Will Upwork implement CAPTCHA before submitting a proposal?

[e1281dd0]

400 Connects Bidding Auction.

 I've been actively using the platform both as a freelancer and a client, and I agree with those who express frustration about the current challenges in getting jobs on the plataform.

Interested in a quick experiment? Create a client's account, set up a job opening with attractive budget and a common subject. In less than a minute, you'll receive 5 to 9 proposals with 50 connects each. It's funny how it's consistently 50 connections, there's neve a 51 or more.

For those unfamiliar with the platform, Upwork doesn't apply a limit for bids. I've seen some jobs getting 4 boosted proposals using 400 connects each. Ouch!

Now, I'm bringing attention to this matter in the hope that it gains traction. As a Software Developer, I comprehend the process of integrating new features into a website from a large company like Upwork. It's not a straightforward process, and I acknowledge that the developers aren't the ones to blame. But from my perspective, implementing a CAPTCHA system to confirm that the freelancer is human at the moment of submitting a proposal could be a useful practice to filter out these bot-generated proposals. It's not a complex system to implement, and when applied correctly, it proves challenging for bots to bypass. In terms of user interactions, it doesn't create a barrier discouraging people from applying for job openings.

While additional features would certainly be beneficial, introducing this one could effectively significantly reduce bot activity on the platform, in my point of view. (Unless Upwork get benefits from these bots that spend money to buy connections and automate the applying process, do I see a consiparcy being created here? Maybe I shouldn't talk to much about this subject...) 🤐

Anyway, I'm sharing these experiences within the Software Development job niche. I'm uncertain if people in other fields, such as translators or video editors, share the same sentiments. However, I'm confident that various areas on the platform face similar issues where simple bots using AI models can apply to numerous jobs with seemingly authentic proposal letters.

A light in the end of the tunnel, of course that you shouldn't be intimidated by high bids before applying to a job, serious clients with time some time on the plataform they want to hire freelancer that have the technical skills and proven work, not people that bid high. I believe that there are lots of serious clients who just don't look at the first 5 proposals for a job opening, especially when they look like they were made by AI (if you've posted a few job openings, you will easily spot an AI proposal and a genuine one).

If you've read this far, leave your thoughts in the comments. I'm very curious to see what other people think. And if a dev of the plataform is reading this, feel comfortable to share your ideas too.

Thank you all for reading this post!

[crart]

As long as Upwork is profiting from bots "activity" there is no incentive to combat this issue, it was discussed widely on the forum.

Regarding captcha - for the love of whatever god whoever believes in, no. I am sick and tired of machines asking me to prove I am not machine everywhere. There must be humane way to weed off scammers, bots and straight frauds, sadly, as in my first sentence, not gonna happen as long as platform benefits from this. Also it requires some form of predictive thinking and this is huge failure on UW's side.

[e1281dd0]

Thanks for replying, Olga. I think it's always great to talk about this subject, and I agree with you. As long as these bots generate profit for the platform, it makes it hard to believe that something is going to be done.

About the CAPTCHA, I agree that sometimes it can be annoying, but at least in my head, it sounds like an easy and very effective way to combat those bots. Bypassing it is not something easy, though it's not impossible.

[the-right-writer]

I see no evidence management is bothered by anything happening here. In fact, they are thrilled with the numbers. And you are correct, they are not going to let go of the connects, especially since so many freelancers obediently do what Upwork tells them to do, and throw connects at jobs they will never have.

CAPTCHA isn't needed. A basic Boolean in the jobs feed would eliminate 99% of the scams. The only thing being done, is trying to turn freelancers into employees chained to their device, constantly refreshing and applying for any job, and throw, throw, throw, those connects, because Upwork tells you to.

[yofazza]

Bots with 400 connects each. Now I think it's gamed (again).

[rekasesh]

I wonder if there is some kind of secret leaderboard for these bots? 

[wlyonsatl]

I despise Captcha, though it has improved in the last few years. But if there is a problem that Captcha can solve, it's better than no solution at all. If Captcha would significantly reduce Upwork's newfound large connects income, though, I don't know that we should expect it will be implemented for this purpose.

But why would someone have such a "bot" submit multiple excessively boosted connects totaling 1,600 (4 x 400), which amounts to $240 (1,600 x $0.15) when it appears that Upwork's own data shows that boosting proposals on average has only a very modest effect on any particular boosted proposal being a new project's winning proposal:

Is it really worth to boost every proposal? - Upwork Community

I have no doubt that some clients, especially on low value, low skill projects, might just not look past the boosted proposals on their new projects, but I do not doubt that 1) high value, high skill projects are usually posted by smart clients who wouldn't hire anyone in the real world just because those anyones were desperate for a job, any job at all and b) most low skill, low value stocks are worth spending $240 bidding on.

[yofazza]

why would someone have such a "bot" submit five excessive boosted connects totaling 1,600 (4 x 400)

The 50 connects consecutive bids was weird, then we know some people created not-too-complex bots just to automate sign-up and bid with the free connects.

Now we see the same weird thing. Consecutive 400 connects. It really doesn't make sense to me if those aren't automated, or if they pay for those connects, but I (currently) have no idea how they get it. Or is the screenshot faked? @Felipe is that yours or you get it from somewhere else?

I was right when I decided not to join the connects game. At least from my side I'm afraid I'll get emotionally-caught in the "betting" game and/or I spend real money against people who game the system.

[e1281dd0]

No, the 400 connects bids image isn't fake. It was just to demonstrate the fact that you can bid way past 50 connects. But despite this, most bids in a job on the first 2 minutes always go with 50 connects, probably because they're bot accounts using free connections so they can't go higher.

[gavintfn]

per:
https://support.upwork.com/hc/en-us/articles/211062898
You’ll receive free Connects (the number can vary) when you win an interview with an established client on Upwork. (To prevent gaming, we aren’t sharing all the details of what we consider “established.” In general, it’s a client who has hired and spent on Upwork in the past.)

thats 1 reason why people buy inactive/old client accounts, post fictitious jobs, and interview/hire their multiple (most likely purchased) freelancer accounts

[crart]

I never received free connects for winning the interview.

[gavintfn]

Captchas can be programtically passed with deathbycaptcha
No Joke.... (feel free to google)
deathbycaptcha.com offers an api service that solves captchas.  Executed code copies the captcha image/s and sends the image and requirements to a pool for human processing.  A human, that is tightly packed in a tiny box along with other humans, located ieastern europe/asia, views the image and replies wth the solution. The code then polls for the response and either submits the letters as the response or emulates clicks on the xy coordinates of the correct solution images.   

The current fee for usage is
              <$2.00 for 1,000 solved captchas, 
              $3.99 for 1k solved hCaptchas,

               $2.99 for 1k solved ReCaptchas
The current solution times are:
             1 second for captchas
             41 seconds for ReCaptchas

              17 seconds for hCaptcha

I've been tasked with vulnerabillity/exploit testing and prevention for this in the past, and as such have used the service. When scraping and bot activity is running headless (without a UI like a browser) it is undetectable.

That said, captchas wont prevent any decent coder from doing anything they are doing now.  400 connects costs more than solving 1k of the hardest captchas, so....won't make a difference.

[6bfcdaf8]

I believe upwork introduced cloudflare protection which should be really advanced. Is there some proof that application process can actually be automated? I thought you cant beat cloudflare

[yofazza]

I thought Cloudfare is more focused on DDoS' and the likes where it (and anyone with the willingness and resource) can find some pattern on compromised PCs/server apps, the IP networks, and apply some smart blockings. It could stop "popular" spam crawlers with known pattern as well this way, but it should not stop legitimate bots, newly created/specific bots, run on legitimate networks. 

I only read about the Upwork bots so I just got curious and try to create a new sign up and it's almost true. The sign-up process is extremely simple, no vetting it only ask questions to understand the niche and fill the profile, no captchas.

The only thing that different is the free connects, they are only 40, not 50. Maybe they changed it recently, or there's something else to do to get the additional 10 (or to multiply it by 10 so they get 400 now -_-).

New signups can immediately bid on jobs. Yes it can be automated, definitely. I've seen many automated things much harder than this. Cloudflare as I wrote is not a problem.

[gavintfn]

ANYTHING can be automated with node and selenium.  Selenium can run headless or UI mode on Windows and or Linux UI's like XFCE . Not only can it field reponses sent to chrome and firefox via webdriver, but can literally be scripted to perform any action that can be perfomed in chrome or friefox browser and detected by JS.  Even to the degree of of moving a mouse pointer, with easing, randomized acceleration/deceleration changes, and randomized deviations from linear graph paths to emulate a human manually clicking "I'm human"  radio boxes, in browser tabs, which is as extreme as it gets for bot detection.  The active/focused browser window eliminates the need for programatically solving for JS generated dependancies and local storage keys need to be passed with the request.

Granted, this does require a dedicated UI to perform these functionalities. So if you don't have 10 old pc's laying around your hut in Uganda, you can always hit the local internet cafe, and spin up remote windows/linux desktops on linode for $5/month on net30 billing.  So in total..... 10 dedicated ip vpss with ubuntu desktop, and solving 1k Hcaptchas for $53.99.  As you only have to pay for the captcha solving upfront, you can start your upwork botting empire for $3.99+internet cafe hourly rates, and have the whole month to bot the crap out of upwork.  If the bots are resulting in more of a profit than $53.99 per month, I would doubt they would still be around.

heres a git repo cloudflare bypass ready, using selenium
https://github.com/ultrafunkamsterdam/undetected-chromedriver
with 7k stars and 947 forks... id say its legit.

Alper, your a dev right?  you should know this stuff....  : )

Feel free let me know if your stumped on any other basic scraping/browser automation problems.

[6bfcdaf8]

I am indeed, a very talented one! And when you are so, you have the choice to keep yourself away from unethical work and focus on clients who has legitimate businesses and help them grow. 

[498c3842]

I'm also seeing bot proposals every day in my sector. Even 2/3 months ago, I didn't see this situation. Now for every job post, people are submitting within 1/2 minutes of the job post. There are multiple proposals with the same 50 connects and the same submitting time.

I've contacted the support team they just informed me that the proposal may be the agency members and setting this as a game.


I think it is high time to set CAPTCHA.

[spectralua]

So bots wellcomed with 400 connects now instead of 50?