Anyone else annoyed with the grammar errors on the paper?
I’m not a human: Breaking the Google reCAPTCHA [pdf]
21–30 of 70 posts
Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]
#22Quite interesting how the authors even mention that this strategy is very economically viable. From the paper: 'Assuming a selling price of $2 per 1,000 solved captchas, our token harvesting attack could accrue $104 - $110 daily, per host (i.e., IP address). By leveraging proxy services and running multiple attacks in parallel, this amount could be significantly higher for a single machine.'
Makes me wonder if they got paid for reporting it to Google.
Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]
#23You could also just pay a service that uses human workers in third world counties. It's a little over a tenth of a cent per captcha.
Or you could set up a pr0n site that shows the material only after the user has completed the captcha. This trick has been done before.
I've never seen a documented case of such tricks actually being used, and I've seen calculations that suggest the cost/benefit outcome is no better than just paying the poor to do the menial work.
The last such analysis I paid attention to was some years ago so the situation may have changed, but I suspect the hassles of running a porn site and CAPCHA proxy still aren't worth it:
* obtaining content sufficient to attract interest
* paying for bandwidth & other resources)
* writing the authentication system
* then maintaining it (every time the CAPCHA service(s) change their process you potentially need to make and test changes to your code)
* and you need to work around rate limits (depending on the CAPCH design it may not be possible to make the relevant requests client-side so if the services has rate limits you'll have to route through something that sufficiently randomises your source address).
* providing support
* dealing with bad press
Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]
#24Earlier quoted context omitted.
Or you could set up a pr0n site that shows the material only after the user has completed the captcha. This trick has been done before.
I've never seen a documented case of such tricks actually being used, and I've seen calculations that suggest the cost/benefit outcome is no better than just paying the poor to do the menial work. The last such analysis I paid attention to was some years ago so the situation may have changed, but I suspect the hassles of running a porn site and CAPCHA proxy still aren't worth it: * obtaining content sufficient to att…
And also, if you got to the point where that porn site was then active and usable enough for the captcha cracking service... it would probably be more profitable just to monetise the porn.
Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]
#25I guess we're all waiting for browser extension to fill in captcha for us, which is sometimes hard to get right, great usability improvement.
Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]
#26I must admit that I have not been able to pass any of the text reCAPTCHA challenges lately when I have wanted to access the more sensitive content. Either I am getting them wrong or my submits get ignored.
Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]
#27I don't get why, when and how Google uses reCAPTCHA within their own tools. E.g. within the Webmaster Tools, I can submit up to 500 URLs for manual fetch/render and subsequent index submission. So the rate limit is already there and reasonable. However, after 4 submitted URLs, I get a reCAPTCHA. From then on for every URL, I have to complete it with additionaly visual quizzes.
Another way they get triggered is when people use browser/desktop based rank checkers. There are also plugins some SEOs use to pull lots of requests. These tools are quite old now and not very useful, but people still use them.
Google recently killed off its page rank toolbar - which most people in SEO used to measure their success with the sites they worked on.
Google has confirmed it is removing Toolbar PageRank: http://searchengineland.com/google-has-confirmed-they-are-re...
Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]
#28Using the Google's own reverse image search to break an image-based captcha. Simple, but brutal.
Thought the same thing, that's ironic /and/ smart
Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]
#29Anyone else annoyed with the grammar errors on the paper?
"We automately searches Google for certain terms, followes
links from the results, watches video on Youtube, searches on Google Maps, visites popular websites that contains
Google plus plugins and widgets."
It's like reading a security paper authored by Gollum.
Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]
#30I have used services like 2captcha.com, to get solving costs down to $0.5-$1 per 1000 solved captchas.
Googles reCAPTCHA is hardly an effective solution... Also if google wanted to they could just automatically verify people without you clicking that checkbox. Because at the end of the day they already know if they are going to auto-verify you, or make you pass a test.