The bottom line: Google introduces biometric camera authentication in reCAPTCHA that analyzes hand gestures, but has already been bypassed through AI-generated animations.
Google is testing a new reCAPTCHA system that requires users to perform a hand movement in front of the camera. The procedure analyzes 21 finger knuckle coordinates to distinguish from bots – but encounters privacy concerns and questions about actual effectiveness.
Google has introduced a new verification method for its reCAPTCHA system that prompts users to grant camera access and perform a simple hand gesture. The system captures a brief video of the hand, automatically extracts 21 finger knuckle coordinates as recognition features, and deletes the video sequence immediately after verification is complete. According to Google Cloud documentation, the procedure is intended to improve liveness detection and block automated account creation and credential-stuffing attacks. For users with disabilities, visual and audio alternatives remain available.
Google assures in its regulatory product guidelines that video recordings are never linked to the user’s identity and no audio recordings take place. Data is used exclusively for the current verification process and is not stored or shared with third parties. For CISOs, this means: The rollout creates new attack surface areas through camera usage, while Google emphasizes data minimization.
Practical testing, however, indicates effectiveness gaps. Security concerns manifest on two levels: On one hand, users criticize the expansion of biometric data collection for everyday authentication. On the other hand, security researchers have already demonstrated successful bypasses using virtual camera drivers and AI-generated hand animations – which raises questions about the effectiveness of the approach against modern automated attack tools.
Source: www.it-daily.net · Published June 20, 2026
Lumi AI News — AI-assisted curation in accordance with Art. 50 EU AI Act. Paraphrase and classification through Lumi News Pipeline v1.7.1.