InsideReCaptcha

Google has been doing this since forever for recaptcha. And, to be fair, it seems to be fairly effectively for bot detection. https://github.com/neuroradiology/InsideReCaptcha > bots seem to be going a very different route If the "very different route" means running a headless browser, then it's a success for this tech. Because the bot must run a blackbox JS now, and this gives people a whole new street of ways to run bot detection, using the bot's CPU.

VM-based architectures are really common in the obfuscation space, which is why you have executable packers[1], JS packers[2] and bot management products[3][4] leveraging similar techniques. As for why the obfuscation is needed: bot management products suffer from a fundamental weakness in that ultimately, all of them simply collect static data from the environment, therefore it would make much more sense to make the steps involved as difficult to reverse engineer as possible. Once that is done, all you need to do is slightly change the schematics of your script every few weeks and publish a new bundle, and you've got yourself a pretty unsubvertible* protection scheme. Regarding the "trojan horse", I think someone is yet to show proof that it's a Javascript exploit. (*Unsubvertible is obviously relative, but raising the cost the attack, f

While they likely wouldn't do a zero-day, their JS files, particularly for automated captchas, do push the boundaries of whatever JS engine they're executed inside. See https://github.com/neuroradiology/InsideReCaptcha#the-analys... and note that this analysis is 8 years old. While there's minimal risk if you're either using a full-fledged modern JS engine or a limited-subset interpreter like the OP, an older or non-optimized spec-compliant JS engine might hit pathological performance cases and result in you DOSing yourself.

The GP post's IP address or other fingerprint may be validated from other Google properties they might have visited, so I wouldn't put so much stock in the 0.7. Honestly... if it's the same team that did ReCaptcha 2.0, this is a team that pulls out all the stops. Per https://github.com/neuroradiology/InsideReCaptcha ... they implemented a freaking VM in Javascript to obfuscate the code that combines various signals. There's a lot going on here that's likely highly obfuscated and quantized before it's displayed to us. EDIT: non-paywall link for [1] in the parent post: https://outline.com/aA7HS5

The answer is not just fluff. It for example links to https://github.com/neuroradiology/InsideReCaptcha where you can read more.

One of the more interesting references linked here was https://github.com/neuroradiology/InsideReCaptcha — apparently the reCAPTCHA JavaScript snippet uses an encrypted bytecode format running on a custom-built VM, which one intrepid person has decompiled.

Actual info about the new ReCAPTCHA at https://github.com/neuroradiology/InsideReCaptcha (original discussion: https://news.ycombinator.com/item?id=8722846)