Just ran through their job site sign up. Didn’t encounter a captcha or email verification to get to a job application form.

I did encounter a password field bad enough that password management software generated passwords aren’t allowed but “Password12345” is.

I can believe the developer found the job application form didn't have a CAPTCHA or IP rate limit at the time.

Presumably it will soon gain one, if it hasn't already.

People usually use human powered CAPTCHA solving services nowadays

Apparently I'm barely human enough to get through those Captchas.

Exactly, deathbycaptcha is one I’ve seen in action more than 5 years ago. This stuff has been human powered for way longer than that.

how does this work? do they capture the screen and forward the captcha to some service in India?

Here's an example of a captcha-solving API: https://anti-captcha.com/apidoc/methods/createTask

They have a browser extension too, I guess it detects the displayed captcha and submits it to the API

Wow, just wow. This is amazing.

Gotta love adversarial interoperability, productionized

I once heard someone (perhaps jokingly) suggest forwarding the captchas to users of some website you control - e.g. a free porn website where you have to solve a captcha every 10 images.

Recaptchas yield a code when completed succesfully, which can be transfered to a different machine to instantly solve it i think.

Finally repercussions for the sites not updating their recaptcha versions and annoying everyone with v2

"reCAPTCHA v3" despite its name is not a captcha though, it's just a very bad risk-scoring service. Bad because (1) it flags plenty of legit visitors as spammy, in a way that's probably a slamdunk GDPR lawsuit waiting to happen, and (2) apparently the returned token is still replayable - Anti Captcha claims to support v3, you can even select what score you want to have (>= 0.3/0.7/0.9) lol

for recaptcha it's even simpler. Because of how it's implemented, all you have to do is send the captcha solving service the site key, and it returns a solved token.

They're using SAP SuccessFactors saas. I'm not sure about the features that platform has, but other easy ways to block the spam would be email verification, shadowban with silent captcha, or turning up cloudflare anti-bot to maximum.

You can solve 1k captchas for $1 at 80% success, they're trivial to bypass