A field guide to CAPTCHA types and how they break

(github.com)

40 points | by vasylsmutok 5 hours ago ago

12 comments

  • rwmj 4 hours ago

    I've never seen reCaptcha v3 (or at least, not that I'm aware of), is that used commonly?

    Also they don't cover the QR code that Google is sometimes throwing up, which of course I absolutely refuse to follow. It's clear that Google really wants to associate every desktop browser with a mobile phone number. You cannot create a Youtube account now without using a mobile phone number.

    • chowells 4 hours ago

      You don't see recaptcha v3. That's the whole point of it. It's not a puzzle to solve, it's behavioral profiling.

    • iagiagiag 2 hours ago

      They say it's "a completely frictionless risk assessment running invisibly across pages.", so I assume it's not made to be seen. Some CAPTCHAs start to work like that now. Either you can pass, or the website will just show you an Error 403 and will not bother showing you an actual test.

  • jwr 2 hours ago

    I just use AI to solve the CAPTCHAs I'm presented with.

    CAPTCHAs are so outdated, annoying, and imposing on us, users. Let's drop them already.

    • lifeisloving an hour ago

      Most detection cant be mitigated on the fly by clicking a turnstile or typing captchas anymore, so no idea what AI is doing for you.

      Web scraping at scale requires solvers. Even if it wasn't cost prohibitive, an llm controlling a browser would be quite a heavy/inefficient way to solve captchas.

  • dangistan202611 2 hours ago

    There is the case of the unending reCAPTCHA v2 Checkbox in a loop. It doesn't care if you solve it rightly.

    • iagiagiag 2 hours ago

      You still have those? I've not seen them in a long time.

    • LoganDark 2 hours ago

      That's not reCAPTCHA's fault. It happens when you pass a challenge and the website decides that's not good enough and to serve you another one. I'm sure services like Cloudflare invalidates solved challenges if you're still too suspicious, even immediately, and that's probably the root of the problem.

  • xgulfie 4 hours ago

    > It is intended for education and authorized research, not for evading protections on services without permission.

    If you believe this in the readme of a repo called "fuck captcha" I have a bridge to sell you

    • rf15 an hour ago

      don't worry, the page already looks like slop, it might already be less truly useful than one would think

  • viccis 4 hours ago

    Thank you for helping bots and spammers have a nice easy repo they can point their agents to. I felt like I wasn't getting enough love and care from the porn bots accounts recently. Very cool!

    • SkiFire13 4 hours ago

      To be fair this looks completely written by an LLM, so it's likely something those agents already know.