18

As far as I know, google has changed its re-captcha to a new one for google chrome browser. Google URL Shortener uses this kind of captcha.

This re-captcha verifies that "We are not robot" automatically only with a single click. But how does it work?

In the image below, you can see the captcha.

(1) We click on "I'm not a robot" and (2) after a while, (3) re-captcha verifies that automatically:

enter image description here

  • 1
    This "checkbox" should work on all browsers who support HTML5. Not only for Chrome. This also works in my IE 9. – crazypotato Sep 21 '14 at 19:05
  • @crazypotato Yes, until two days ago, as far as I know, this re-captcha didn't work on Firefox and Opera (it was old difficult captcha). but today, this captcha came instead of the old one! – Amirreza Nasiri Sep 21 '14 at 19:51
  • 3
    This seems to explain it very well: stackoverflow.com/a/25626267/3622209 – user3622209 Nov 6 '14 at 23:52
  • @user3622209 Really? People only want to know its JS? Thats so obviously. I don't understand this. Also part about "spambots" laughable – crazypotato Dec 4 '14 at 9:52
  • Where can I try this out? Google URL Shortener does not show me one. – gparyani Dec 10 '14 at 6:20
7

As far as I know, there's quite a few things that are going towards it. For a start, it uses Javascript - which many spambots can't execute, so it's inherently stopping a lot of spambots in that regard. (depending on if the owner has configured fallback, they may see a basic HTML version of the CAPTCHA).

But more to the point of determining a 'human' click to a 'possibly robot' (and show visual CAPTCHA) click:

  1. IP Addresses - as mentioned, being on Tor IP addresses almost certainly leads to a trigger for the visual CAPTCHA. Also, being located in certain countries seems to increase probabilities, but I can't be certain on that.

  2. Google Account and History, * perhaps* - I notice a lower incidence of the visual one firing on me when signed in, versus when I'm in Incognito mode. Also, if you've had a Google session watching YouTube videos, sending emails, you would be seen as a lesser threat than someone who's just loaded a page for the first time.

  3. Page activity - I haven't deleved into this too far, but it seems they're using some sort of mechanism to detect how you're viewing the page. If one is to click the CAPTCHA as soon as the page is loaded, rather than after 30 seconds of form filling, they're seen as higher-risk.

  4. Number of times anti-robot check completed - This is an obvious one. Eventually, if you keep ticking the box over an over, the higher the probability of the robot check firing. A spambot may be able to get through a form the first 3 times, but after that when the robot-check fires, they are stopped.

  • Hmm, good :) but this new captcha's security is lower than letter captchas because if a smart robot targets and know the algorithm of this mechanism, it can be easy for the robot to solve ALL of these captcha. so do you thing there is any "randomization" to avoid this problem? – Amirreza Nasiri Dec 23 '14 at 21:32
  • 1
    Good point, completely forgot that - added the last one. After some time it does appear to throw some random ones in. – mjt Dec 24 '14 at 3:11
1

As far I as know there's some sort of bot that looks for "human patterns". If you for instance were able to scroll to the bottom of the page and instantly click the "I'm not a robot-button" you would most likely NOT be approved - but would be asked to do an old captcha.

  • 1
    That seems a bit too simple. So you say the only difference here is a matter of how fast you scroll down? I guess if it's done in an instant, it might be a robot, but once this is known, the bot just has to wait a little longer to appear human. Not a good test! – SPRBRN Dec 22 '14 at 8:54
  • This was just an example. The over all idea is to look for robot-ish behavior. – GLaDER Dec 22 '14 at 12:16
0

Google probably has an IP address blacklist like this. If your IP address is listed on this database, "normal" recaptcha is shown. If not, then you bypass this "checkbox".

This is a very simplified explanation but the IP address is the most important part. You can sniff all the data being sent to Google, but only Google knows what exactly is processed on the server-side.

Anyway this "checkbox" won't be used for major services like Google search (too simple for a bypass).

While using TOR (most IP banned in google search) after clicking the checkbox, the usual unreadable(?) captcha will appear (1 word garbage + 1 word with possibility read it):

fk recaptcha

I think it's irrelevant, but it appears this page was written in HTML5

  • 1
    Yes that's right the captcha depends on IP and Browser (both of them, I'm sure). But how does it work? – Amirreza Nasiri Sep 21 '14 at 11:40
  • 1
    Humans have flaws. And in a graphical user interface you move a mouse around in a random way that robot’s can’t replicate. The way you swoop a finger on a trackpad or drag a mouse. Acceleration, deceleration, pauses… That all adds up to a human. Spambots are too perfect in their data entry and that is their flaw. – JakeGould Dec 10 '14 at 8:02
  • I disagree, Jake. I can program bots to mimic mouse movement with ease and nothing can tell them apart from humans. There are other things that are not doable (not in a time-efficient manner anyway), but mouse movement is not one of them. – Overmind May 10 '17 at 10:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.