Live data from Hacker News

Beating Google ReCaptcha and the funCaptcha using AWS Rekognition

bitbucket.org

11–20 of 128 posts

Re: Beating Google ReCaptcha and the funCaptcha using AWS Rekognition

#11
post #7

At some point Captcha's will be easier to solve with software than by people. Hopefully by then we can retire them completely. The onus for proving that a visitor is not a bot should be on the server side, not on the humans.

I'd imagine they may already be. I've been having a -lot- of issues with captchas lately. It's not my eyes getting worse, they seem to be getting both more esoteric, and the letters all crammed together. Is that cl, cI, ol, oI, or d? It often takes me multiple attempts.

Re: Beating Google ReCaptcha and the funCaptcha using AWS Rekognition

#12

Woah, I never seen something like this done with bash and command line utilities. Thanks for sharing, made me find xdotool which is exactly what I neede to replace SikuliX. I can't comment on the project since I didn't test it but wow, only this example https://bitbucket.org/Pirates-of-Silicon-Hills/voightkampff/... made me think why didn't OP use a scripting language and went with Bash? (Python?) Don't get me wrong,…

Sikuli has the benefit of being fairly cross-platform, so scripts written for X will also work in Windows and in theory other more esoteric window manager environments.

It also has the ability to identify visual cues, which this doesn't seem to do.

Re: Beating Google ReCaptcha and the funCaptcha using AWS Rekognition

#13
post #7

At some point Captcha's will be easier to solve with software than by people. Hopefully by then we can retire them completely. The onus for proving that a visitor is not a bot should be on the server side, not on the humans.

> The onus for proving that a visitor is not a bot should be on the server side,

Unfortunately that's exactly what is happening with ReCaptcha checking for Google cookies.

Re: Beating Google ReCaptcha and the funCaptcha using AWS Rekognition

#14
while neat, it's a boon to spammers and other nefarious actors who can use these techniques to further get around captcha... concerning to say the least.

if we want to defeat time-wasting and privacy-invading captcha and the murky ethics aren't a concern, then we should go to every e-commerce site that employs them, with full crap-blocking privacy mode on, load up on products/services, and then abandon our carts at the captcha.

maybe we can have botnet operators take this idea and run with it, despite the murky ethics.

Re: Beating Google ReCaptcha and the funCaptcha using AWS Rekognition

#15
post #3

Step 1: Use Captcha to get free AI training data. Step 2: Sell improved AI. Step 3: Add edge cases to the Captcha that your AI can't handle yet. Go to step 1.

Can someone please explain to me why smart people keep saying that we’ll just build software to detect deepfakes?

When AlphaZero plays against itself it just gets better. Once that spread is so narrow, every deviation is in the range of possible error. And it can’t explain WHY a certain move is better or why the picture is a squirrel. And sometimes it can be wrong, but only on hilarious edge cases, in the rest we just “trust it” because we dont know one way or the other!!

Once deepfakes have covered every possible thing that could give away the deepfake, what remains is dubious arguments as to WHY something is or is not a deepfake. It could be wrong or not, we would just “trust it”?

I am saying that if there a range past the uncanny valley for adversarial AI then once the generative network is there, it’s game over. They can quickly generate any amount of speech said by anyone for example, and we will not know whether they said it or not. All audio and video evidence would be inadmissible without watermarks. And then we would have to trust whoever made the watermark.

In short - mutually distrusting byzantine consensus or signing will be required for any claim.

Re: Beating Google ReCaptcha and the funCaptcha using AWS Rekognition

#16
post #7

At some point Captcha's will be easier to solve with software than by people. Hopefully by then we can retire them completely. The onus for proving that a visitor is not a bot should be on the server side, not on the humans.

There are already extensions for that.

Re: Beating Google ReCaptcha and the funCaptcha using AWS Rekognition

#17
post #15
post #3

Step 1: Use Captcha to get free AI training data. Step 2: Sell improved AI. Step 3: Add edge cases to the Captcha that your AI can't handle yet. Go to step 1.

Can someone please explain to me why smart people keep saying that we’ll just build software to detect deepfakes? When AlphaZero plays against itself it just gets better. Once that spread is so narrow, every deviation is in the range of possible error. And it can’t explain WHY a certain move is better or why the picture is a squirrel. And sometimes it can be wrong, but only on hilarious edge cases, in the rest we jus…

Except of course if they also are able to use AI to generate hash collisions in everybcryptographically secure hash algorithm, but I highly doubt THAT’ll ever happen :-)

Re: Beating Google ReCaptcha and the funCaptcha using AWS Rekognition

#18
post #15
post #3

Step 1: Use Captcha to get free AI training data. Step 2: Sell improved AI. Step 3: Add edge cases to the Captcha that your AI can't handle yet. Go to step 1.

Can someone please explain to me why smart people keep saying that we’ll just build software to detect deepfakes? When AlphaZero plays against itself it just gets better. Once that spread is so narrow, every deviation is in the range of possible error. And it can’t explain WHY a certain move is better or why the picture is a squirrel. And sometimes it can be wrong, but only on hilarious edge cases, in the rest we jus…

security by obscurity - The companies detecting deepfakes will certainly not publish their methods/networks.

Re: Beating Google ReCaptcha and the funCaptcha using AWS Rekognition

#19
post #15
post #3

Step 1: Use Captcha to get free AI training data. Step 2: Sell improved AI. Step 3: Add edge cases to the Captcha that your AI can't handle yet. Go to step 1.

Can someone please explain to me why smart people keep saying that we’ll just build software to detect deepfakes? When AlphaZero plays against itself it just gets better. Once that spread is so narrow, every deviation is in the range of possible error. And it can’t explain WHY a certain move is better or why the picture is a squirrel. And sometimes it can be wrong, but only on hilarious edge cases, in the rest we jus…

We do have methods to detect deepfakes and it often works very well (at least for any given generator, perhaps not multiple generators), but you're right, at some point deepfakes will be indistinguishable from real media. At that point I think the problem is largely outside the domain of computer science and we will need to start redefining "trust" looks like.

Re: Beating Google ReCaptcha and the funCaptcha using AWS Rekognition

#20
post #7

At some point Captcha's will be easier to solve with software than by people. Hopefully by then we can retire them completely. The onus for proving that a visitor is not a bot should be on the server side, not on the humans.

Server should never trust client input

How would it make that determination?

Post reply on HN