[Article] Hacking Google reCAPTCHA v3 using Reinforcement Learning

Sven

More here :: https://arxiv.org/abs/1903.01003

wolfvanween

hahaha, excellent. Beating Google with their own weapons.

VMart

Can workout in Captcha Breaker?
 8-) 

andrzejek

https://github.com/search?o=desc&q=recaptcha&s=stars&type=Repositories

there may be something soon?

Deeeeeeee

From paper Sven cites:

"Our proposed method achieves a success rate of 97.4%"

Wow. That is....solved! 

I'm not sure I understand the mechanism used by their agent, though.

" Our approach simply applies the trained policy tochoose optimal actions in the reCAPTCHA environment."

" Depending on this interaction, the reCAPTCHAsystem will reward the user with a score."

I do not see how they establish this scoring, as reCAPTCHA systems only reward 100% for solves, and not anything for partial solves.

So then, how does the "trained policy" run through the time/direction/velocity (last parameter just to authenticate a real user, not to really solve puzzle, I would guess)  maze of simulated mouse movements, in such a way as to solve the reCAPTCHA puzzle?

Just do many, many, many, many puzzles and correlate results with which ones solve correctly, then "see" what is in each "block" that is geometrically or color-wise similar?

An incredibly large sample size is then needed??

Just wondering....

ComputerEngineer

Deeeeeeee said:

From paper Sven cites:

"Our proposed method achieves a success rate of 97.4%"

Wow. That is....solved! 

I'm not sure I understand the mechanism used by their agent, though.

" Our approach simply applies the trained policy tochoose optimal actions in the reCAPTCHA environment."

" Depending on this interaction, the reCAPTCHAsystem will reward the user with a score."

I do not see how they establish this scoring, as reCAPTCHA systems only reward 100% for solves, and not anything for partial solves.

So then, how does the "trained policy" run through the time/direction/velocity (last parameter just to authenticate a real user, not to really solve puzzle, I would guess)  maze of simulated mouse movements, in such a way as to solve the reCAPTCHA puzzle?

Just do many, many, many, many puzzles and correlate results with which ones solve correctly, then "see" what is in each "block" that is geometrically or color-wise similar?

An incredibly large sample size is then needed??

Just wondering....

That is correct. An incredible size is necessary. However with having so many IPs, I believe they can collect enough amount of samples over time.

With  Reinforcement Learning it is 100% possible to solve just requires massive amount of data - trial in this case

I have read their article, they did the basic stuff, simulation of real browser, not logged in, not using any proxy

Now I wonder that how their IP was not blocked by google due to so many fails. This my biggest question 

And do not expect that they will release their trained model to public

VMart

Hellow brother, lot of non-technical people available like me, I could not understand you r conversation in terminology.
How implement in this reCAPTCHA mechanism in Captcha breaker, or how it use.
Can implement in this captchabreaker sven

Deeeeeeee

"That is correct. An incredible size is necessary. "

Oh, OK. So that IS it....hmm....

"Now I wonder that how their IP was not blocked by google due to so many fails. This my biggest question "

hahaha Best question, and most relevant to us all, so far, BY FAR!

I very much appreciate the discourse.    This is what sets Sven's boards apart, in my experience.  A lot to learn, on all levels. Unfortunately, I have a way to go, in terms of SEO learning and application.

Deeeeeeee

"Hellow brother, lot of non-technical people available like me, I could not understand you r conversation in terminology."

To explain it another way, these guys solved Google reCAPTCHA with AI, examining super-large sets of "experiences" hitting a reCAPTCHA puzzle, then sorting through the results to find correlations when they somehow randomly successfully solve it, and use that data to solve better in the future.  A LOT better than just random success. WOW.