Captcha.nsa.gov

Re:Captcha.nsa.gov by fredley on Monday February 03, 2020 @12:42PM (#22226644)

Can someone explain what's going on? Is this a domain hack to get Google's captcha working under an nsa.gov hostname, presumably so that it's usable on whitelist firewalls? I'm surprised Google serves a homepage to the domain, and that it doesn't only respond to requests to google.com (etc.)

[ Parent | on HN ]

Re:Captcha.nsa.gov by cm2187 on Monday February 03, 2020 @02:31PM (#22228000)

If the NSA rids the web of google captchas, it will have fully deserved its budget and all past mistakes will be forgiven!

[ Parent | on HN ]

Re:Captcha.nsa.gov by dessant on Monday February 03, 2020 @02:54PM (#22228243)

Until then, you can use my browser extension to solve them: https://github.com/dessant/buster

[ Parent | on HN ]

Re:Captcha.nsa.gov by morrbo on Monday February 03, 2020 @02:57PM (#22228279)

Huge fan of your work. Use it daily with no problems. Just wanted to say, from the bottom of my heart, thanks.

[ Parent | on HN ]

Re:Captcha.nsa.gov by dessant on Monday February 03, 2020 @03:02PM (#22228338)

You're sweet, thanks a lot!

[ Parent | on HN ]

Re:Captcha.nsa.gov by matheusmoreira on Monday February 03, 2020 @08:38PM (#22231485)

Thank you so much for creating this.

[ Parent | on HN ]

Re:Captcha.nsa.gov by dredmorbius on Monday February 03, 2020 @09:44PM (#22231862)

https://mastodon.cloud/@dredmorbius/102054627041751386

This is working far faster now than when first posted.

[ Parent | on HN ]

Re:Captcha.nsa.gov by captainmuon on Monday February 03, 2020 @12:56PM (#22226846)

My guess: a custom version of Google that allows NSA analysts to do "Google dorking" - searching for vulnerable hosts with Google - without triggering a captcha. Somebody on twitter mentioned they could not get a captcha with strings that usually reliably cause one.

Maybe this is just a fake front page that calls to the Google search API and pretends to be Google proper. Either it is for agents in the field to inconspicuously use google or they misconfigured it to be public?

[ Parent | on HN ]

Re:Captcha.nsa.gov by FDSGSG on Monday February 03, 2020 @12:57PM (#22226873)

Your guess is wrong. This isn't a custom version of google. It's just a regular akamai reverse proxy setup.

> Either it is for agents in the field to inconspicuously use google

By visiting a nsa.gov subdomain served by akamai? Yeah right. I feel like heading to www.google.com would be far less conspicuous.

[ Parent | on HN ]

Re:Captcha.nsa.gov by captainmuon on Monday February 03, 2020 @01:02PM (#22226945)

You can do that? I would expect Google to flag connections to the search page that don't terminate on a residential/commercial IP as suspicious and show you the near "unsolvable" captcha.

At least that is my experience with proxying google services (e.g. silly setup for accessing them from China). Datacenter IPs or SSL "MitM" connections reliably trigger it.

[ Parent | on HN ]

Re:Captcha.nsa.gov by penagwin on Monday February 03, 2020 @01:59PM (#22227615)

Anecdotal, and I'm guessing it's because I was logged in (to my long standing personal Google account) - but I didn't have any issues when I was VPN'd through a Vultr vps of mine when I was in my dorm.

Again I'm guessing it's because I was logged in, from google chrome.

[ Parent | on HN ]

Re:Captcha.nsa.gov by FDSGSG on Monday February 03, 2020 @01:04PM (#22226974)

Depends very much on which datacenter you're using. I'd imagine google doesn't get much (any) bot traffic from Akamai, so I'm not surprised that their ranges aren't flagged yet.

[ Parent | on HN ]

Re:Captcha.nsa.gov by jjeaff on Monday February 03, 2020 @01:43PM (#22227425)

But all it takes is a few dozen queries in fast succession and google will start showing a captcha. At least, that is how it seemed to be a few years ago.

[ Parent | on HN ]

Re:Captcha.nsa.gov by ryanlol on Monday February 03, 2020 @03:13PM (#22228462)

Akamai rotates their source IPs a lot so you wouldn’t get a captcha very fast.

[ Parent | on HN ]

Re:Captcha.nsa.gov by tempestn on Monday February 03, 2020 @01:45PM (#22227459)

I wonder how many people are currently submitting queries via that page...

[ Parent | on HN ]

Re:Captcha.nsa.gov by VectorLock on Monday February 03, 2020 @01:27PM (#22227262)

I'd love to know what the distribution of tries on the "unsolvable" captcha is when served to real people operating in good faith.

[ Parent | on HN ]

Re:Captcha.nsa.gov by njetten on Monday February 03, 2020 @12:45PM (#22226688)

Seems to be on purpose, unless someone really misconfigured their Akamai setup. Your purpose sounds viable

[ Parent | on HN ]

Re:Captcha.nsa.gov by ryanlol on Monday February 03, 2020 @12:51PM (#22226777)

>I'm surprised Google serves a homepage to the domain

Google doesn’t, the reverse proxy just rewrites the Host header.

[ Parent | on HN ]

Re:Captcha.nsa.gov by bndw on Monday February 03, 2020 @12:47PM (#22226721)

Is this more than a reverse proxy to google.com? Seems like the real question is _why_.

[ Parent | on HN ]