It's not directly addressing version 3's invisible scoring, but the mouse-movement analysis first introduced in version 2 - but because of how the system is implemented on some websites, it doesn't have to fool the newer system.

The researchers have created an automated system that can fool that part of reCAPTCHA.

The 'I am not a robot' checkbox was introduced in version 2 of reCAPTCHA, analysing behaviour including mouse movements to spot bots. This is how it's being reinvented for the AI ageĪnd it's in that gap that Akrout and his fellow researchers strike. Do it at random, and a site will suddenly stop working. 'Most programmers I know add checkboxes because they don't know how to choose a time at which they ask v3 about its belief.' By that, he means that version 3 has a constant score websites can access it at any time. If a website visitor falls below the bot-or-not threshold, the site will surface a page with the older style 'I am not a robot' checkbox, letting humans better understand why their online shopping experience or whatever else was interrupted and giving them a chance to prove their humanity. Instead, Akrout says, many sites choose to negotiate the process a little more kindly. 'This is a bad practice from a user experience perspective,' says Akrout. The first is to immediately show a page denouncing that visitor as a bot, which is a little awkward if the system is wrong and it's a human imagine working your way through an online purchase to suddenly have the page you're looking at disappear and be shown a 'You're a bot' accusation out of nowhere.

If a visitor falls under that threshold at a set point, such as when they're entering a review or login details, the website has two options, says Akrout. In reCAPTCHA v3, websites set their own score threshold for what they are willing to consider a bot or not. The invisible scoring system isn't abused, but nevertheless they claim they could still get past reCAPTCHA v3. That system hasn't yet been hacked, despite the title claim of the authors of a recent paper, 'Hacking Google reCAPTCHA v3 using Reinforcement Learning.' Instead, Mohamed Akrout, of the University of Toronto, and his co-authors focused on tricking a secondary system with machine learning.

Captcha solving bots