Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using WolframAlpha to Hack Text CAPTCHA

joelvanhorn.com

Post reply on HN
Print view View original

21–30 of 47 posts

Re: Using WolframAlpha to Hack Text CAPTCHA

#21

Post by gojomo »

jluxenberg wrote: post #14
elliottcarlson wrote: post #8

Earlier quoted context omitted.

Wouldn't an open-source bank of CAPTCHA questions open the door for an open-source bank of answers to these questions?

No, that's the reason the answers are hashed. You can't get the answer from the hash, since a hash is a one-way function. This is the same reason you never store passwords in your database in plaintext, but rather hash them first.

Still, almost all (or all?) of the answers are excerpts of the question. So just test all short excerpts against the hashes, voila, an answer key.

Re: Using WolframAlpha to Hack Text CAPTCHA

#22

Post by elliottcarlson »

gojomo wrote: post #20

Some ALMOSTs could be turned into SUCCESSes with a few postprocessing rules-of-thumb, like: - the CAPTCHA usually wants a single word or number - the desired word is usually the rarer or later one

It's still a game of guesswork. Generally if you fail the CAPTCHA you will be offered a new one; and any good system should lock you out after a certain amount of failures.

Re: Using WolframAlpha to Hack Text CAPTCHA

#23

Post by joelvh »

gojomo wrote: post #20

Some ALMOSTs could be turned into SUCCESSes with a few postprocessing rules-of-thumb, like: - the CAPTCHA usually wants a single word or number - the desired word is usually the rarer or later one

Exactly. The whole discussion here points to the major flaws in using text as CAPTCHA. Maybe if questions were more metaphorical they would be harder to guess, but then there is no absolute answer. I think a combination of text, image, and logic would be hardest to break.

Re: Using WolframAlpha to Hack Text CAPTCHA

#24

Post by InclinedPlane »

jluxenberg wrote: post #14
elliottcarlson wrote: post #8

Earlier quoted context omitted.

Wouldn't an open-source bank of CAPTCHA questions open the door for an open-source bank of answers to these questions?

No, that's the reason the answers are hashed. You can't get the answer from the hash, since a hash is a one-way function. This is the same reason you never store passwords in your database in plaintext, but rather hash them first.

As elliotcarlson pointed out the issue isn't that answers can be determined automatically, it's that the cost of determining the answers can be amortized over all uses. It's the same vulnerability problem as rainbow tables. With rainbow tables you spend a lot of (automated) effort computing hashes for password guesses, the key advantage of this tactic is that it is widely applicable to every naive use of that hash function.

The amount of effort for a human to go through the list of answers and come up with answers may be non-trivial, but once completed it's applicable to every single use of the plain-text captcha system. That's bad.

Re: Using WolframAlpha to Hack Text CAPTCHA

#25

Post by kevindication »

notyourwork wrote: post #4

This is a very interesting application of WolframAlpha but it appears to be purely luck when "success" was the result. Using things such as "2nd item in a..." or "7th digit in..." work in a lot of cases but lets talk about a few. "2nd fruit in bear apple goat orange" would result in apple because it is looking for second in a list and neglects context of fruit. "7th digit in abc123def456ghi789 " would result in d whe…

I immediately wondered the same thing. An example from their questions was:

Q: "Which word contains “z” from the list: zoologist, midwifery, spiderweb, crimps?" A: "zoologist"

But what if you change up that list a bit?

Q: "Which word contains “z” from the list: action, jackson, midwifery, zoologist, spiderweb, crimps?" A: "jackson"

Alpha's sentence digestion has always left me going: huh?

Re: Using WolframAlpha to Hack Text CAPTCHA

#26

Post by _JC_ »

jluxenberg wrote: post #6

Was curious about the "text captcha" service. It's a collection of questions with MD5 sums of acceptable answers. They provide an API, but I think this is a case of a project being a "service" to keep the database of questions from being free. There's no technical reason for this to be a service, and it's not a terribly complicated product that would be difficult to scale. It's a static database! Might be neat to cre…

http://jclg.fr/projects/textcaptchahack/

Just tell me if you need the source code ;P

Re: Using WolframAlpha to Hack Text CAPTCHA

#27

Post by eru »

nodata wrote: post #19
elliottcarlson wrote: post #16

Earlier quoted context omitted.

That's not the issue - as soon as you make a list of questions available for the world, all it takes is one spammer to create a matching list of answers and they can go to town. By providing that list of answers as open source you are making it easier for someone to create the counter part answer database.

http://xkcd.com/810/

http://xkcdexplained.com/post/1395792545/constructive

Re: Using WolframAlpha to Hack Text CAPTCHA

#28

Post by VeXocide »

mquander wrote: post #11
pygy_ wrote: post #7

Earlier quoted context omitted.

> "2nd fruit in bear apple goat orange"[1], "7th digit in abc123def456ghi789"[2] It barfs on these ones, but not like you predict (it's actually worse). "The 2nd colour in purple, belly, yellow, arm, white and blue"[3] gives back yellow, though, so it's not that stupid. [1] http://www.wolframalpha.com/input/?i=The+2nd+fruit+in+bear+a... [2] http://www.wolframalpha.com/input/?i=7th+digit+in+abc123def4... [3] http://ww…

Oh, not that stupid, huh? Query: The 2nd colour in purple, belly, yellow, arm, white and blue Answer: yellow Query: The 3rd colour in purple, belly, yellow, arm, white and blue Answer: yellow Query: The 7th colour in purple, belly, yellow, arm, white and blue Answer: yellow Query: The bluest colour in purple, belly, yellow, arm, white and blue Answer: yellow :-)

I wonder what its favorite colour is ;-)

Re: Using WolframAlpha to Hack Text CAPTCHA

#29

Post by MarcusAurelius »

VeXocide wrote: post #28
mquander wrote: post #11

Earlier quoted context omitted.

Oh, not that stupid, huh? Query: The 2nd colour in purple, belly, yellow, arm, white and blue Answer: yellow Query: The 3rd colour in purple, belly, yellow, arm, white and blue Answer: yellow Query: The 7th colour in purple, belly, yellow, arm, white and blue Answer: yellow Query: The bluest colour in purple, belly, yellow, arm, white and blue Answer: yellow :-)

I wonder what its favorite colour is ;-)

Try it: http://www.wolframalpha.com/input/?i=what+is+your+favorite+c...

Re: Using WolframAlpha to Hack Text CAPTCHA

#30

Post by phwd »

I am not sure I understand what he is saying. All the "results" that he is talking about are the interpreted inputs for the application to process.

So for," What is seven hundred and forty four as a number? ", the interpreted input is a NumberQ function taking the main part "seven hundred and forty four as a number" and evaluating whether it is a number or not. The real result is true.

The zoologist one has already been talked about. The rest other than the 7th digit question are all false.

There are many different choices for the inputs, for example with the colour question

The 2nd colour in purple, yellow, arm, white and blue is?

There seems to be some popularity going on. The first choice as input is yellow and the second choice is blue. To further test replacing yellow with black leads to blue as the first choice. Then again even if you were to use the interpreted inputs you would have to determine the syntax for wolfram which last time I checked is not available and is basically a guess the syntax game.

http://webapps.stackexchange.com/q/1322/40

If someone would care to enlighten me on how this could actually work I would greatly appreciate it, otherwise this method does not seem like it will work. Nice creativity though.

Post reply on HN