Captcha situation ?!

[Stubbe-Unibet]

1 hour ago, z555 said:

First, let's have a moment to appreciate the surreal situation. Humans are now using automated batch scripts to avoid bot detection. 

On a more serious note, we could ask ourselves. Why?  Why is the captcha there in the first place?  It's placed after we type in the "password and user" but before we send that data to the server. 

In this spot, the captcha protects against two distinct threats,  Brute Force Attacks (BFAs) and Automated-Login-Threats (ALTs).

A Brute Force Attack is a hacker trying to guess your login and password. An Automated-Login-Threat is more related to people deploying poker bots or collusion software. 

Captcha has at least two mechanisms of protection delaying tactics and intelligence detection.  Delay tactics render brute force attacks impossible.  Intelligence detection mainly hampers ALTs. 

 

Captcha technology is useful in protecting client accounts and the poker environment. So why are we celebrating that Captcha can be circumvented with a single line in a .bat file? Don't get me wrong; solving a captcha before (re)entering the client is hugely annoying. And that's the reason why I stopped playing. 

But seeing a possible security vulnerability glorified as a workaround is mind-blowing. The workaround shows how easy it is, and was, to bypass Captcha challenges. Deleting one file is enough. I'm no expert in cybersecurity, but this looks clumsy. There may be deeper safety checks in the (login)-system; in that case, I'm worrying over nothing. 

You've misunderstood a few different things. Most importantly, deleting the cookie file doesn't disable the captcha solution; it just means it won't trigger when it shouldn't. It will still trigger when it's an actual bot.

[mafiaboyXXX]

clean the PC with CCleaner and reinstall unibet by deleting the history from the computer to get rid of cookies and errors...

[Stubbe-Unibet]

6 hours ago, mafiaboyXXX said:

clean the PC with CCleaner and reinstall unibet by deleting the history from the computer to get rid of cookies and errors...

That will not work.

The release yesterday had a temporary workaround, so you shouldn't se captchas on new client launch. Still working on a proper solution and you can of course still get the captcha if Google are giving you a low score regardless of this issue.

[z555]

6 hours ago, mafiaboyXXX said:

reinstall unibet by deleting the history from the computer 

Should I install a new future on the disk drive? 

In my opinion, 99% of all Cleaner programs are viruses. They work like this: 

A website will fake a virus using some harmless JS/HTML code. This might look scary, but it's confined to the browser sandbox. At this point, nothing is compromised, but it spooks the uninformed user to install a PC cleaner program. Cleaner programs are .exe files. These are installed outside the browser sandbox and have full access to all the computer resources.  

To be clear.

I don't fear for my computer's safety. Deleting that cookie from the poker client isn't harmful to my computer. However I still remain critical towards workaround. 
 

 

[z555]

1. A login can only be done through the poker client.
Encryption protocols are secret and safely tucked into the poker client. So all attacks have to happen through the client. This is good because the client is always between the attacker and the server. 

2. Every installed poker client should be uniquely identifiable.  
As any poker player has a unique login name, a poker client should have a unique client-id. This client-id is set during the first client-server interaction after installation. In principle, it is set once and remains the same forever. The server will request a new captcha token from Google to be used with this poker client. This means all login attempts from a poker-client are linked to a single captcha-token. This is the way it should be. 

3. The problem.
Deleting the cookie-file fools the client into thinking this is a new installation. It will contact the server claiming it is a new installation.  The server believes the client and grants a new poker-client-id every time. The server also requests a new captcha-token from Google. This means every login from the same poker-client uses a different captcha-token.  

 

@Stubbe-Unibet I don't know how to manage a large product like a poker site. It requires a lot of skills that I don't possess. However, my skills include SQL , C++ , and JS. It's hard to be sure who misunderstood who. 

 

[Stubbe-Unibet]

1 minute ago, z555 said:

1. A login can only be done through the poker client.
Encryption protocols are secret and safely tucked into the poker client. So all attacks have to happen through the client. This is good because the client is always between the attacker and the server. 

2. Every installed poker client should be uniquely identifiable.  
As any poker player has a unique login name, a poker client should have a unique client-id. This client-id is set during the first client-server interaction after installation. In principle, it is set once and remains the same forever. The server will request a new captcha token from Google to be used with this poker client. This means all login attempts from a poker-client are linked to a single captcha-token. This is the way it should be. 

3. The problem.
Deleting the cookie-file fools the client into thinking this is a new installation. It will contact the server claiming it is a new installation.  The server believes the client and grants a new poker-client-id every time. The server also requests a new captcha-token from Google. This means every login from the same poker-client uses a different captcha-token.  

 

@Stubbe-Unibet I don't know how to manage a large product like a poker site. It requires a lot of skills that I don't possess. However, my skills include SQL , C++ , and JS. It's hard to be sure who misunderstood who. 

 

Not sure how your post could be misunderstood:

"But seeing a possible security vulnerability glorified as a workaround is mind-blowing. The workaround shows how easy it is, and was, to bypass Captcha challenges. Deleting one file is enough."

I replied to the above. Again, it's not a security vulnerability. It's not bypassing the captcha solution

[z555]

Deleting one file fools the system enough to provide a new ID for captcha purposes. making cross-session evaluation impossible for the captcha. That seems like a bypass.

[Stubbe-Unibet]

17 minutes ago, z555 said:

Deleting one file fools the system enough to provide a new ID for captcha purposes. making cross-session evaluation impossible for the captcha. That seems like a bypass.

No, it's not a bypass that results in a potential security vulnerability. Let's leave it at that 🙂

[z555]

2 minutes ago, Stubbe-Unibet said:

No, it's not a bypass that results in a potential security vulnerability. Let's leave it at that 🙂

Yes, it's a bypass that almost certainly has no further significant security implications. 

[Stubbe-Unibet]

25 minutes ago, z555 said:

Yes, it's a bypass that almost certainly has no further significant security implications. 

No 😅  reCAPTCHA is not that basic and the cookie file for the client is not as critical is you seem to believe - there's a reason I suggested to delete this one initially.

Even if we said the cookie file is fundamental, it wouldn't be a bypass as no history is not exactly = high trust. Quite the contrary.

[eLPe21]

2 last logins no captcha ! 

ps. deleting the file did not work 4 me ! 

[mafiaboyXXX]

it works and I don't have any problems for 3 weeks, I kept choosing images...

[mafiaboyXXX]

On 4/19/2023 at 8:32 AM, z555 said:

Should I install a new future on the disk drive? 

In my opinion, 99% of all Cleaner programs are viruses. They work like this: 

A website will fake a virus using some harmless JS/HTML code. This might look scary, but it's confined to the browser sandbox. At this point, nothing is compromised, but it spooks the uninformed user to install a PC cleaner program. Cleaner programs are .exe files. These are installed outside the browser sandbox and have full access to all the computer resources.  

To be clear.

I don't fear for my computer's safety. Deleting that cookie from the poker client isn't harmful to my computer. However I still remain critical towards workaround. 
 

 

erasing the history is good and for trojans, viruses and worms I use SuperAntiSpyware...

[Hest]

i will end my ccount if this dont stop

 

[GothMoth]

No captchas since I tried UK instead of English(intl), now with English(intl) no captchas too.

It shouldn't work as a solution and is not an option for everyone.

 

I wonder why every time when I open the client the country/language screen is still present and if it's a common thing now and is there any option to simply skip it? I haven't deleted cookies or anything which might be related to it.

 

 

[SShcherbyna]

52 minutes ago, GothMoth said:

I wonder why every time when I open the client the country/language screen is still present and if it's a common thing now and is there any option to simply skip it? I haven't deleted cookies or anything which might be related to it.

This is for this reason:

And the choice of country should not affect the captcha, because it does not affect your IP and bot rating in the eyes of google. Probably just a coincidence. I also don't get a captcha every time and I can't find any pattern.

[Richarddddddd]

I also have this problem, after 10 x captcha I can't move on, it's annoying
im using the poker app (iOS)

[WaitButWhy]

Deleting the cookie file works for me most of the time, but not always. e.g today Captcha still appeared right after deleting cookies & launching client. I  don't mind solving a couple of puzzles , but more than 10 seems excessive. 

Really wanted to play on the site today as it was the last day I could clear a bonus. Oh well.  Please get this fixed asap,

[ValueHeavy]

25 minutes today, just getting worse and worse for me

[ValueHeavy]

For anyone that's also having this issue: I noticed I get in a lot more and faster if I complete the Captcha extremely slowly. Can anyone confirm this has the same effect for them?

Edited June 4, 2023 by ValueHeavy

[MarkinBristol]

My heart sinks every morning when I know that I have to sign on to Unibet to place bets and I'm confronted with the dreaded reCaptcha screens. The other day I counted 41 screens before I was allowed in (I did report it but had no reply). No other website I use has such a stringent sign on process - the only other one that even uses reCaptcha currently is Sky Sports that I can watch via my Virgin Media account, which presents 2 or 3 reCaptcha screens at most. I think I'm developing an aversion to fire hydrants, buses, bicycles, motorbikes, pedestrian crossings, stairs, traffic lights. taxis and even tractors. This is a relatively recent problem but given the number of adverse comments, isn't it time that Unibet resolved this issue?

[Stubbe-Unibet]

Issue has actually mostly been resolved already. We see around 50 logins a day, which get the captchas (was in the hundreds and even thousands before). Not sure why you'd have such a low rating but will look into it later today. 

[Stubbe-Unibet]

18 hours ago, MarkinBristol said:

My heart sinks every morning when I know that I have to sign on to Unibet to place bets and I'm confronted with the dreaded reCaptcha screens. The other day I counted 41 screens before I was allowed in (I did report it but had no reply). No other website I use has such a stringent sign on process - the only other one that even uses reCaptcha currently is Sky Sports that I can watch via my Virgin Media account, which presents 2 or 3 reCaptcha screens at most. I think I'm developing an aversion to fire hydrants, buses, bicycles, motorbikes, pedestrian crossings, stairs, traffic lights. taxis and even tractors. This is a relatively recent problem but given the number of adverse comments, isn't it time that Unibet resolved this issue?

@MarkinBristol Now I noticed you reference bets and can see you never had the issue in the poker client. There's no issue with captcha on the website, in the sense there's no known bug. 

Also had a look at the logs and can only see one login where captcha was triggered the last two weeks. Got the impression you're getting it more often?