Live data from Hacker News

Yahoo CAPTCHA Cracked.

0x000000.com

1–10 of 31 posts

Re: Yahoo CAPTCHA Cracked.

#2
A long time ago I decided, that if I were to ever have a captcha system, it wouldn't use ones of that style, which are getting so.. randomized these days, it's hard for a human to read.

Frankly, I think knowledge or logic based captchas are the way to go.

"Todd is three times as old as Jane is. When Jane was ten years younger, Todd was five times as old as Jane is. How old is Todd?" for example.

Sure, takes longer to think about, but if someone can write a script to start parsing logic puzzles like that, quickly, and use it to defeat website signup authentication methods?

I'll buy that person a pint.

Re: Yahoo CAPTCHA Cracked.

#3
post #2

A long time ago I decided, that if I were to ever have a captcha system, it wouldn't use ones of that style, which are getting so.. randomized these days, it's hard for a human to read. Frankly, I think knowledge or logic based captchas are the way to go. "Todd is three times as old as Jane is. When Jane was ten years younger, Todd was five times as old as Jane is. How old is Todd?" for example. Sure, takes longer to…

If myspace used that system, they'd have about 99 million less users.

Re: Yahoo CAPTCHA Cracked.

#4
post #2

A long time ago I decided, that if I were to ever have a captcha system, it wouldn't use ones of that style, which are getting so.. randomized these days, it's hard for a human to read. Frankly, I think knowledge or logic based captchas are the way to go. "Todd is three times as old as Jane is. When Jane was ten years younger, Todd was five times as old as Jane is. How old is Todd?" for example. Sure, takes longer to…

You better have a really good porn site if you expect me to jump through that kind of holes to use it.

Oh and Todd is 60.

Re: Yahoo CAPTCHA Cracked.

#5
post #2

A long time ago I decided, that if I were to ever have a captcha system, it wouldn't use ones of that style, which are getting so.. randomized these days, it's hard for a human to read. Frankly, I think knowledge or logic based captchas are the way to go. "Todd is three times as old as Jane is. When Jane was ten years younger, Todd was five times as old as Jane is. How old is Todd?" for example. Sure, takes longer to…

I'd take you on that bet. Write the system and I'll write the solver. I drink Guinness :)

A better system would be to ask the user to identify the gender of a person based on an image to tell whether the picture is of a dog or of a cat and so on, these tasks are trivial for a person and very very hard for a program.

Re: Yahoo CAPTCHA Cracked.

#6
post #2

A long time ago I decided, that if I were to ever have a captcha system, it wouldn't use ones of that style, which are getting so.. randomized these days, it's hard for a human to read. Frankly, I think knowledge or logic based captchas are the way to go. "Todd is three times as old as Jane is. When Jane was ten years younger, Todd was five times as old as Jane is. How old is Todd?" for example. Sure, takes longer to…

Consider an image-based, interactive captcha using drag and drop.

Show a map with a bee on it. Please guide this bee to the flower, passing the pond, the bear, and the scarecrow. Now bring the bear to the beehive; you would generate a hash string based on the sequence of visits. This may involve multiple back-and-forths, which is probably bad, but fairly brainless and robust, from what it seems, as little thought as I have given it.

Re: Yahoo CAPTCHA Cracked.

#7
post #5
post #2

A long time ago I decided, that if I were to ever have a captcha system, it wouldn't use ones of that style, which are getting so.. randomized these days, it's hard for a human to read. Frankly, I think knowledge or logic based captchas are the way to go. "Todd is three times as old as Jane is. When Jane was ten years younger, Todd was five times as old as Jane is. How old is Todd?" for example. Sure, takes longer to…

I'd take you on that bet. Write the system and I'll write the solver. I drink Guinness :) A better system would be to ask the user to identify the gender of a person based on an image to tell whether the picture is of a dog or of a cat and so on, these tasks are trivial for a person and very very hard for a program.

My introduction to AI class required us to write a classifier for people in the news (20 different images of 10 different people). We were given the location of the people's faces, but we were able to get 60% accuracy using SVMs and the 32x32 block of pixels (nose, eyes, mouth region). This was the "baseline" system. Some systems were getting nearly 85+%. I must admit though, that this was a restricted dataset, but the faces were not all looking straight ahead the way eigenfaces are, and I'm sure with enough data, and enough features that sort of CAPTCHA could be defeated a large percentage of the time.

Re: Yahoo CAPTCHA Cracked.

#8
post #2

A long time ago I decided, that if I were to ever have a captcha system, it wouldn't use ones of that style, which are getting so.. randomized these days, it's hard for a human to read. Frankly, I think knowledge or logic based captchas are the way to go. "Todd is three times as old as Jane is. When Jane was ten years younger, Todd was five times as old as Jane is. How old is Todd?" for example. Sure, takes longer to…

The problem is that problems that are easy to generate with a computer are usually easy to solve with one. Even if you rotated through 100 different variations, solving 10 of those would give the spammer a 10% success rate. If it is just for one small site, no one is going to break it, but there are easier ways to prevent spam on small sites (comment spam bots don't understand JavaScript for instance - something that I take advantage of on my blog).

A system like that might be good for keeping commenter quality high though :).

Re: Yahoo CAPTCHA Cracked.

#9
post #7
post #5

Earlier quoted context omitted.

I'd take you on that bet. Write the system and I'll write the solver. I drink Guinness :) A better system would be to ask the user to identify the gender of a person based on an image to tell whether the picture is of a dog or of a cat and so on, these tasks are trivial for a person and very very hard for a program.

My introduction to AI class required us to write a classifier for people in the news (20 different images of 10 different people). We were given the location of the people's faces, but we were able to get 60% accuracy using SVMs and the 32x32 block of pixels (nose, eyes, mouth region). This was the "baseline" system. Some systems were getting nearly 85+%. I must admit though, that this was a restricted dataset, but t…

You are confusing two different tasks, identifying a person out of a small comparison group is relatively easy - just deconstruct the face & compare certain facial features. There was a ton of research on the subject and even some working commercial products (my schools AI lab uses one we built as a lock).

Identifying gender is significantly harder.

You want something a lot harder, have them click on the picture of the more attractive person, use data from a hotornot type site (just make sure the data isn't public). Good luck solving that with Support Vector Machines. If you want to generate more data just use build RE-CAPTCHA type system.

Re: Yahoo CAPTCHA Cracked.

#10
post #2

A long time ago I decided, that if I were to ever have a captcha system, it wouldn't use ones of that style, which are getting so.. randomized these days, it's hard for a human to read. Frankly, I think knowledge or logic based captchas are the way to go. "Todd is three times as old as Jane is. When Jane was ten years younger, Todd was five times as old as Jane is. How old is Todd?" for example. Sure, takes longer to…

Consider an image-based, interactive captcha using drag and drop. Show a map with a bee on it. Please guide this bee to the flower, passing the pond, the bear, and the scarecrow. Now bring the bear to the beehive; you would generate a hash string based on the sequence of visits. This may involve multiple back-and-forths, which is probably bad, but fairly brainless and robust, from what it seems, as little thought as…

And highly inaccessible.
Post reply on HN