Live data from Hacker News

I’m not a human: Breaking the Google reCAPTCHA [pdf]

blackhat.com

31–40 of 70 posts

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#31
"We ran our captcha-breaking system against 2,235 captchas, and obtained a 70.78% accuracy"

That's more impressive than it sounds. I'm pretty sure 70.78% is more accurate than I am with reCAPTCHA manually. A lot of the captcha's presented are very fuzzy, or have ambiguous questions, etc.

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#32

I have used services like 2captcha.com, to get solving costs down to $0.5-$1 per 1000 solved captchas. Googles reCAPTCHA is hardly an effective solution... Also if google wanted to they could just automatically verify people without you clicking that checkbox. Because at the end of the day they already know if they are going to auto-verify you, or make you pass a test.

Someone should really make a web browser plugin that automatically solves CloudFlare, Google and Facebook captchas for people using ::gasp:: VPNs. I would happily pay $1 for every 1000 captchas served at me to be solved for me, even if it took the page a bit longer to load for me still. As long as the latency wasn't too much higher than it'd take me to solve it myself.

Just like with DRM, captchas only seem to punish legitimate users and perhaps very small-time bad actors.

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#34
http://arxiv.org/abs/1602.02697

I don't work on reCAPTCHA but I imagine they could easily + significantly beef up image captcha by adding adversarial image examples that trip up would-be automators.

Note that adversarial examples generalize across models. Meaning a good adversarial example will work against SVMs, convnets, etc just the same.

If you're interested in the basics of how it works, Julia Evans has a great post: jvns.ca/blog/2015/12/24/how-to-trick-a-neural-network-into-thinking-a-panda-is-a-vulture

The key is that deep neural nets are actually very (piecewise) linear and that makes them susceptible to adversarial training.

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#35
post #28

Using the Google's own reverse image search to break an image-based captcha. Simple, but brutal.

Thought the same thing, that's ironic /and/ smart

Perhaps in response google could identify their own image they just served from recaptcha being google searched and throw the google image search into a captcha jail? .... if they have a large enough pool of images they are using, to be able to make that correlation, and if google search and recaptcha are capable of sharing that level of intimate detail ... probably a lot of problems with that tho.

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#36

I am the only one who thinks google reCAPTCHA is just a tool that Google uses to train Machine Learning Algorithms? First it was used to help Google learn how to Read, now its learning to detect object, landscapes, ...

The little captcha box does some processing before deciding what to show you. If you look suspicious, it can show you a more complex challenge. If you look like a normal browser, it might show you a house number to read (to improve its Maps product maybe). If you already have a cookie set because you already proved you're human, maybe it's just that check-box that says "I'm a human".

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#37

I am the only one who thinks google reCAPTCHA is just a tool that Google uses to train Machine Learning Algorithms? First it was used to help Google learn how to Read, now its learning to detect object, landscapes, ...

No, that's definitely what it is. It just also happens to be useful for blocking bots.

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#38

I am the only one who thinks google reCAPTCHA is just a tool that Google uses to train Machine Learning Algorithms? First it was used to help Google learn how to Read, now its learning to detect object, landscapes, ...

I'm pretty sure this is the advertised purpose of it. It stops bots AND helps machine learning.

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#39
post #16

I have a bad feeling CloudFlare is going to break the internet for Tor users with impossible-to-solve CAPTCHAs again after this...

Not that it can become much worse than it already is, though. The current reCAPTCHAS are already "fuck this shit"-inducing on Tor.

It very much can. Only a few months ago they were simply impossible. I tried to solve 30 of them while accessing a site and was still unable to. The current set are merely extremely annoying and time-consuming, but they can consistently be solved (at least by English speakers).

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#40
post #36

I am the only one who thinks google reCAPTCHA is just a tool that Google uses to train Machine Learning Algorithms? First it was used to help Google learn how to Read, now its learning to detect object, landscapes, ...

The little captcha box does some processing before deciding what to show you. If you look suspicious, it can show you a more complex challenge. If you look like a normal browser, it might show you a house number to read (to improve its Maps product maybe). If you already have a cookie set because you already proved you're human, maybe it's just that check-box that says "I'm a human".

Unless you're able to explicitly state how this is done and/or how to trick it in think you're "high risk" - then seems like speculation; yes, I'm aware Google's said this, but never seen an proof of it. I've found bug in the past in the system that were easy to fix, told Google, but the bugs never were fixed.
Post reply on HN