If you’ve spent any time on the Internet, then you’re probably familiar with CAPTCHAs. Designed as an anti-spambot measure, it requires the user to prove they are human by performing specific tasks. Currently, one of the more common tests involves identifying objects in a set of images. Of course, as bots become more advanced, these systems must evolve. Google has been testing a new challenge for its reCAPTCHA system, which relies on hand gestures.

Officially dubbed “hand gesture verification”, it requires access to the user’s webcam so it can record clips of their hand. The user must then perform certain actions or gestures, such as a wave. According to Google, the system leverages a machine learning model to extract hand landmark data, which includes 21 hand-knuckle coordinates. This data is then used to determine whether the user is human. In theory, biometric identification should be a foolproof verification method.

In practice, it’s shaping up to be pretty unreliable so far. Early testers have already figured out a way to bypass the gesture-based checks by using stock images and the virtual camera function in OBS Studio. So, not only can users defeat the reCAPTCHA using a still image, but they can also do it without a physical webcam. What’s more, this method can probably be automated with a simple Python script.

With this in mind, Google’s hand gesture verification method is still in its infancy. The company will likely improve on the tech as more weaknesses are identified. That said, advanced AI can already solve existing systems, including the image recognition challenges. So, Google has its work cut out for it.

But even if hand gesture verification becomes an effective method, it’s not without problems. Privacy-conscious users may not want to provide camera access just to visit a website. Of course, Google claims that the recorded videos are only used for verification purposes and are deleted afterwards. It also declares that it does not associate these videos with the user’s identity, nor does it record audio. However, the average user has no way to prove these assertions, so they’re left with just taking the company’s word for it.

For what it’s worth, though, it seems that Google won’t be doing away with the regular tests. The company says it will “continue to provide visual and audio challenges, and develop more accessible and secure alternatives.”

(Source: Google, @Patrosi73 via X)

Updated 11:15 am, Mon, 6 July 26