Live data from Hacker News

Goodbye (Crummy) CAPTCHAs. Hello Ad Dollars?

mediamemo.allthingsd.com

61–70 of 81 posts

Re: Goodbye (Crummy) CAPTCHAs. Hello Ad Dollars?

#61
post #17
post #3

So you replace the hard to read CAPTCHAs with easy to read ads. Of which presumably there will be a limited number in circulation at any one time. Sounds kinda easy to circumvent...

You know, most modern capchas are not solved by bots, but by people in third world countries solving them for pennies. The current going rate is about $1/1000 and there are easy to use captcha solving APIs for any platform. capcha has long provided an illusion of security, nothing more. Any and all captchas will be broken.

I don't think having people solve capchas for money is all that common. Do you have a source or something? Even if it is common, capchas still stop those spamming strategies that rely on each spam being free for the spammer.

Re: Goodbye (Crummy) CAPTCHAs. Hello Ad Dollars?

#62
post #56

Earlier quoted context omitted.

So if I have a library of 10s of thousands of images of animals, shapes, things etc. that are all easily recognisable to English speakers -- e.g. cat, dog, house, drum, road, tree, book, horse -- and ask them to write in what is it, AND I constantly update that library and retire pictures that's been used many time -- what is your dumb script's success rate? What if I combine three pictures in each challenge - e.g. "…

My spam script would always answer "cat", so among 8 options (cat, dog, house, drum, road, tree, book, horse), I'd get a 12.5% success rate. Plus you constantly have to update your image library, which a huge pain. Also, recognizing 10,000 images will take me around one day and less than $1000 with Amazon turk, thus giving me a perfect 100% success rate. After that you would have to completely renew your image databa…

sigh .. etc. There would be more than 8 options, many more.

YES, it would be a pain to update the library, which is why I'm commending this particular concept for solving that problem ...

Re: Goodbye (Crummy) CAPTCHAs. Hello Ad Dollars?

#63
post #36

Earlier quoted context omitted.

Heh, I know people who are working on breaking reCaptcha. Maybe they should get together and learn from each other. If you're saying that it's possible to prevent manual, outsourced captcha solving, I would have to strongly disagree. It's similar to the futility of DRM as an antipiracy measure. As long as I can see the captcha, I can pay someone in another country to solve it for me. I will agree that it's rare- but…

I'm not saying that its possible to do it in an automated way. I'm just saying that tools exist to create red flags that would make thing easily verified by a human. They have ways in which they deal with these things. All I'm saying is so far, its been working for them.

You're probably not going to tell me more about these tools, although I would be very curious to learn how they work.

All I have is anecdotal evidence- I know several people who are making their living spamming Craigslist and outsourcing their ReCaptcha solving. Since they can make $XX per post, paying pennies for captcha is a tiny expense. I don't condone this behavior, but be aware- it happens more than you think.

Anyway, probably best to take the discussion to email if you want more...perspective from the other side.

Re: Goodbye (Crummy) CAPTCHAs. Hello Ad Dollars?

#64
post #17

Earlier quoted context omitted.

You know, most modern capchas are not solved by bots, but by people in third world countries solving them for pennies. The current going rate is about $1/1000 and there are easy to use captcha solving APIs for any platform. capcha has long provided an illusion of security, nothing more. Any and all captchas will be broken.

I don't think having people solve capchas for money is all that common. Do you have a source or something? Even if it is common, capchas still stop those spamming strategies that rely on each spam being free for the spammer.

I don't know how prevalent this practice is exactly, but I have it on good authority that sites like decaptcher.com are making a mint selling this service.

Re: Goodbye (Crummy) CAPTCHAs. Hello Ad Dollars?

#65
post #3

So you replace the hard to read CAPTCHAs with easy to read ads. Of which presumably there will be a limited number in circulation at any one time. Sounds kinda easy to circumvent...

A longtime standing solution to hard-to-read captchas are easy to read (but hard to process) captchas. E.g. show a picture of an animal or a shape and ask what it is, or even just ask a simple math problem or riddle in writing. Problem with those are that they need to be constantly updated from a reliable source, or else, once the solution becomes popular, the spammer can bruteforce it in linear time (no matter how h…

This was the process used by the Microsoft Research project ASSIRA (http://research.microsoft.com/en-us/um/redmond/projects/asir...) which used images of kittens and puppies put up for adoption as a constant fresh source of input data.

This was later, awesomely riffed on by HotCaptcha (http://valleywag.gawker.com/246656/a-face-only-a-bot-could-l...) which pulled HotOrNot data and asked you to select the 3 hot women out of 9. Sadly, the site is down now but I remember trying it and it was remarkably useful and a hell of a lot more fun than word captchas.

Re: Goodbye (Crummy) CAPTCHAs. Hello Ad Dollars?

#66
post #19

here is the challenge I got when I signed up for the service: http://imgur.com/x5hoN.png for the solution I put in 'stupid', and it worked this definitely doesn't solve the security considerations that captchas were designed for. Update: Ok so it didn't take long to break this thing. These guys have the plain text of the CAPTCHA in the document DOM. It isn't even an image - the CAPTCHA is rendered in javascript. See:…

And since this CAPTCHA isn't secure at all, they'll remove the security element altogether, making it a more annoying version of a banner ad.

Re: Goodbye (Crummy) CAPTCHAs. Hello Ad Dollars?

#67
post #56

Earlier quoted context omitted.

My spam script would always answer "cat", so among 8 options (cat, dog, house, drum, road, tree, book, horse), I'd get a 12.5% success rate. Plus you constantly have to update your image library, which a huge pain. Also, recognizing 10,000 images will take me around one day and less than $1000 with Amazon turk, thus giving me a perfect 100% success rate. After that you would have to completely renew your image databa…

sigh .. etc . There would be more than 8 options, many more. YES, it would be a pain to update the library, which is why I'm commending this particular concept for solving that problem ...

You aren't getting it. The probability is 1/present to the user>. If you show the user 100 images and ask them to select one, a bot will have a 1% probability to find the right one, but the user will tell you to get lost.

If you present 10 images (still a stretch), bots will have 10% success rate just answering randomly.

EDIT: Wait, from what I see you mean that the user will have to write "cat" or "dog" or whatever? That's better, yes. Communication, however, is hard, which is why me the GP didn't understand what you meant.

Re: Goodbye (Crummy) CAPTCHAs. Hello Ad Dollars?

#68
post #16

Yeah, this is exactly what I want - remind the user about some other brand in the exact same signup page where I should actually try hard to win him over. Not to mention how ridiculously easy it will be to break these limited edition captchas.

Works just fine for a blogger that doesn't care too much whether you complete the captcha or not but likes the few extra bucks he makes on a well-commented blog entry.

Not if the well-commented blog entry is 99% viagra comments.

Re: Goodbye (Crummy) CAPTCHAs. Hello Ad Dollars?

#70
post #53

Normally, I refrain from writing such bad things about start-ups and people's ideas, unless there is something really awful about it. In this case, it's obvious how terrible this service is, both in terms of how it treats the user (who wants to do you a favor by signing up) as a cow to be milked, and how the implementation of it does very little to solve the actual problem of spam. It's just a greedy and short-sighte…

Users creating and using free accounts have costs associated with them. Those costs need to be met in order for the service to continue, either by tying a revenue model to the users directly, via charity, or by subsidizing their use of your resources by using something they contribute, such as content. Selling user content is not a stable net in proportion to user use of the site; you don't know that the content will…

Very good points here.

I failed to remember that captchas are indeed used for other things besides registering as a member to a site. Things like one-time viewing of information (eg: WHOIS), etc, will probably benefit a lot from this. I showed some oversight claiming this service was dumb. It's great for things where it's OK that I get insulted, because I want to see something bad enough anyway.

I was in the mindset of imagining this being on a registration form to become a user of a website. I think the money lost from the amount of users getting turned off by this would be greater than the one-time profit incurred whenever a user registers. That is, unless your site profits from less users. In equation form:

(amt profit per lifetime of user) x (number of users that won't sign up because of this) > (amt of users that do sign up with this) x N [where N is how much you make from this ad captcha].

Notice that the longer you plan on retaining users, the less you should be willing to risk slowing down your sign-ups, unless this ad captcha offers a high enough profit. It is my opinion that for sites seeking long-term relationships with users, that this thing sucks. On the other hand, if you can afford that the user not continue beyond a point, then it's great. That's why it'll work for porn and other seedy crappy sites, and probably why I have low regard for it. I admit this is a foolish mindset.

In regards to "actual problem of spam," I was referring to the answer of the captcha being in the DOM, and the otherwise flawed implementation of it.

Post reply on HN