A field guide to CAPTCHA types and how they break | Hacker News Reader

A field guide to CAPTCHA types and how they break

github.com

45 pointsvasylsmutok15 comments

I've never seen reCaptcha v3 (or at least, not that I'm aware of), is that used commonly?

Also they don't cover the QR code that Google is sometimes throwing up, which of course I absolutely refuse to follow. It's clear that Google really wants to associate every desktop browser with a mobile phone number. You cannot create a Youtube account now without using a mobile phone number.

You don't see recaptcha v3. That's the whole point of it. It's not a puzzle to solve, it's behavioral profiling.

They say it's "a completely frictionless risk assessment running invisibly across pages.", so I assume it's not made to be seen. Some CAPTCHAs start to work like that now. Either you can pass, or the website will just show you an Error 403 and will not bother showing you an actual test.

I just use AI to solve the CAPTCHAs I'm presented with.

CAPTCHAs are so outdated, annoying, and imposing on us, users. Let's drop them already.

Most detection cant be mitigated on the fly by clicking a turnstile or typing captchas anymore, so no idea what AI is doing for you.

Web scraping at scale requires solvers. Even if it wasn't cost prohibitive, an llm controlling a browser would be quite a heavy/inefficient way to solve captchas.

> It is intended for education and authorized research, not for evading protections on services without permission.

If you believe this in the readme of a repo called "fuck captcha" I have a bridge to sell you

don't worry, the page already looks like slop, it might already be less truly useful than one would think

There is the case of the unending reCAPTCHA v2 Checkbox in a loop. It doesn't care if you solve it rightly.

That's not reCAPTCHA's fault. It happens when you pass a challenge and the website decides that's not good enough and to serve you another one. I'm sure services like Cloudflare invalidates solved challenges if you're still too suspicious, even immediately, and that's probably the root of the problem.

Their overbroad definition of suspicious is what's suspicious to me. Literally if I were to use a Private Window, I'd get it.

These days you're suspicious whenever you're not rocking the usual spyware and telemetry. Especially if there's any chance that any of the software you're running is possible to modify (even if it hasn't been).

You still have those? I've not seen them in a long time.

I fully expect it if I were to use a Private Window.

Thank you for helping bots and spammers have a nice easy repo they can point their agents to. I felt like I wasn't getting enough love and care from the porn bots accounts recently. Very cool!

To be fair this looks completely written by an LLM, so it's likely something those agents already know.

Reply on news.ycombinator.com