Hacker News Reader

Comment by mef | Hacker News Reader

Looks like it's using http://nucaptcha.com

According to their website[1], it's supposed to be H.264 video, but it's clearly an animated GIF.

[1]: http://nucaptcha.com/features/security-features

Also, this bit: "It's important to note that NuCaptcha is a video stream and not a Flash program. This is because it is not secure to create a Captcha in Flash."

Yet, the Click-to-Plugin feature from Chrome says it's Flash. Worst captcha company ever?

Did you check if the flash content was vector animation or video?

I think the point is that it's not a Flash program that is taking the Captcha value as input and then animating it, where it would be easy to sniff the input value. It's a Flash player for a video stream that is generated externally to the Flash.

Interestingly they claim that the moving images are "an H.264 MPEG-4 Video Stream that is rendered in your browser in a variety of ways" http://nucaptcha.com/features/security-features but they're not--it's just an animated GIF!

The one on their demo page is

http://bit.ly/10vBCDf

And Apple's production version is also an animated GIF, at least on Chrome/Linux.

    <td colspan=2 align="right"><!-- NuCaptcha Start - Java 1.7.15908 --><script type="text/javascript" charset="UTF-8" src="https://s.mzstatic.com/captcha/staticd.nucaptcha.com/16606/v7/skins/itunes-alt/nc.min.js"></script>

Yup.

Reply on news.ycombinator.com