this post was submitted on 24 Jul 2024
1077 points (98.4% liked)

Technology

59052 readers
6622 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS
 

Research Findings:

  • reCAPTCHA v2 is not effective in preventing bots and fraud, despite its intended purpose
  • reCAPTCHA v2 can be defeated by bots 70-100% of the time
  • reCAPTCHA v3, the latest version, is also vulnerable to attacks and has been beaten 97% of the time
  • reCAPTCHA interactions impose a significant cost on users, with an estimated 819 million hours of human time spent on reCAPTCHA over 13 years, which corresponds to at least $6.1 billion USD in wages
  • Google has potentially profited $888 billion from cookies [created by reCAPTCHA sessions] and $8.75–32.3 billion per each sale of their total labeled data set
  • Google should bear the cost of detecting bots, rather than shifting it to users

"The conclusion can be extended that the true purpose of reCAPTCHA v2 is a free image-labeling labor and tracking cookie farm for advertising and data profit masquerading as a security service," the paper declares.

In a statement provided to The Register after this story was filed, a Google spokesperson said: "reCAPTCHA user data is not used for any other purpose than to improve the reCAPTCHA service, which the terms of service make clear. Further, a majority of our user base have moved to reCAPTCHA v3, which improves fraud detection with invisible scoring. Even if a site were still on the previous generation of the product, reCAPTCHA v2 visual challenge images are all pre-labeled and user input plays no role in image labeling."

you are viewing a single comment's thread
view the rest of the comments
[–] Mubelotix@jlai.lu 59 points 3 months ago (2 children)

I bypassed 35000 google recaptcha v2 using bots. Don't ever rely on this for security

[–] Caboose12000@lemmy.world 6 points 3 months ago (1 children)

Where can I learn this power?

[–] Mubelotix@jlai.lu 13 points 3 months ago (1 children)

I just spent 3$ worth of bitcoin on NoCaptchaAI. I used their web extension on a server which had a browser opened and controlled by a custom webextension I made so that a solved challenge would be returned to a swarm of clients upon request

[–] gregor@gregtech.eu 1 points 2 months ago (1 children)

Your extension is archived, I'd rather not use it.

[–] Mubelotix@jlai.lu 2 points 2 months ago

It's a custom extension solving my very specific problem on a specific internal website. It was never meant for you to use it, it's just there to serve as inspiration to others

[–] theherk@lemmy.world -2 points 3 months ago (1 children)

It is neither intended nor even stated to be intended for security.

[–] Gizmokid2005@lemmy.world 34 points 3 months ago (1 children)

Except, that's most of its ad copy on Google's own website?

reCAPTCHA uses an advanced risk analysis engine and adaptive challenges to keep malicious software from engaging in abusive activities on your website. Meanwhile, legitimate users will be able to login, make purchases, view pages, or create accounts and fake users will be blocked.

It's literally billed as a security measure for a website.

https://www.google.com/recaptcha/about/