Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using WolframAlpha to Hack Text CAPTCHA

joelvanhorn.com

Post reply on HN
Print view View original

11–20 of 47 posts

Re: Using WolframAlpha to Hack Text CAPTCHA

#11

Post by mquander »

pygy_ wrote: post #7
notyourwork wrote: post #4

This is a very interesting application of WolframAlpha but it appears to be purely luck when "success" was the result. Using things such as "2nd item in a..." or "7th digit in..." work in a lot of cases but lets talk about a few. "2nd fruit in bear apple goat orange" would result in apple because it is looking for second in a list and neglects context of fruit. "7th digit in abc123def456ghi789 " would result in d whe…

> "2nd fruit in bear apple goat orange"[1], "7th digit in abc123def456ghi789"[2] It barfs on these ones, but not like you predict (it's actually worse). "The 2nd colour in purple, belly, yellow, arm, white and blue"[3] gives back yellow, though, so it's not that stupid. [1] http://www.wolframalpha.com/input/?i=The+2nd+fruit+in+bear+a... [2] http://www.wolframalpha.com/input/?i=7th+digit+in+abc123def4... [3] http://ww…

Oh, not that stupid, huh?

Query: The 2nd colour in purple, belly, yellow, arm, white and blue

Answer: yellow

Query: The 3rd colour in purple, belly, yellow, arm, white and blue

Answer: yellow

Query: The 7th colour in purple, belly, yellow, arm, white and blue

Answer: yellow

Query: The bluest colour in purple, belly, yellow, arm, white and blue

Answer: yellow

:-)

Re: Using WolframAlpha to Hack Text CAPTCHA

#12

Post by torme »

elliottcarlson wrote: post #8
jluxenberg wrote: post #6

Was curious about the "text captcha" service. It's a collection of questions with MD5 sums of acceptable answers. They provide an API, but I think this is a case of a project being a "service" to keep the database of questions from being free. There's no technical reason for this to be a service, and it's not a terribly complicated product that would be difficult to scale. It's a static database! Might be neat to cre…

Wouldn't an open-source bank of CAPTCHA questions open the door for an open-source bank of answers to these questions?

Yeah, exactly, I think this is why it necessitates it being a service and kind of assume that it's not a static database for that reason. If you have a fixed list of questions, it's easy to get answers to those once and never have to do it again. Again, I think its a safe assumption that these are in some way generated on the fly.

Re: Using WolframAlpha to Hack Text CAPTCHA

#13

Post by joelvh »

elliottcarlson wrote: post #8
jluxenberg wrote: post #6

Was curious about the "text captcha" service. It's a collection of questions with MD5 sums of acceptable answers. They provide an API, but I think this is a case of a project being a "service" to keep the database of questions from being free. There's no technical reason for this to be a service, and it's not a terribly complicated product that would be difficult to scale. It's a static database! Might be neat to cre…

Wouldn't an open-source bank of CAPTCHA questions open the door for an open-source bank of answers to these questions?

If you were able to analyze the sentence structure of all 180 million questions, how many different sentence structures would there be? This all points to the fact that you can build algorithms to guess the answers eventually.

Re: Using WolframAlpha to Hack Text CAPTCHA

#14

Post by jluxenberg »

elliottcarlson wrote: post #8
jluxenberg wrote: post #6

Was curious about the "text captcha" service. It's a collection of questions with MD5 sums of acceptable answers. They provide an API, but I think this is a case of a project being a "service" to keep the database of questions from being free. There's no technical reason for this to be a service, and it's not a terribly complicated product that would be difficult to scale. It's a static database! Might be neat to cre…

Wouldn't an open-source bank of CAPTCHA questions open the door for an open-source bank of answers to these questions?

No, that's the reason the answers are hashed. You can't get the answer from the hash, since a hash is a one-way function. This is the same reason you never store passwords in your database in plaintext, but rather hash them first.

Re: Using WolframAlpha to Hack Text CAPTCHA

#15

Post by elliottcarlson »

joelvh wrote: post #13
elliottcarlson wrote: post #8

Earlier quoted context omitted.

Wouldn't an open-source bank of CAPTCHA questions open the door for an open-source bank of answers to these questions?

If you were able to analyze the sentence structure of all 180 million questions, how many different sentence structures would there be? This all points to the fact that you can build algorithms to guess the answers eventually.

Not even just guess them but accurately determine them.

A few years back I was hired by a third party to build a system to break the CAPTCHA on a popular site for various evil deeds. Morals set aside, the money was good and I had a wedding to pay for. A CAPTCHA system becomes quite breakable when it becomes predictable. The system in question used an image based CAPTCHA that used the same (albeit annoying) font for each image, as well as a static distortion overlay and a second set of random distortion. By extracting a thousand sample images I was able to build a system in Perl that could determine the text with an estimated 98% success rate - and when it failed you would just request a new CAPTCHA.

My solution would be to mix up images with logic. I.E.

In the following list of images, which image number contains the green animal: {pic of zebra}, {pic of frog}, {pic of giraffe}

This would require image recognition as well as logic.

Re: Using WolframAlpha to Hack Text CAPTCHA

#16

Post by elliottcarlson »

jluxenberg wrote: post #14
elliottcarlson wrote: post #8

Earlier quoted context omitted.

Wouldn't an open-source bank of CAPTCHA questions open the door for an open-source bank of answers to these questions?

No, that's the reason the answers are hashed. You can't get the answer from the hash, since a hash is a one-way function. This is the same reason you never store passwords in your database in plaintext, but rather hash them first.

That's not the issue - as soon as you make a list of questions available for the world, all it takes is one spammer to create a matching list of answers and they can go to town. By providing that list of answers as open source you are making it easier for someone to create the counter part answer database.

Re: Using WolframAlpha to Hack Text CAPTCHA

#17

Post by joelvh »

mquander wrote: post #11
pygy_ wrote: post #7

Earlier quoted context omitted.

> "2nd fruit in bear apple goat orange"[1], "7th digit in abc123def456ghi789"[2] It barfs on these ones, but not like you predict (it's actually worse). "The 2nd colour in purple, belly, yellow, arm, white and blue"[3] gives back yellow, though, so it's not that stupid. [1] http://www.wolframalpha.com/input/?i=The+2nd+fruit+in+bear+a... [2] http://www.wolframalpha.com/input/?i=7th+digit+in+abc123def4... [3] http://ww…

Oh, not that stupid, huh? Query: The 2nd colour in purple, belly, yellow, arm, white and blue Answer: yellow Query: The 3rd colour in purple, belly, yellow, arm, white and blue Answer: yellow Query: The 7th colour in purple, belly, yellow, arm, white and blue Answer: yellow Query: The bluest colour in purple, belly, yellow, arm, white and blue Answer: yellow :-)

Haha.

Re: Using WolframAlpha to Hack Text CAPTCHA

#18

Post by joelvh »

elliottcarlson wrote: post #16
jluxenberg wrote: post #14

Earlier quoted context omitted.

No, that's the reason the answers are hashed. You can't get the answer from the hash, since a hash is a one-way function. This is the same reason you never store passwords in your database in plaintext, but rather hash them first.

That's not the issue - as soon as you make a list of questions available for the world, all it takes is one spammer to create a matching list of answers and they can go to town. By providing that list of answers as open source you are making it easier for someone to create the counter part answer database.

Exactly!

Re: Using WolframAlpha to Hack Text CAPTCHA

#19

Post by nodata »

elliottcarlson wrote: post #16
jluxenberg wrote: post #14

Earlier quoted context omitted.

No, that's the reason the answers are hashed. You can't get the answer from the hash, since a hash is a one-way function. This is the same reason you never store passwords in your database in plaintext, but rather hash them first.

That's not the issue - as soon as you make a list of questions available for the world, all it takes is one spammer to create a matching list of answers and they can go to town. By providing that list of answers as open source you are making it easier for someone to create the counter part answer database.

http://xkcd.com/810/
Post reply on HN