Live data from Hacker News

I’m not a human: Breaking the Google reCAPTCHA [pdf]

blackhat.com

41–50 of 70 posts

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#41
post #40
post #36

Earlier quoted context omitted.

The little captcha box does some processing before deciding what to show you. If you look suspicious, it can show you a more complex challenge. If you look like a normal browser, it might show you a house number to read (to improve its Maps product maybe). If you already have a cookie set because you already proved you're human, maybe it's just that check-box that says "I'm a human".

Unless you're able to explicitly state how this is done and/or how to trick it in think you're "high risk" - then seems like speculation; yes, I'm aware Google's said this, but never seen an proof of it. I've found bug in the past in the system that were easy to fix, told Google, but the bugs never were fixed.

Try doing a Google search from tor. The catches that tor users get are borderline impossible because of the suspicious ip and/or browser.

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#42
I worked on a little piece on recaptcha a while ago[0].

I'm glad to see research around how this captcha method is actually as breakable as any, but the real problem continues to be that there is no separation between the data Google collects for advertising, and the data Google collects from the captcha service.

Their privacy policy says they can link the captcha to your other online identity and use it to target you. It's especially cringeworthy to see lots of sites of dubious legality implement reCAPTCHA (like thepiratebay).

[0]: http://www.businessinsider.com/google-no-captcha-adtruth-pri...?

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#43
post #41
post #40

Earlier quoted context omitted.

Unless you're able to explicitly state how this is done and/or how to trick it in think you're "high risk" - then seems like speculation; yes, I'm aware Google's said this, but never seen an proof of it. I've found bug in the past in the system that were easy to fix, told Google, but the bugs never were fixed.

Try doing a Google search from tor. The catches that tor users get are borderline impossible because of the suspicious ip and/or browser.

Not impossible, very often I get the "Body of water" one, but I do seem to get a challenge every 10 minutes or so, in each new tab.

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#44
post #16

Earlier quoted context omitted.

Not that it can become much worse than it already is, though. The current reCAPTCHAS are already "fuck this shit"-inducing on Tor.

It very much can. Only a few months ago they were simply impossible. I tried to solve 30 of them while accessing a site and was still unable to. The current set are merely extremely annoying and time-consuming, but they can consistently be solved (at least by English speakers).

They can be consistently solved, the only problem is the endless repetition and "multiple answers needed" nonsense, which only seems to apply to Tor users.

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#45
post #31

"We ran our captcha-breaking system against 2,235 captchas, and obtained a 70.78% accuracy" That's more impressive than it sounds. I'm pretty sure 70.78% is more accurate than I am with reCAPTCHA manually. A lot of the captcha's presented are very fuzzy, or have ambiguous questions, etc.

Indeed. It's good that these guys are white-hats because they could have made a killing selling to spammers (for as long as they could go undetected, which could've been a while).

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#46
post #31

"We ran our captcha-breaking system against 2,235 captchas, and obtained a 70.78% accuracy" That's more impressive than it sounds. I'm pretty sure 70.78% is more accurate than I am with reCAPTCHA manually. A lot of the captcha's presented are very fuzzy, or have ambiguous questions, etc.

Indeed. It's good that these guys are white-hats because they could have made a killing selling to spammers (for as long as they could go undetected, which could've been a while).

"This work was supported by the NSF under grant CNS-13-18415"

I think that means you might be able to get source code via FOIA or similar :)

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#47

http://arxiv.org/abs/1602.02697 I don't work on reCAPTCHA but I imagine they could easily + significantly beef up image captcha by adding adversarial image examples that trip up would-be automators. Note that adversarial examples generalize across models. Meaning a good adversarial example will work against SVMs, convnets, etc just the same. If you're interested in the basics of how it works, Julia Evans has a great…

Or use those images: http://imgur.com/a/K4RWn :)

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#48

I am the only one who thinks google reCAPTCHA is just a tool that Google uses to train Machine Learning Algorithms? First it was used to help Google learn how to Read, now its learning to detect object, landscapes, ...

I'm pretty sure this is the advertised purpose of it. It stops bots AND helps machine learning.

*AND helps a company make profit by training their proprietary models.

If they were open, it would be a lot better (considering all the training is done by volunteers, too)

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#49
> Over the period of the following 6 months, text captchas appeared to be gradually “phased out”, with the image captcha now being the default type returned, as these captchas are harder for humans to solve despite being solvable by bots [3, 4].

This is so true. When I first go an image captcha, it took me 3 minutes to learn how to solve it. I had JavaScript disabled so I did not realize I had to do 3 pages to complete the challenge (after two, I reloaded and got a new route thanks to tor the page since I though i message up). Also I'm not sure what to click when there is a partial match, is that still a match? And don't even get me started with solving signs (in my first challenge I had to tell apart different kind of signs that were in the image). Is a no trespassing sign still a traffic sign? What about if it is a sign but I don't know which kind of sign (due to domain knowledge – especially when they're foreign signs). Another problem is that they require you to understand the language the challenge is in. You can still solve a text captcha if you don't speak any English.

I wish there was a way to force text captchas

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#50

I am the only one who thinks google reCAPTCHA is just a tool that Google uses to train Machine Learning Algorithms? First it was used to help Google learn how to Read, now its learning to detect object, landscapes, ...

I agree with you
Post reply on HN