browser extension. https://github.com/dessant/buster

If you manage to force google to serve you the noscript version, it tends to accept correct answers the first time with no re-challenges. The javascript version of recaptcha won't let me through no matter how many times I give it correct answers. However websites must specifically allow the noscript version to be used; by default it's disabled for all websites.

What do I have to do to force the noscript version to activate? At this point it's getting impossible for me to pass captchas, and the audio challenge is no help since I just get half a word or some other unintelligible utterance.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#74

Post by taneq »

darkpuma wrote: post #65
zamadatix wrote: post #13

Earlier quoted context omitted.

reCAPTCHA relies on things like Google cookies to lower the "user is a bot" risk score. Higher risk scores (such as when you go via a blank slate browsing session) result in more/more difficult challenges.

> more difficult challenges. That's just code for "it rejects correct answers to frustrate you." If you manage to get the noscript version of the captcha with otherwise the same browser state it will accept a correct answer the first time nearly every time. Presumably this is because they didn't bother to implement their "hassle the user" code in the noscript version; it's probably neglected by google since it's disa…

I run a combination of uBlock Origin, Privacy Badger and Firefox's tracking protection. Can confirm, tiles take 5 seconds to fade in, I have to do 3-5 rounds of it, and unless it's really important I'll just tell reCaptcha to piss off.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#75

Post by Aeolun »

darkpuma wrote: post #62
TaylorAlexander wrote: post #53

Earlier quoted context omitted.

Dang. I didn’t realize recapcha depended on being logged in. Dark pattern.

They also punish you for blocking cookies, using first party isolation, fingerprinting resistance, etc. ReCaptcha v2 operates much like ReCaptcha v3 (which does away with the question/answer interrogation entirely) without telling users it works that way. v2 will frequently reject correct answers just to punish users who aren't sucking up to the Google surveillance system.

Is this related to the Google account? Because since switching to firefox and everything not-google I have been constantly harrassed by recaptcha everywhere.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#76

Post by Semaphor »

Aeolun wrote: post #75
darkpuma wrote: post #62

Earlier quoted context omitted.

They also punish you for blocking cookies, using first party isolation, fingerprinting resistance, etc. ReCaptcha v2 operates much like ReCaptcha v3 (which does away with the question/answer interrogation entirely) without telling users it works that way. v2 will frequently reject correct answers just to punish users who aren't sucking up to the Google surveillance system.

Is this related to the Google account? Because since switching to firefox and everything not-google I have been constantly harrassed by recaptcha everywhere.

I think it's mostly the google account (and not blocking access to its cookies), but (as an FF user) I feel that just being on FF instead of Chrome is also a strike against you.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#77

Post by kaffee »

timdierks wrote: post #63

This is irrelevant. Speech-to-text costs $0.006 per invocation (for [1] https://cloud.google.com/speech-to-text/pricing [2] https://2captcha.com/ , the first hit I found with the search [captcha solving serving price] Disclosure: I work for Google on security and cloud, but not on anything related to captchas or speech to text.

I would love to pay money (or do some sort of proof-of-work hashing) rather than solve Google's infuriating, privacy-hostile CAPTCHAs. I rather suspect that Google, as an advertising and consumer-surveillance firm, gets rather a lot of information out of the system.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#78

Post by clairity »

darkpuma wrote: post #62
TaylorAlexander wrote: post #53

Earlier quoted context omitted.

Dang. I didn’t realize recapcha depended on being logged in. Dark pattern.

They also punish you for blocking cookies, using first party isolation, fingerprinting resistance, etc. ReCaptcha v2 operates much like ReCaptcha v3 (which does away with the question/answer interrogation entirely) without telling users it works that way. v2 will frequently reject correct answers just to punish users who aren't sucking up to the Google surveillance system.

neat, now we have a test for our anti-google privacy efforts. multiple captcha, good for you! no captcha, not so good...

(in most cases, i just close the tab if i get a captcha challenge-i’m sick and tired of the tracking)

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#79

Post by notbestcomment »

timdierks wrote: post #63

This is irrelevant. Speech-to-text costs $0.006 per invocation (for [1] https://cloud.google.com/speech-to-text/pricing [2] https://2captcha.com/ , the first hit I found with the search [captcha solving serving price] Disclosure: I work for Google on security and cloud, but not on anything related to captchas or speech to text.

From your link, it actually says $2.99 per 1000 ReCaptchas so $0.30 for 100. Still cheaper than the automated method of the author.

Also, the automated method is probably more reliable than humans and much faster. And the cost of the speech-to-text API could be lowered by using cheaper services or an in-house model.

(Looking at other services, they all seem to agree on the $0.20-$0.40 range, mostly dictated by the hourly wage of their workers)

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#80

Post by dcbadacd »

kolanos wrote: post #72
hartator wrote: post #50

Earlier quoted context omitted.

What do you mean? Enabling VoiceOver on OSX is being white-listed by ReCaptchapa?

Yes. Or at least it appears that way.

I don't doubt that Google employees are reading this thread and this might make the life of sight-impaired a bit worse.
Post reply on HN