Trade offers now contain captcha

[scholtzm]

Valve decided to add captcha to trade offer window.

http://steamcommunity.com/groups/tradingcards/discussions/1/622954023422884592/ https://twitter.com/SteamDB/status/553642965688909824

This pretty much kills the whole trade offer part of SteamBot for now. They claim they have added exceptions for "some trading services".

We will see how this goes in the next few days.

[alexey-gromov]

Use anti-captcha

[BlueRaja]

What a dumb idea. Once the user has been tricked into downloading and installing malware, the game is over. No amount of CAPTCHAs can save them - I highly doubt this will save even one person from losing their items.

They need to be putting more preventative measures to stop scammers from mass-scamming in the first place.

[FrozenHaxor]

@BlueRaja I agree, It's just like when the phishing spambots were massively adding random people and sending them phishing links. Instead of doing some clever filtering on that - what Valve did? Blocked adding more than a few people a day to your friends list, thus ruining trading completely for most people.

They always go with the dumbest ideas that cause more harm, even to people who weren't affected by the problem in first place. Horrible policies.

[debugger-perm]

IMO, whitelisting is good idea, but who know how valve filed current list?

2015-01-10 5:51 GMT+05:00 FrozenHaxor notifications@github.com:

@BlueRaja https://github.com/BlueRaja I agree, It's just like when the phishing spambots were massively adding random people and sending them phishing links. Instead of doing some clever filtering on that - what Valve did? Blocked adding more than a few people a day to your friends list, thus ruining trading completely for most people.

They always go with the dumbest ideas that cause more harm, even to people who weren't affected by the problem in first place. Horrible policies.

— Reply to this email directly or view it on GitHub https://github.com/Jessecar96/SteamBot/issues/689#issuecomment-69427441.

[WildCard65]

shall I bring in @ValveSoftware to this?

[vudung45]

"We’ve excluded a few of the existing third-party trading services from this requirement so they can continue to function"

Is there a way to be on this whitelist? By the way, can we get the picture of the captcha so that the users can type in on their behalf?

Edit: Dota2lounge, csgolounge bots r working normally, dont know about other sites

[doktokto]

OMG, does it mean that part of my bots in whitelist? O_O

[doktokto]

Link for captcha: https://steamcommunity.com/tradeoffer/new/captcha?v=*************&sessionid=**************==&partner=*****

[Jessecar96]

No your bots are probably not in the whitelist, and if they use trade offers they won't work anymore. Valve does not have a way to get on the whitelist at the moment so you're out of luck for now.

All pull requests to add a captcha cracker or an exploit around it will be deleted by me. This is not the way you get around this.

[doktokto]

I need to be able to manually write captcha, I already have idea how to make it but I don't know how to make bot see the captcha link. Anyone know how?

[doktokto]

@Jessecar96, but some of my bots still works

[SleepinDevil]

@doktokto @Jessecar96 I can also confirm that my personal trade bot works now. It did not work this morning and I rage quit and force-power-button-shutdown my little trade bot laptop before I went to work - when I found out about the captcha thing. Then I come home to the pleasant surprise of the bot account being able to receive and send trades without captcha again.

I am quite content, but I feel like steam is teasing me with the golden apple infront of me before they viciously rip it from me again shortly.

[scholtzm]

So apparently your account is automatically white listed if you have ~5500-7500* trades. The number is only estimate, we still don't know the exact number.

*Account with 5401 trades has captcha. Account with 7530 trades does not.

edit. Market trades might also be used to determine this. It's still very unclear how the whitelist works.

[debugger-perm]

Who stop me from cheat with two bot and one item in direct trade?

[scholtzm]

They just switched to Google's reCaptcha.

[WildCard65]

Does that make it unbypassable? On 2015-01-10 7:21 PM, "Michael Scholtz" notifications@github.com wrote:

They just switched to Google's reCaptcha.

— Reply to this email directly or view it on GitHub https://github.com/Jessecar96/SteamBot/issues/689#issuecomment-69478045.

[waylaidwanderer]

I have a workaround in mind, but it might not be the best solution. If you can get an image of the captcha and then ask the user to solve it for you (and implement error handling for failed captchas) it wouldn't be too big of a problem.

[doktokto]

I get previous captcha image and saved it, but now they using reCaptcha, of course it's better for users, just another one mark in trade, but now I can't fetch captcha. I wanted to fetch it like an image, but there is so many requests. Have any ideas how to easily fetch it?

[SleepinDevil]

Stop trying to beat the captcha system that's not the way to do it. Go get in contact with Steam community support or something to try get yourself whitelisted but I doubt they would do it for just anyone.

Also since Steam is using Google Recaptcha, gg, good luck finding a solution which can mimic user mouse interaction with the page which is what Google uses to determine if it's a bot or not, it's not just a matter of clicking the checkbox. And if it suspects bot behaviour (IE large number of captcha requests from same IP, similar user input during capture ticking process, page referrer etc) then it display an image captcha instead anyway. Which has happened to me so many times already by manually accepting trades on my non-bot account.

So, seriously, stop trying to beat it, they've got a good implementation of it now, just try to be legit.

[doktokto]

I just want to have solution to manually write captcha. I can't manually do things that do my bot that now have captcha and this bot makes only about 2-3 trade offers each day.

[vudung45]

@doktokto I dont think there is away to do it. Im on vacation right now, didnt have time to check this shitty update. have u found the link to get captcha yet? The users could help typing the captchas on their behalf right?

edit: there has not been a way to bypass this google recaptcha thing LOL

[scholtzm]

There are third party services which can solve even Google reCaptcha. It costs money though.

[doktokto]

I'm using two bots right now to trade items to each other, if after 10000 successful trades trade offers will still asking captcha - I will wait another ways to get whitelisted. I don't know what to do. Maybe sites that solve reCaptcha have instruction how to fetch it? How they get captcha for solving?

[WildCard65]

Try emailing valve or send in a support ticket.

[vudung45]

@scholtzm really? I thought this google no captcha thing is not bypassable

[vudung45]

The point is developing is gonna be prohibitted since people like me who dont trade much and have lack of rep wont be on that exception list. Are they putting requirements on sites and users who want to be whitelisted?

@doktokto so number of trades is not a condition then...

[doktokto]

Epic win. 5762 trades. No captcha anymore.

[MaxyBlack]

doktoko how? explain i want try this method.

[scholtzm]

You need 2 accounts and you simply trade 1 item back and forth using the regular trading method.

@doktokto Nice one. The treshold is probably between 5500 - 5750. The only thing I don't understand is why someone said that they had no captcha with 4900 trades.

[Bottswana]

Knowing Valve, it may depend on a number of factors such as account age, steam level, history of trading ect.

I would imagine some accounts might not even be able to be whitelisted.

Additionally, these types of whitelist may be temporary. On 12 Jan 2015 14:24, "Michael Scholtz" notifications@github.com wrote:

You need 2 accounts and you simply trade 1 item back and forth using the regular trading method.

@doktokto https://github.com/doktokto Nice one. The treshold is probably between 5500 - 5750. The only thing I don't understand is why someone said that they had no captcha with 4900 trades.

— Reply to this email directly or view it on GitHub https://github.com/Jessecar96/SteamBot/issues/689#issuecomment-69576331.

[MaxyBlack]

thx, i will try this.

[vudung45]

k. Its time to farm mah trades up

[ippo20]

@doktokto @scholtzm Regular trading method? Manually? Or using the Trade Request Method, if this, how do we tell the bot to Request a trade on another bot. Haven't tried this part

[doktokto]

Bot 1 and bot 2. Bot 1 invite bot 2 to trade. When trade init bot 2 add item. When bot 1 see that item added he add item too. When bot 2 see that item added he mark that he is ready. Bot 1 mark too. Bot 2 accept. Bot 1 too. Add to bot 1 OnTradeClose() sending invite again. Each trade takes 11-16 seconds. One of bot sometimes crash (randomly), need to add try{} catch {} in that places where was error. When I started it one of bot (random) crashed after 100 trades. After try catch adding bot's crashed each 1000 trades. Maybe you will make it better.

[ippo20]

@doktokto Hi, I got the idea, thanks, my simple problem is the Initialize part, Bot 1 Invites Bot 2 to trade. I never tried my bot doing the Invite, only used OnTradeRequest to initialize everything. Looking at the code of TradeManager, i figured I should start with InitializeTrade then CreateTrade?

EDIT: I am looking at the wrong part, I guess I should use OpenTrade instead.

[doktokto]

Bot.OpenTrade(AnotherBotId);

[doktokto]

I'm used this pull request because it makes bot little faster (1-3 seconds each trade): https://github.com/Jessecar96/SteamBot/pull/693

[Jessecar96]

Closing & locking this issue since there is no real issue here. I don't want people talking about how to bypass captchas. If you want to get around it contact valve somehow.