A field guide to CAPTCHA types and how they break

45 points by vasylsmutok 22 hours ago on hackernews | 12 comments

> It is intended for education and authorized research, not for evading protections on services without permission.

If you believe this in the readme of a repo called "fuck captcha" I have a bridge to sell you

: rf15 | 18 hours ago
don't worry, the page already looks like slop, it might already be less truly useful than one would think

Thank you for helping bots and spammers have a nice easy repo they can point their agents to. I felt like I wasn't getting enough love and care from the porn bots accounts recently. Very cool!

: SkiFire13 | 21 hours ago
To be fair this looks completely written by an LLM, so it's likely something those agents already know.

rwmj | 21 hours ago

I've never seen reCaptcha v3 (or at least, not that I'm aware of), is that used commonly?

Also they don't cover the QR code that Google is sometimes throwing up, which of course I absolutely refuse to follow. It's clear that Google really wants to associate every desktop browser with a mobile phone number. You cannot create a Youtube account now without using a mobile phone number.

: chowells | 21 hours ago
You don't see recaptcha v3. That's the whole point of it. It's not a puzzle to solve, it's behavioral profiling.
: iagiagiag | 18 hours ago
They say it's "a completely frictionless risk assessment running invisibly across pages.", so I assume it's not made to be seen. Some CAPTCHAs start to work like that now. Either you can pass, or the website will just show you an Error 403 and will not bother showing you an actual test.

jwr | 19 hours ago

I just use AI to solve the CAPTCHAs I'm presented with.

CAPTCHAs are so outdated, annoying, and imposing on us, users. Let's drop them already.

: lifeisloving | 18 hours ago
Most detection cant be mitigated on the fly by clicking a turnstile or typing captchas anymore, so no idea what AI is doing for you.
Web scraping at scale requires solvers. Even if it wasn't cost prohibitive, an llm controlling a browser would be quite a heavy/inefficient way to solve captchas.

dangistan202611 | 19 hours ago

There is the case of the unending reCAPTCHA v2 Checkbox in a loop. It doesn't care if you solve it rightly.

: LoganDark | 19 hours ago
That's not reCAPTCHA's fault. It happens when you pass a challenge and the website decides that's not good enough and to serve you another one. I'm sure services like Cloudflare invalidates solved challenges if you're still too suspicious, even immediately, and that's probably the root of the problem.
: iagiagiag | 18 hours ago
You still have those? I've not seen them in a long time.