dessant / buster

Captcha solver extension for humans, available for Chrome, Edge and Firefox
https://addons.mozilla.org/en-US/firefox/addon/buster-captcha-solver/
GNU General Public License v3.0
7.9k stars 593 forks source link

Arkose labs captcha #178

Closed isinteger closed 3 years ago

isinteger commented 4 years ago

Have you thought maybe about extending the extension to arkose labs captcha? Is it possible?

https://www.arkoselabs.com/

dessant commented 4 years ago

I think their challenges are one of the most pleasant captcha solutions available on the web, and I don't yet see a good reason to add support for them in Buster.

DanH42 commented 4 years ago

I'm bumping this issue because I've been seeing more Arkose captchas starting to pop up lately, and they've been getting increasingly difficult. While they were previously requiring 3 solves to pass in most cases, I'm now expected to solve as many as 9 in a row before being allowed to log into a site. And in addition to the relatively simple "rotate the ball" challenges, they've started showing six copies of a more complex puzzle like "pick the maze that has a valid solution" or "pick the image where all the dice add up to 14" and you STILL have to repeat that 3-9 times. If you get one wrong, they don't tell you right away, they just keep letting you solve more and then tell you at the end that they didn't like one or more of your answers, or that you just took too long, and then they make you start over. The more times you fail, the harder the challenges get. It often takes me several minutes to pass one of these cursed things, assuming I don't just give up first. I find them to be at least as bad as reCAPTCHA now, if not worse.

Example showing 9 required solutions of a complex challenge

Their accessible audio version, however, sounds similar to reCAPTCHA's, except they're only reading digits instead of words. That sounds like it should fit Buster's approach wonderfully, so if the only reason for not supporting them in the past was that they weren't so bad, I'd encourage you to reconsider in light of recent changes.

dessant commented 4 years ago

I've just found this, though not sure if it's real. Your screenshotted challenge also looks awful. The numbers in the audio are also spelled out fast enough that I had trouble typing it in quickly on mobile, I can only imagine the difficulty of solving this even with mild disabilities.

For now I've only found these demos for testing:

https://client-demo.arkoselabs.com/github https://client-demo.arkoselabs.com/solo-animals https://www.google.com/search?gl=us&hl=en&gws_rd=cr&q=site%3Ahttps%3A%2F%2Ffuncaptcha.com%2Ffc%2Fapi%2F

I see the audio challenge is not always available, for example here: https://funcaptcha.com/fc/api/nojs/?pkey=73BEC076-3E53-30F5-B1EB-84F494D43DBA&litejs=1&fb_type=10&session=791597e64669cbda0.67846068&r=us-east-1&lang=es

Please share any other demo or site where the challenge types can be tested.

dessant commented 4 years ago

Further resources:

https://arkoselabs.atlassian.net/wiki/spaces/DG/pages/214176229/Standard+Setup https://arkoselabs.atlassian.net/wiki/spaces/DG/pages/289080310/Non-JavaScript+Support https://arkoselabs.atlassian.net/wiki/spaces/DG/pages/335905657/Inline+Integration+Guide https://arkoselabs.atlassian.net/wiki/spaces/DG/pages/198215091/Supported+Languages https://arkoselabs.atlassian.net/wiki/spaces/DG/pages/786526/Accessibility

DanH42 commented 4 years ago

Here's some other sites I've seen people complaining about:

https://www.twilio.com/login/password https://www.dropbox.com/login https://www.dplay.no/mydplay/login https://www.epicgames.com/id/login/epic https://signin.rockstargames.com/signin/user-form?cid=rsgsupport https://www.roblox.com/login

Just enter any random fake email/password and you should get prompted

Also, my heart goes out to this poor soul as I reconsider my frustration with being asked to solve a mere 9 puzzles.

MuhannadYT commented 3 years ago

This would be HIGHLY appreciated, as they are really hard to solve and the have time limits ![Uploading Screenshot_20210306_191851_com.roblox.client.png…]()

crankycupcake commented 3 years ago

I got this issue while registering an account on EA. After solving 5 14-sum-dice challenges, it brings me 10 more. Better quit.

DanH42 commented 3 years ago

It looks like this idea may be dead before it even got off the ground. I've been doing Arkose's audio challenges manually when I encounter them because they're still a lot easier than the ridiculous visual puzzles, but I recently got this prompt:

Audio Challenge: "Press Play, type the number of the song that is the most sad, then press Enter or the Done button below"

It played 3 slow MIDI piano tunes. In addition to being fairly long to get through, none particularly stood out as "more sad" than the others, at least for the set I was given. Since I know these challenges only get harder when you give an answer they think is wrong, I just gave up on the spot and moved on to something else.

As an aside: I know that while this isn't a strategy Buster would be able to employ with its current architecture, it's not too hard to train a neural net to listen to a tune and categorize its mood, but even that extreme approach probably wouldn't work here, since I couldn't classify them as a human. At this point it feels like my best hope for sanity is that these sadists put their toe far enough across the line in terms of accessibility that they get hit with legal action and are compelled by a judge to make their challenges a bit less challenging. Not holding my breath on that, though.

PolyLOL88 commented 3 years ago

They now disabled audio vertification

The-SamminAter commented 3 years ago

They now disabled audio vertification

It seems to be still available on socialclub.rockstargames.com. Screenshot

dessant commented 3 years ago

Issue is tracked at https://github.com/dessant/buster/issues/320.

dessant commented 2 years ago

The Arkose Labs service is now so hostile to users that it may be breaking accessibility laws is some jurisdictions. It would be important to raise your concerns at the appropriate government agency in your country.

You can also raise awareness at W3C, they have a working group that documents the inaccessibility of captcha services, and they are receptive to feedback. Let them know about the companies that hinder your access to services and information on the web.

https://www.w3.org/TR/turingtest/

https://github.com/w3c/captcha-accessibility/issues

https://github.com/w3c/apa/issues

eileenmcnaughton commented 1 year ago

Hmm I found this cos I can no longer log into twitter because I can't navigate through their captcha

image