challenge-bypass-extension
challenge-bypass-extension copied to clipboard
privacypass
restore hCaptcha compatibility
This PR restores full hCaptcha compatibility.
Maintainers: please notify [email protected] well in advance of shipping breaking changes to hCaptcha support. This will let us schedule work to validate and PR any changes required.
We have historically linked hCaptcha users to the extension published out of this repo, but if maintaining compatibility with non-Cloudflare endpoints is not a priority then it may make more sense to publish our fork separately to avoid similar issues going forward.
Let us know your thoughts on this.
Hi @fedecarpy, apologies for the delay on this. We intend to land this and will work with you on getting it merged in the next week or so.
First starters, we have some questions about maintenance, and it would be great to confirm that you actually work for hCaptcha :) Would you mind reach out at https://research.cloudflare.com/contact/?
@fedecarpy apologies for the delay. I'll add some more details on next week.
Hi @fedecarpy , I noticed that hCaptcha allows to spend one token, but in the second try, it consumes the token but do not bypass the captcha (the puzzle images are prompted to the user). See the image:
Steps to reproduce:
- Get 5 tokens from https://www.hcaptcha.com/privacy-pass.
- Go to https://accounts.hcaptcha.com/demo, in the first try, the token is consumed and no images. Good!
- Refresh the page.
- Check the mark of captcha, now, the token is consumed and sent without error, but the images still appear. :(
I observed the same behaviour by solving this demo: https://2captcha.com/demo/hcaptcha
Hi @fedecarpy , I noticed that hCaptcha allows to spend one token, but in the second try, it consumes the token but do not bypass the captcha (the puzzle images are prompted to the user).
Hi @armfazh.
This is the expected behavior. The existence of a Privacy Pass token is only one of many variables that decide whether a challenge is shown. Rapid repeated redemptions make it less likely that a session will bypass the challenge.
Hi @fedecarpy , I noticed that hCaptcha allows to spend one token, but in the second try, it consumes the token but do not bypass the captcha (the puzzle images are prompted to the user).
This is the expected behavior. The existence of a Privacy Pass token is only one of many variables that decide whether a challenge is shown. Rapid repeated redemptions make it less likely that a session will bypass the challenge.
Ok, then we might add somewhere in the documentation that the captcha might still showing the puzzle even though the extension provides a valid token. Tracked in #348