reCAPTCHA isn't secure 😱

Disclaimer: I can't 'officially' verify this.

I've been using Firefox as main browser with about 5 addons for added privacy for ages now. When googles (fucking) reCaptcha takes more than a few minutes on Firefox (about 90 percent of the time, I'm estimating), I switch to Chromium (with the same amount of (similar) privacy addons) so I can go on with my stuff.

Now, I recently thought 'why not try to do user agent spoofing on Firefox to see if reCaptcha would start working 'normally'?

So, I installed a user agent spoofing addon on Firefox/Chromium, results:

Without spoofing:

Firefox reCaptcha success rate: 10 percent approx. (mostly 2+ minutes)
Chromium: 90 percent. (mostly instant)

With spoofing:
Firefox: 90 percent approx.
Chromium: 10-20 percent approx.

Again, I can't prove any of this yet but mother of fucking god, whenever using Chromium or spoofing Chromium on Firefox the succession rate skyrockets.

Google, what the fuck are you up to?

Mother of fucking god, its astonishing to see how difficult it is to entirely block out Google from your computer.

Actually, its very easy and I wrote something to automate that but the second you block out that goddamned mass surveillance network, every login page of every goddamn site with a fucking recaptcha just doesn't work anymore.

Google, go fuck yourself and with that, every motherfucking site which uses recaptcha.

It says i should select all parts of a stop sign... help me pls :c

Am i the only one that hates Google reCAPTCHA from the body down to the soul ?

- Click the Car
- The Blue Car
- The Truck
- The Truck Bus
- The Bus Truck
- With Blue Light
- Select the Bicycles
- Skip the house
- Find the sign
- With the blue bat
- Purple pink hat
- Click Traffic light
- We mean all Traffic lights
- Select Stores
- With Zebra Crossing
- ...
WTF!!! Just kill me already.

fujioaskl;f;asdfjkl
WHY THE FUCK DOES MY BOSS HAVE ME MOCKING FUCKING RECAPTCHA API RESPONSES? IT'S SO FUCKING STUPID

I CAN'T MOCK THE RECAPTCHA JS METHODS SO I HAVE TO MAKE VALID-LOOKING JSON RESPONSES AND I DON'T HAVE A FUCKING CLUE HOW ANY OF IT FUCKING WORKS

THIS IS THE STUPIDEST THING ANYONE HAS EVER ASKED OF ME (okay, it isn't, but it's pretty damned close.) AND IT'S DURING MY BLOODY PERFORMANCE REVIEW.

I hate reCaptcha so much nowadays.

Now this is what a captcha should look like...

System.out.println("recaptcha check successful. Humans sucks :p")

You know what makes sense? Having a reCAPTCHA on a REST API.

Select all images with cars. I did and its not correct. Why not?

Did you know reCAPTCHA v1 will no longer work from now on? Would be interesting to know how many sites are still using it...

That is peak security:
- Require timebased OTP for login
- Also require recaptcha for login
- Select the frickin bus, palm tree and cross walk 93 times
- Finally manage to please the algorithm
- The 30 second validity window of TOTP expired

*GAAH!*

Go home captcha, you're drunk

FUCK RECAPTCHA.
FUCK GOOGLE FOR MAKING RECAPTCHA.
FUCK IT

"Don't be evil." My foot.

Please google, stop the recaptcha madness...I'm sitting here for 30 minutes, clicking on road signs

Why did suddenly all websites start putting recaptcha in front of every user submission? Have they not heard of request limiting? I'm so tired of having to identify bridges, store fronts, cars, and unicorns before being able to do ANYTHING on the internet. For fuck's sake.

Google: "How do we have millions of people identify images for us so we can reinforce our image recognition software?"

Answer: reCAPTCHA

Okay, Google. I can see why you want me to check those boxes with cars. And I'm also fine with you telling me to do it on a different picture if the first one didnt had any, just to check. But WHAT I AM FUCKING NOT OKAY WITH, IS ME SOLVING CAPTCHAS FOR 10 FUCKING MINUTES REPETEDLY SAYING PLEASE TRY AGAIN AND THEN TELLING ME THAT I AM NOT EVEN ABLE TO TRY AGAIN BECAUSE OF AN DETECTED ATTEMPT OF BOTTING? WHO ARE YOU? AN AI QUESTONING MY HUMAN IDENTITY? JUST BECAUSE IM USING LINUX YOU DECIDE TO GIVE ME ANOTHER NOTHERFUCKING BATCH OF STREET SIGNS? YOU CAN STICK THOSE STREET SIGNS UP YOUR ASS! FUCK OFF!

tl;dr: i got banned from solving recaptchas the second time this week. lets hope its just *another* timeout.

What is going on with the web these days? 500 adds, 3 auto play video's per page and now this shit?!

Websites that do this should be removed from Google.
I don't think it's even allowed.

If you block it, it goes to a subdomain 1.<website> and asks for permission again. If you block that one it'll go to 2.<website>, up until 10.<website>, then it switches to either a "get Express VPN" or another website that asks for permission. And that one even claims to be reCAPTCHA! and then another that asks you to press "Allow" in order to watch the video. What video?!

Where's the BIKE bitch !!!!????

Soo.. Google is using ReCaptcha to improve their AI... They are verifying the answers by having multiple users solve the same image...

Couldn't we break their AI by just having enough users answer the same Captcha in the same wrong way?

This is the Result Declaration form of our university, It's all good but there is one thing (bug) in this form, you only need to fill the Recaptcha once and you can that same Recaptcha to extract as many results as you want. Though not a Security issue, we can extract results of many students as roll numbers are sequential, we just need a bot to fill roll number and click the button. The only use would be to conduct surveys on results, but, a bug is a bug.

THIS FUCKING RECAPTCHA GEM! WHY THE FUCK MUST I DEBUG YOUR FUCKING PRODUCTION CODE AND WORK AROUND YOUR FUCKING BLUNDERS?

VERY LITTLE PISSES ME OFF MORE THAN SUFFERING FROM SOMEONE ELSE'S FUCKING STUPIDITY

Any alternative to Googles reCAPTCHA?

Backstory we have a contact form, in a bootstrap modal, loading the form as an ajax request. The form has (as of today) a captcha, as we where getting a lot of spam.

Guess what it does on safari? Right... It renders outside the modal and since there's no need for scrolling, bootstraps modal adds an overflow hidden to the body. Results in non submitable forms on some resolutions.

Any idea on how to fix this, or other captcha systems we could use (it's a Symfony app).

Oh, RSpec.

Adding recaptcha tests, I copy a passing login spec
and because I'm bored, I run it again just to check.
I paste in the passing mock
and run it in my new block
and oh no, why are you failing? What the heck!?

It is increasingly difficult to believe that Google CAPTCHAs are not deliberately made unsolvable.

Everyone hates CAPTCHA, that is nothing new. As most people know, CAPTCHA frequently whines "please try again" after the user provides the correct answer. Sometimes it shows "Please select all matching images." when no new images with the named subject exist. However, now Google is taking it to a new level.

After clicking, the pictures take five seconds to fade to white and the new pictures take another five seconds to fade in. And CAPTCHA challenges have an expiry duration of two minutes. This causes CAPTCHAs to expire before it is possible to solve them.

Does Google think I am not a human because I don't have the time to waste whack-a-moling random StreetView pictures?

I have a feeling that Google is laughing at us for wasting efforts solving CAPTCHAs that are not meant to be solved.

The company that I work for has recently recruited a team for Web Development, so they don't have to pay a monthly fee to the previous team who designed their website.

They have over 3000+ products in the old website, and no logical way to import them to the new website. The old team was asking for 300$ to give them an API which would return the product details in an XML format.

Obviously, paying that amount of money wasn't logical for a dying website, so the manager decided to hire someone to manually copy the content from the old admin panel to the new one, that is until I stopped him.

My solution? Write a simple web scraper to login to the old panel and collect data. Boom! 300$ saved from going to waste.

Now, the old team found about this and as much as my manager was happy, they were quite angry. So they implanted a Google reCaptcha to prevent my bot from scraping the old panel.

I spent about 20 minutes, and found out once you're logged in to the old panel, the session is saved in a cookie and you are no longer greeted by a Captcha.

So I re-written a small portion of my bot, and Boom! Instant karma from manager. We finished publishing the new site, and notified the old team, only to see the precious look on their face. Poor guy, he thought I was a wizard or something 😂😂

That's what you get for overcharging people!

TL;DR: Company's old website team wanted to overcharge us writing an API to fetch 3000+ records.
Written a basic web scraper to do the same job in less than an hour.

What do you do when your redirect doesn’t go where you tell it?

Clearly I’m missing something.

I stepped through the code, following the failure path of Sheogorath’s Recaptcha. It fails as expected, and hits this redirect before doing anything else:

`return redirect_to new_user_session_path`

I verified that this redirects to the “/users/sign_in” path, and it returns so the server doesn’t even try to authenticate the user. It just nopes out as it should to prevent timing attacks.

But somehow instead of doing that and redirecting as it should, it signs the user in and redirects somewhere else entirely: the role select page, which only happens after authenticating an admin user. It never even hits my breakpoint after the recaptcha check! It never authenticates!

I think what I’m missing is my old reality where things made sense.

Fuck RECAPTCHA !

Good job reCaptcha for not fully displaying the pop-up!

When I see all those People, running around, watching their smartphones and don't see the world around them, I start asking my self if the most used lie on the internet is "I'm not a robot"...

Who the fuck thought that carieer grade NAT would be a great solution instead of just switching over to IPv6 and have functioning internet?

I don't want to share my IP with some bastard who fails every reCaptcha so that pictures take 5 fucking seconds for me to fade out and in again.

Neither Chrome nor Firefox have a reliable way of forcing IPv6 if possible so Google still thinks I'm an evil bot.
I'm waiting for my PayPal to be frozen because of "suspicious actions from 'my' internet connection".
I don't want to share my IP. I want to be responsible myself for everything that happens to it.

Please replace that old switches that are too slow to manage serious traffic anyway and are just wasting their power for being turned on so that I can have an IP address to myself

I have spent 5 days in Microsoft Excel trying to do my budget planner. I struggled a lot and too much Googling. Google started to show reCaptcha whenever I search for something after that.

Yesterday, I spent 3 hours and got my fully functionality web based budget planner done.

I don't know if I did the right thing or not but am really happy and I have the full control.

Integrating Google recaptcha into my web service. For some reason it always errors, both on a production and development environment, correct domains configured, and with he simplest setup. I'm fucking lost, documentation assumes it actually works. Similar errors on stack overflow and Google groups either got no answers or have obvious issues.

Fuck this man

What the heck reCAPTCHA

A while back I saw a spammy ad on a website that looked like a Google ReCAPTCHA checkbox. I accidentally clicked it. Twice!

Yeah, got it, the bug made it into production

Have any of you noticed how bad the new Google login page is? They invented reCAPTCHA, yet they use the old one. Considering how easy it is to make a mistake in the captcha and have to retype the password, people could start making shorter passwords (<16 characters) and seriously lower the security level of their accounts.

Whenever I utilize a Google technology, I start with "... Go go" as if I'm Inspector Gadget.

Go go Google Recaptcha!

Google reCaptcha is not really responsive

Someone has a cloud VM running automated attempts to sign up at our website, which is causing the payment processor to block us because of all the suspicious credit card creation attempts, so we get no new signups... I suppose implementing recaptcha is a potential solution/mitigation for this? Do you guys have any other suggestions?

What the hell is wrong with recaptcha? It is solely there to be a nuisance, especially if I use a 2FA device. I do not fear hacking attempts against my username+password, because the 2FA will keep the lucky guess out.

Just bumped into this service called hCaptcha which looks very similar to Google's reCaptcha.
Anybody used it before? what's the difference in terms of benefits?
if it is not a google service, then where does it fetches its captcha images from?
I'm just a bit curious.

Why isn't anyone asking where Google's recaptcha images are coming from?
Yesterday, the challenge i got was clearly obvious, it was a car shaded by a tree shown from side view and it looks like someone unknowingly holding his/her device pointing to it (bloatware i suspect). And today i am told to pick "stairs". Yes! from someones fucking home! No sugar-coated explanation is justifiable enough for this sort of fuckery!

Looks like Googles recapture is now used to help their deep mind AI identify dick pics 🍆

ReCAPTCHA

Is there a way to get rid of the reCAPTCHA while website scraping using Python? Thanks

Tryna search for my new self inspired sexiest domain name if available but the fucking page keeps bringing up that fucking recaptcha asking me for some fucking description about some fucking cars, fucking roads, fucking bridges, dunno if that was my fucking business!
I want you to stop asking me shitty questions cause i'm a fucking robot. Hence i wrote a script that would change the typo from "i'm not a robot" to "i'm a f*cking robot" any time i visit any fucking page requesting for my fucking identity!
Fuck Google!, Fuck Recaptcha!, Fuck Hostgator! Fuck Security! Fuck them all!!!

Most spam attempts sent to my contact form scripts are so cryptic and useless; it looks like there`s just a bot sending garbage to persuade webmasters that they need recaptcha.

Hi, so I am fairly new to GitHub and I just wanted to know how do you publish your code on GitHub Public Repo without disclosing your sensetive credentials like DB hostname, username and password, and other keys like Recaptcha secret?

My GitHub repo is connected to Heroku hosting so I cannot replace the keys with something dummy. It will fuck the production deployment up.

Is google training its google maps AI with recaptcha?