Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

github.com

Post reply on HN
Print view View original

81–90 of 98 posts

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#81

Post by bscphil »

kaffee wrote: post #77
timdierks wrote: post #63

This is irrelevant. Speech-to-text costs $0.006 per invocation (for [1] https://cloud.google.com/speech-to-text/pricing [2] https://2captcha.com/ , the first hit I found with the search [captcha solving serving price] Disclosure: I work for Google on security and cloud, but not on anything related to captchas or speech to text.

I would love to pay money (or do some sort of proof-of-work hashing) rather than solve Google's infuriating, privacy-hostile CAPTCHAs. I rather suspect that Google, as an advertising and consumer-surveillance firm, gets rather a lot of information out of the system.

That's a funny, very accurate point. I would absolutely pay 10c to have a service automatically bypass Google's CAPTCHA for me every time I encounter one.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#82

Post by darkpuma »

contravariant wrote: post #73
darkpuma wrote: post #61

Earlier quoted context omitted.

If you manage to force google to serve you the noscript version, it tends to accept correct answers the first time with no re-challenges. The javascript version of recaptcha won't let me through no matter how many times I give it correct answers. However websites must specifically allow the noscript version to be used; by default it's disabled for all websites.

What do I have to do to force the noscript version to activate? At this point it's getting impossible for me to pass captchas, and the audio challenge is no help since I just get half a word or some other unintelligible utterance.

Sometimes disabling javascript using e.g. umatrix can do it, but only in cases where that website operator has elected to use the most permissive setting (this seems to be rare.)

4channel.org is one site that allows noscript captcha, you can try it out there. But I've rarely seen it possible on other sites.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#83

Post by darkpuma »

Aeolun wrote: post #75
darkpuma wrote: post #62

Earlier quoted context omitted.

They also punish you for blocking cookies, using first party isolation, fingerprinting resistance, etc. ReCaptcha v2 operates much like ReCaptcha v3 (which does away with the question/answer interrogation entirely) without telling users it works that way. v2 will frequently reject correct answers just to punish users who aren't sucking up to the Google surveillance system.

Is this related to the Google account? Because since switching to firefox and everything not-google I have been constantly harrassed by recaptcha everywhere.

> Is this related to the Google account?

It seems so. That's not the only factor but it seems to be strong one.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#84

Post by gingerlime »

darkpuma wrote: post #64
jayd16 wrote: post #54

Earlier quoted context omitted.

Isn't the text based ReCaptcha pretty ancient at this point? Google's current version is either the simple checkbox (which I assume is checking various things) or the image based version where you have to click on traffic signs. I like to assume that's a live feed from a Waymo car and I'm saving lives.

> "Isn't the text based ReCaptcha pretty ancient at this point?" That was v1, they shut it down in March 2018. You won't see it anymore anywhere. > "Google's current version is either the simple checkbox (which I assume is checking various things) or the image based version where you have to click on traffic signs." That's v2. v2 will present you with a simple check box if you're very compliant with the google survei…

> The recently released v3 is the worst of them all; it does away with the image challenges of v2 completely. The user never interacts with it directly, never has an opportunity to persuade v3 that they're a real human by answering any sort of questions. It's nothing more than a measure of how compliant you are with google's surveillance.

I did a very quick experiment with reCAPTCHA v3:

  * using Firefox in private browsing mode (not logged-in to anything)
  * with a VPN
  * using uBlock Origin
  * Do-Not-Track on, disabling 3rd party trackers
  * Only went to one page and filled one form with garbage data
My score was 0.7, which is pretty decent I would say.

I did a similar experiment using Ghost Inspector (a platform for automating browser testing, something similar to Selenium, but not sure what they use exactly), and my scores were consistently 0.1.

I'm also a bit suspicious of Google, and have trouble with the fact that this is the only solution on the market, and it's free for websites to use. But I'm not sure your statement is entirely accurate judging from my very limited experience.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#85

Post by edoo »

"The team has allowed us to release the code, despite its current success."

First off permission was never needed to release the code. Second, Google's interest in captcha is not to protect websites but to further their machine learning algorithms. Unless the captcha mechanism was destroyed to such an extent nobody used it they will be happy to accept captcha requests from automated systems. Google may seem like it sometimes but it is not your friend.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#86

Post by darkpuma »

gingerlime wrote: post #84
darkpuma wrote: post #64

Earlier quoted context omitted.

> "Isn't the text based ReCaptcha pretty ancient at this point?" That was v1, they shut it down in March 2018. You won't see it anymore anywhere. > "Google's current version is either the simple checkbox (which I assume is checking various things) or the image based version where you have to click on traffic signs." That's v2. v2 will present you with a simple check box if you're very compliant with the google survei…

> The recently released v3 is the worst of them all; it does away with the image challenges of v2 completely. The user never interacts with it directly, never has an opportunity to persuade v3 that they're a real human by answering any sort of questions. It's nothing more than a measure of how compliant you are with google's surveillance. I did a very quick experiment with reCAPTCHA v3: * using Firefox in private bro…

I get 0.3 with firefox right now when blocking their cookies, using first party isolation and resist fingerprinting. In the past I've gotten as low as 0.1 with a similar configuration.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#87

Post by mockingbirdy »

I've built the same in the past to solve ReCaptchas and my question is:

Why on earth did they publish this?

I've kept it secret because Google will close this loophole and probably make it more difficult for disabled people to verify that they're humans. And Google is not dumb: They already know that speech recognition "breaks" their bot detection, just like screen readers - this is about accessibility. Publishing stuff like this will increase the pressure so they will be forced to "improve" their bot detection system - which simply means that even more people won't be able to solve those captchas.

Heck, some weeks ago I've tried to solve a ReCaptcha for literally 10 minutes! My answers were right, it was a matter of discrimination. My point is: My bot automation is able to solve a Captcha faster than a human being. This is silly and ineffective.

And about the people who've published this: they think they do someone a favor with this. But I can't see how it's in anybody's interest to release this into the public (especially on a site like HN where Googlers are reading). If they would propose a better solution for website owners to secure their sites, fine.

But everyone who's talking about "vulnerabilities" like this makes it more difficult for real people to access the websites that they want to use. I know disabled people who can't solve those captchas - it's just too much of a hassle while it's easy for my bot automation to do it.

We should really ask ourselves what we're really trying to improve here.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#88

Post by birksherty »

gingerlime wrote: post #84
darkpuma wrote: post #64

Earlier quoted context omitted.

> "Isn't the text based ReCaptcha pretty ancient at this point?" That was v1, they shut it down in March 2018. You won't see it anymore anywhere. > "Google's current version is either the simple checkbox (which I assume is checking various things) or the image based version where you have to click on traffic signs." That's v2. v2 will present you with a simple check box if you're very compliant with the google survei…

> The recently released v3 is the worst of them all; it does away with the image challenges of v2 completely. The user never interacts with it directly, never has an opportunity to persuade v3 that they're a real human by answering any sort of questions. It's nothing more than a measure of how compliant you are with google's surveillance. I did a very quick experiment with reCAPTCHA v3: * using Firefox in private bro…

On Firefox, if disable 3rd party cookie, it never accepts my correct answer. I have to fight 5 minutes with google to prove that I am human. Same when I use vpn. Allow 3rd party, logged in to google account, no vpn and just one check.

Edit: If try to use audio challenge in the first case, it directly tells me that I am using some method to solve captcha and they won't allow it. So much fun.

Google is evil.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#89

Post by birksherty »

nolok wrote: post #17
akerro wrote: post #12

I've seen this a week ago on reddit. The researched told google about this vulnerability and Google doesnt care about it, they are totally OK with it. You can see here that captcha doesn't block robots, but blocks people and makes browsing inconvenient. reCaptcha is a way google mines data from us for free.

Oh please, what a total joke of a comment. > Google doesnt care about it, they are totally OK with it Google hasn't said they don't care about it, where did you see any of that ? They merely allowed the code to be released despite it still working against the current. Previous experience (namely the original uncaptcha) prove that they intend to find a way to fix it. > You can see here that captcha doesn't block robot…

100% nonsense. When I use Firefox with 3rd party cookie blocked, it does not accepts my correct answers. Waste 5 minutes of my life to beg google to let me in.

Allow 3rd party cookie, log in to google and I only have to check a box.

Same when I use VPN, it does not accept any of the correct answers.

So when Google sees that I am trying to protect my privacy, it punish me by having to work for them.

One more thing. If try to use audio challenge in the first case, it directly told me that I am using some method to solve captcha and they won't allow it. So much fun.

Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text

#90

Post by beardog »

kaffee wrote: post #77
timdierks wrote: post #63

This is irrelevant. Speech-to-text costs $0.006 per invocation (for [1] https://cloud.google.com/speech-to-text/pricing [2] https://2captcha.com/ , the first hit I found with the search [captcha solving serving price] Disclosure: I work for Google on security and cloud, but not on anything related to captchas or speech to text.

I would love to pay money (or do some sort of proof-of-work hashing) rather than solve Google's infuriating, privacy-hostile CAPTCHAs. I rather suspect that Google, as an advertising and consumer-surveillance firm, gets rather a lot of information out of the system.

They do train their AIs on the system, which is why we solve for so many store fronts, fire hydrants, etc.
Post reply on HN