Google has begun testing a fundamentally new reCAPTCHA verification method, intended to replace the familiar tasks of identifying traffic lights and road signs. Instead of clicking on images, the system now asks users to confirm their humanity using a camera: users are asked to wave their hand or show an open palm.
However, the very first trials of the new technology by independent testers turned into a major scandal, revealing critical vulnerabilities in the tech giant's security algorithms.
New verification format and privacy concerns
The essence of the new system lies in the analysis of simple body movements. When verification is initiated, the browser requests access to the device's webcam and requires the performance of a clear gesture. Google states that the video stream is processed instantly and deleted immediately after successful verification, without being stored on servers.
Despite these assurances, the very idea of scanning biometric data has sparked a wave of concern among users. Many refuse to share such information just to access websites, considering it a violation of privacy.
Vulnerability bypassed by stock photos
The main problem identified during testing is the AI protection's inability to distinguish real live movement from a static image. A user on social network X conducted an experiment that demonstrated the algorithm's complete inadequacy against the simplest deception methods.
To test the system's reliability, the tester streamed a standard stock photo of a hand using the free OBS Virtual Camera software. The result was unexpected: the system recognized the still image as a successful human gesture.
After several attempts with various static shots and precise scaling of the image within OBS, Google's algorithm registered the photo as a legitimate dynamic gesture. This proves that bypassing the captcha does not require complex AI animations or expensive video clips for attackers.
Automation of bypass and future prospects
The situation is exacerbated by the fact that the entire bypass process can be fully automated in minutes using a simple script in the Python programming language. This makes the new technology completely helpless even against simple scripts, not just sophisticated bots.
Currently, the new version of reCAPTCHA is in the early stages of testing. The community hopes that Google will promptly update its algorithms and teach the system to correctly reject static images to prevent mass security breaches.