Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I’m not a human: Breaking the Google reCAPTCHA [pdf]

blackhat.com

Post reply on HN
Print view View original

61–70 of 70 posts

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#61

Post by deelowe »

mehta wrote: post #57
kuschku wrote: post #55

Earlier quoted context omitted.

Well, I do the same. I won’t destroy any of their dataset, or even have a measurable impact – but in turn, I won’t have a measurable impact in positive direction either. If they want to make a profit from me, they should pay me, or they can license correct CAPTCHA results from me under GPL.

This argument doesn't really make sense to me. What browser, OS and device are you using to post this comment? Someone made profit when you bought the device, bought the OS and/or browser. A healthy system needs some kind of motivation. In economies, that is profits/money. What's wrong with that? (I know I am being simplistic here but...)

Napster, torrents, and the free internet warped an entire generation's perspective on things. This sort of "everything should be free" attitude isn't going away any time soon.

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#63

Post by bitskits »

deelowe wrote: post #54
kuschku wrote: post #48

Earlier quoted context omitted.

*AND helps a company make profit by training their proprietary models. If they were open, it would be a lot better (considering all the training is done by volunteers, too)

uhh. Everything they do is arguably for profit. That's why Google is an LLC. What do you expect them to do, put an "* this is done to earn us money" disclaimer on everything?

This is a little pedantic and doesn't change your point, but Google is not an LLC. It's a C Corporation.

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#64

Post by nv-vn »

sp332 wrote: post #36
kauegimenes wrote: post #33

I am the only one who thinks google reCAPTCHA is just a tool that Google uses to train Machine Learning Algorithms? First it was used to help Google learn how to Read, now its learning to detect object, landscapes, ...

The little captcha box does some processing before deciding what to show you. If you look suspicious, it can show you a more complex challenge. If you look like a normal browser, it might show you a house number to read (to improve its Maps product maybe). If you already have a cookie set because you already proved you're human, maybe it's just that check-box that says "I'm a human".

I can't find the original source, but the system for deciding whether to just show a check box or not was super complicated.Back around a year and a half ago when it was first released, some people on 4chan's technology board (/g/) were frustrated because they'd repeatedly be marked as suspicious (and never got the check box only) when posting on 4chan (which requires a captcha to be solved for each post). One user in particular was reverse engineering it and published a ton of super interesting stuff on Github (the levels of obfuscation were insane), but later got a job offer from Google (allegedly) in exchange for deleting it.

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#65

Post by Snowflame »

chippy wrote: post #59
kevincox wrote: post #38

Earlier quoted context omitted.

I'm pretty sure this is the advertised purpose of it. It stops bots AND helps machine learning.

The advertised purpose was to digitize the worlds books and help libraries, digital humanities and the world. This ended, and all trace of public good was erased (Check archive.org if you dont believe me) when Google execs mandated that only things that made money can be supported.

You do realize that it was the US court system that put the library-of-the-world version of Google Books on ice, correct? Larry & Sergey wanted a hippy "share all the books to everyone" view of this. The court said no, do what the book publishers say.

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#66

Post by greglindahl »

chippy wrote: post #59
kevincox wrote: post #38

Earlier quoted context omitted.

I'm pretty sure this is the advertised purpose of it. It stops bots AND helps machine learning.

The advertised purpose was to digitize the worlds books and help libraries, digital humanities and the world. This ended, and all trace of public good was erased (Check archive.org if you dont believe me) when Google execs mandated that only things that made money can be supported.

While you're mentioning the Internet Archive, you might also recall that our advertised purpose is to digitize all the world's knowledge :-)

I just had a chat with our book guy today about OCR corrections using captchas, one of our volunteers suggested it. We expect to scan 500,000-700,000 books this year.

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#67

Post by ant6n »

mehta wrote: post #57
kuschku wrote: post #55

Earlier quoted context omitted.

Well, I do the same. I won’t destroy any of their dataset, or even have a measurable impact – but in turn, I won’t have a measurable impact in positive direction either. If they want to make a profit from me, they should pay me, or they can license correct CAPTCHA results from me under GPL.

This argument doesn't really make sense to me. What browser, OS and device are you using to post this comment? Someone made profit when you bought the device, bought the OS and/or browser. A healthy system needs some kind of motivation. In economies, that is profits/money. What's wrong with that? (I know I am being simplistic here but...)

The devices that I buy generally don't ask me to do work for them. If they do, for example by spying on my behavior, then I'm not so happy. On the other hand, I may accept some spying/doing work for companies if I get something in return - which happens for some Google products, like search.

When doing a captcha, I don't really get anything. It's something I have to do because the website I'm using has the problem that they can't find a better way to identify bots. So I do a captcha, fine. But, if there's benefits for whatever company offers them, i.e. I'm doing work for them without getting anything in return, or without everybody getting anything in return (the GPL option), then I'm again not so happy.

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#68

Post by kuschku »

mehta wrote: post #57
kuschku wrote: post #55

Earlier quoted context omitted.

Well, I do the same. I won’t destroy any of their dataset, or even have a measurable impact – but in turn, I won’t have a measurable impact in positive direction either. If they want to make a profit from me, they should pay me, or they can license correct CAPTCHA results from me under GPL.

This argument doesn't really make sense to me. What browser, OS and device are you using to post this comment? Someone made profit when you bought the device, bought the OS and/or browser. A healthy system needs some kind of motivation. In economies, that is profits/money. What's wrong with that? (I know I am being simplistic here but...)

> A healthy system needs some kind of motivation. In economies, that is profits/money. What's wrong with that? (I know I am being simplistic here but...)

Simple.

I buy a thing, I get something – in that moment the contract is over.

VW doesn’t come to me every 3 days with "You bought a car, to continue using it, take this and drive to Hanover and deliver it there".

When I bought my computer, or its parts, I bought them, I put them together, and that’s it. The manufacturer has never asked me to do work for them, or pay for them again.

I use ARCH Linux and Firefox – projects done by volunteers, and they profit by having a better product for themselves and others.

Google profits from ads, and from selling data. That’s a tradeoff, and a reason for me to try to use as few Google products as possible.

But when government organizations use ReCaptcha, and I have to work without pay for Google, then I have no choice, and it is not something I agree with.

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#69

Post by totony »

etrain wrote: post #52
gboudrias wrote: post #45

Earlier quoted context omitted.

Indeed. It's good that these guys are white-hats because they could have made a killing selling to spammers (for as long as they could go undetected, which could've been a while).

Going rate for humans breaking captchas is like $1/1000 captchas solved. A fully automated service could make some money, sure, but not exactly a killing .

From paper, "Assuming a selling price of $2 per 1,000 solved captchas, our token harvesting attack could accrue $104 - $110 daily, per host (i.e., IP address). By leveraging proxy services and running multiple attacks in parallel, this amount could be significantly higher for a single machine."

Re: I’m not a human: Breaking the Google reCAPTCHA [pdf]

#70

Post by jamessb »

dspillett wrote: post #23
amelius wrote: post #17

Earlier quoted context omitted.

Or you could set up a pr0n site that shows the material only after the user has completed the captcha. This trick has been done before.

I've never seen a documented case of such tricks actually being used, and I've seen calculations that suggest the cost/benefit outcome is no better than just paying the poor to do the menial work. The last such analysis I paid attention to was some years ago so the situation may have changed, but I suspect the hassles of running a porn site and CAPCHA proxy still aren't worth it: * obtaining content sufficient to att…

The closest thing to a documented case I've seen is a report of people gaming the Time Person of the Year poll so that the top person was moot, and the first letters of the candidates spelt out "Marblecake. Also the game.":

By understanding how reCAPTCHA worked – the team was able to double their productivity (since they usually only had to enter one word instead of two). To further optimize their voting they created a poll front-end that allowed you to enter votes quickly while giving you an update of the poll status (and since it is a 4chan kind of crowd, they also provided the option to stream some porn just to keep you company while you are subverting one of the largest media companies in the world.

https://musicmachinery.com/2009/04/27/moot-wins-time-inc-los...

However, this is slightly different as people were deliberately solving CAPTCHAs (and watching porn) rather than wanting to watch porn and also incidentally solving CAPTCHAs that they had no direct interest in.

Post reply on HN