Automatically Registering A Gmail Account
 

Hey guys, I'm having trouble making a script of mine automatically register for an account on Gmail.

Don't worry, my intentions aren't evil. :$

The URL is here: https://www.google.com/accounts/CreateAccount

I just need someone to help me confirm that my header and post data is correct... I've poured over it for hours upon hours, and am unable to find out why it's not working.

Relative Pretext:
- One may successfully register for an account on Gmail with javascript disabled
- One may successfully register for an account on Gmail with cookies disabled
- urllib2 automatically handles HTTPS

What Happens:
- I get the registration form thrown back at me asking me to re-enter the captcha, because I entered it incorrectly.

Problem:
- The captcha entered was the correct captcha's value from the registration form's captcha <img> tag.

Here is the debug information provided by urllib2. This shows the URL that was accessed, the exact raw data that was sent over the socket, and the response headers.


The HTML of the reply:
- It is the registration form again
- It has all of the correct data (IE 'tim.oreily@gmail.com') entered into the fields already
- It is missing the fields for the password and captcha
- It says the captcha was incorrectly entered, and the password should be re-entered.

The contradiction:
- The "newaccounttoken" variable in the POST data is "gmaZxhjXZAoRl1UaJ3ofVf4e9JxsCYqvzfoOD6UCnRT0Yrby8vK0B0PbbN9VlTsV%3AYkbaUYhrKp5gvXrBOucOuw"
- This token represents the URL: https://www.google.com/accounts/Capt...Kp5gvXrBOucOuw
- At the time of registering, this was the URL used by the captcha's <img> tag
- This captcha, after visiting the registration form, was visited and confirmed by me to say "wudec"
- The value "wudec" is consistent with the POST variable "newaccountcaptcha" in my request

Furthermore:
- I know the "newaccountcaptcha" variable was sent intact, because the reply I got contained new HTML that was not there before:

Could someone confirm that I'm sending this data correctly? Double check my logic? Maybe I don't know the HTTP as well as I should for this.

Thanks in advance for your time reading this long post. :S

Re: Automatically Registering A Gmail Account
 

A kitten dies every time somebody tries to automate a site registration. :( ;)

Re: Automatically Registering A Gmail Account
 

Well, gmail is making it very difficult to keep any-o'-those kittens alive then. :icon_wink:

Re: Automatically Registering A Gmail Account
 

The reason your script isn't working is probably that your script is assuming the server has fixed behaviour but the server is keeping track of state and has some elements of dynamic behaviour, so it recognises that the data you are sending is spoofed or hacked (i.e. it is not actually being typed in by a user) regardless of how you modify your headers.

That is actually the purpose of schemes, such as the one you're trying to bypass. Automated registration is the one of the first goals of spammers.

Re: Automatically Registering A Gmail Account
 

Grumpy, I was thinking that too originally. But figured out that's not the case.

When my script downloads the first registration form, I saved that to a file. I opened that file locally, entered all of the information in manually, clicked submit, and the account was created.

Also, all of the post data I'm sending is parsed dynamically from the registration form. So that aspect of dynamic behaviour has its solution.

The reason I can't just capture that network packet and compare it to my urllib debug information is because that's sent https. Maybe I should look into how to decode an https packet.

Re: Automatically Registering A Gmail Account
 

The engineers at Google have done everything possible to prevent automated Gmail registrations. The engineers at Google are very, very smart. It is therefore highly unlikely that you will find a way to successfully automate Gmail registrations.

Re: Automatically Registering A Gmail Account
 

I don't like this thread. It's very marginal when it comes up against the rules regarding discussions of "hacking". While it isn't concerned with actual hacking, it is an attempt to bypass protections put in place by the target.

I'm not going to issue an infraction, but I'm going to close this thread to further discussion. Feel free to appeal my unilateral decision.