Is Buster: Captcha Solver for Humans safe?

Buster bundles Wit.ai API credentials encrypted with a key derived entirely from its own publicly distributed source files.

The extension fetches its own source files at runtime and uses their combined SHA256 hash as the AES decryption key for a bundled secrets.txt file containing Wit.ai API keys. Because the source files are distributed with every installation, any party can compute the decryption key and recover the credentials. These keys are used as Bearer tokens when sending audio to api.wit.ai for speech recognition to solve audio CAPTCHAs.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.