This exploit has been known for a while.
Uncaptcha2: Defeat ReCaptcha with Google Speech2Text
51–60 of 98 posts
Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text
#52Here is a similar attempt from 7 years ago (LayerOne 2012). Reveals how 'simple' life was back then. Bonus: the talk is HIGHLY entertaining. Their approach gets counter measured by Google an hour before the talk and so they can’t demo it anymore. https://youtu.be/Mj3thHKeKyg
> https://youtu.be/Mj3thHKeKyg
This was entertaining. Thanks for posting it.
Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text
#53Funny story: I can no longer moderate Disqus on my site because it pops up reCaptcha, and I don't even attempt reCaptcha anymore. And I can't ask for support because it pops up reCaptcha. And I can't export my data and delete my account because -- you guessed it -- it pops up reCaptcha. One of these days I'll gird my loins and go into battle to convince a bot that I'm not a bot. One last time.
Use Chrome, create a google account, login, allow all cookies and scripts. Login to disqus. Export your data and delete your account.
Dang. I didn’t realize recapcha depended on being logged in. Dark pattern.
Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text
#54Google doesn't care, they just want free training data. The team behind uncaptcha even gave them 6 months notice and Google still did nothing their own sites are protected by additional measures to detect bots like monitoring mouse movement
Isn't the text based ReCaptcha pretty ancient at this point? Google's current version is either the simple checkbox (which I assume is checking various things) or the image based version where you have to click on traffic signs. I like to assume that's a live feed from a Waymo car and I'm saving lives.
Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text
#55Earlier quoted context omitted.
"second solving"? I've sometimes been asked ten times in a row to click on the shop fronts or traffic light tiles.
I feel that this depends on how fingerprintable your browser is. Signed in to Chrome? You’ll likely see nothing. But logged out and using Safari’s Private Browsing? You will likely have to do it multiple times.
I have the feeling this is also configurable somewhere.
A few months ago, my bank added the image-clicking one to its login screen. I've always gotten past that one on the first attempt. But with the same profile on the same Firefox, all other sites always take multiple tries.
Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text
#56Google doesn't care, they just want free training data. The team behind uncaptcha even gave them 6 months notice and Google still did nothing their own sites are protected by additional measures to detect bots like monitoring mouse movement
Isn't the text based ReCaptcha pretty ancient at this point? Google's current version is either the simple checkbox (which I assume is checking various things) or the image based version where you have to click on traffic signs. I like to assume that's a live feed from a Waymo car and I'm saving lives.
Obligatory xkcd (crowdsourced steering):
https://xkcd.com/1897/
Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text
#57I'm using Buster[0] for this purpose, and it relies on the same method. Available on Firefox, Chrome and Opera in their respective add-on stores, and no additional steps are needed (like in this project). From my experience, it works perfectly in a default session and not at all in the private browsing mode. I've never bothered to figure out why is that (possibly some other add-on interfering). [0] https://github.com…
The creator of that repo commented in this thread as well. Pretty neat.
Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text
#58Here is a similar attempt from 7 years ago (LayerOne 2012). Reveals how 'simple' life was back then. Bonus: the talk is HIGHLY entertaining. Their approach gets counter measured by Google an hour before the talk and so they can’t demo it anymore. https://youtu.be/Mj3thHKeKyg
> https://youtu.be/Mj3thHKeKyg This was entertaining. Thanks for posting it.
The importance of recording your demos haha!
Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text
#59Earlier quoted context omitted.
For the record, the one I meant are the second solving: sometimes recaptcha ask you one (I believe it is genuine), and then after you succeed it ask again with another set of picture (sometimes another question), which I believe is for training. I have it semi-regularly (like once or twice a week); but I also have some automated tooling using my account AND I travel quite often so location testing probably flag we as…
"second solving"? I've sometimes been asked ten times in a row to click on the shop fronts or traffic light tiles.
I keep selecting random tiles until the captures get easier and I can solve one without thinking. It takes about 10 to 20 iterations.
Re: Uncaptcha2: Defeat ReCaptcha with Google Speech2Text
#60Url changed from https://twitter.com/FGRibreau/status/1080810518493966337, which points to this.