HardwareFreaks

Tag: Anti-bot

  • Google is testing a webcam CAPTCHA that scans your hand, but it’s already been bypassed using a photo

    Google’s New Handshake Challenge: Are Biometric Captchas Just Digital Dust?

    In the ongoing digital arms race against automated bots, tech giants are constantly tweaking the systems designed to ensure that online interactions are performed by real people. Recently, Google has embarked on an ambitious effort to revamp its notoriously frustrating reCAPTCHA system by introducing a radical new approach: biometric identification via hand gestures.

    This experimental method, officially dubbed “Hand Gesture Verification” (HGV), aims to use webcam-based scans to confirm that the person attempting to interact with a website is, in fact, human. The goal is to create an anti-bot challenge so sophisticated it can reliably distinguish between genuine users and malicious algorithms.

    But as often happens when technology chases complexity, early testing of HGV has yielded somewhat disappointing results. While the concept sounds futuristic and incredibly secure, the practical application of scanning a user’s hand movement for verification has proven largely ineffective in stopping automated traffic.

    The skepticism is warranted. If a system designed to confirm humanity is mostly useless in practice, it raises serious questions about its viability in a real-world security context. Beyond mere inefficiency, the potential implications of deploying such biometric scanning technology—even in a rudimentary form—demand closer scrutiny.

    While Google continues to explore the theoretical possibilities of using physical movement as a digital key, the current reality suggests that simple puzzles are often more effective than complex biometric checks for filtering out bots. The challenge remains whether this pivot will lead to genuinely robust security or simply introduce another layer of digital noise into our online experience.

    Credit: TechSpot

  • Google testing controversial webcam-based reCAPTCHA that asks for a hand scan to prove you’re human — testers beat it with a stock photo

    Featured image Google testing controversial webcambased reCAPTCHA that asks for a hand scan to prove youre human testers beat it with a stock photo

    In the endless digital war against automated bots, Google decided to crank up the stakes and add a splash of biometric flair to its famous reCAPTCHA challenge. The goal? To ditch simple visual puzzles for something far more personal: a test of human presence via hand gestures.

    The experimental system asked users to activate their camera and perform a specific gesture, mapping twenty-one coordinates of the hand to determine if a real person was actually present. This new approach is designed to catch sophisticated threats like automated account creation and credential stuffing, moving beyond the limitations of older visual checks.

    Behind the scenes, this feature lives within Google Cloud Fraud Defense. When triggered, the process prompts the browser for camera permission and captures a brief moment of video. A machine-learning model then extracts detailed hand-landmark data—using the same sophisticated tracking technology that powers MediaPipe—to perform the verification.

    Google assures that this process is designed to be fleeting and private. The system deletes the footage immediately upon successful verification, records no audio, and ensures the video is never tied to a user’s identity or shared with third parties. However, even with these safeguards, introducing biometric hand scans into login flows raises complex questions about data collection and privacy boundaries.

    The real-world test, however, quickly exposed some theoretical vulnerabilities. Testers didn’t need to perform the delicate gesture; they simply fed a static stock photo of a hand through the OBS Virtual Camera. With minor adjustments, this static image successfully cleared the challenge. This demonstrated that while the system was technically sound in its design, it added friction for legitimate users without offering significant resistance against determined attackers.

    This outcome highlights the persistent struggle reCAPTCHA has faced. Researchers have previously reported that AI models and sophisticated agents have achieved a 100% success rate against older versions of the system, proving that simply relying on visual puzzles is no longer enough.

    The technological push for stronger verification is ongoing. In a related move aimed at preserving both security and privacy, Google, Cloudflare, Mozilla, and Microsoft recently collaborated on Private Access Control Tokens (PACT). This cryptographic scheme aims to replace traditional CAPTCHA challenges with proofs that verify legitimacy without exposing personal data.

    As the industry evolves, the focus is shifting toward solutions that are both effective against AI and respectful of user privacy. Whether the gesture-based checks graduate to general availability remains to be seen, but the underlying drive to secure the web in a trustworthy way continues to evolve rapidly.

    Credit: Tom’s Hardware