On: The No CAPTCHA problem

[homakov]

Using clickjacking we can get lots of valid tokens, no need to solve challenges.

[_cpancake → homakov]

You don't think Google will figure something out when a bunch of tokens from different IP addresses are all being used by one IP?

[homakov → _cpancake]

It can be helpful. There's (optional!) remoteip parameter server can use to send google IP address of current user. As in wordpress demo sometimes we can send requests with the browser.

[kuschku → homakov]

And additionally it’s easy to just create empty Google accounts and then use them with the bots. Just create a few dozen accounts, use them with a few hundred bots, and you easily get full verification.

[warkdarrior → _cpancake]

It it naive to think that attackers have only one IP at their disposal.