Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An Empirical Study and Evaluation of Modern CAPTCHAs

arxiv.org

Post reply on HN
Print view View original

71–80 of 338 posts

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#71

Post by eviks »

leobg wrote: post #44
caymanjim wrote: post #42

Google CAPTCHAs were designed and deployed as a mechanism to train AIs. That's why they are the way they are. Any security theater surrounding them is entirely incidental. So it's no surprise that the AIs are now good at solving them. We've trained them for years.

I still find it funny that Google, with the advantage of having millions of Internet users train their AI like galley slaves for free, hasn’t yet been able to crack vision driven self driving. Tesla had no such advantage when training their FSD to recognize traffic lights, bicycles, motorcycles, etc.

It's a much harder problem, and Tesla is nowhere close to the solution

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#72

Post by vanviegen »

Roark66 wrote: post #61
hknmtt wrote: post #43

no need for captchas, just implement throttling per ip. like bcrypt dues for passwords. if a bot fills up a form(or whatever), so be it, but it won't be able to do it for another N seconds or minutes..so the problem then is lowered from per try, which can be thousands of submissions, all the way down to per period and per ip.

Hell no... Some of us sit behind CGNAT, half a million of us on a single public IP.

Exactly. Besides that, a bad actor may well have easy access to tens of thousands of ip address from all over the globe..

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#73

Post by chii »

shadowgovt wrote: post #35
chii wrote: post #30

Earlier quoted context omitted.

> a standard issue human can pass that a machine somehow cannot? may be the premise is wrong. Why prevent non-humans from registering/using/viewing?

Because automated systems operating at scale outstrip the ability of the administrator to maintain the service provided.

If each additional user is not adding additional revenue that exceeds the cost of that user (automated or not), you don't have a business model.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#74

Post by ArtTimeInvestor »

swinglock wrote: post #70
ArtTimeInvestor wrote: post #48

The solution could be a cryptocurrency which can be mined in the browser. Hashcash, which was one of the inspirations for Bitcoin, was initially invented to prevent email spam. Consumer devices have a lot of spare CPU and RAM. So a proof-of-work algorithm which consumes those resources for a minute might work? If it generates $0.01 for the website owner in that minute, maybe that would work?

Proof of work can already be implemented without a token. Tor has such a feature for denial of service protection. https://blog.torproject.org/introducing-proof-of-work-defens... A benefit of a token is you can recycle previous proof of work by using a small amount of Bitcoin, which could be transferred using Lightning. The value could also be transferred back some amount of time after registration given no bad behav…

With a token, you probably get a higher efficiency. Similar to how a heatpump is more efficient than a heater.

If you only consume resources on the client side, then you hope that an attacker thinks "I won't invest $0.01 of resources just to log in here".

If you also transfer the consumed resources to the server, you get an additional benefit: The server thinks "$0.01 is enough to cover the costs of a fake signup".

And the second benefit is probably even better than the first. The server will never really know how cheaply attackers can access resources. But they probably know how much a fake signup costs them.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#75

Post by bongobingo1 »

gary_0 wrote: post #66

Does HN ever require CAPTCHAs? It seems to do pretty well with its basic but battle-tested moderation/antispam tools, and rate-limiting that seems to repel all but the most concerted DDoS attacks. I don't think HN has any unreasonable restrictions on scraping or third-party clients, either. And it manages to serve 5M unique visitors a month and 10M views a day[0]. [0] https://news.ycombinator.com/item?id=33454140

I cant tell if the audience of HN are more likely to script something untoward against HN, be that DDOS or just "check out my product" spam, because its a bunch of hackers - or less likely to do it because (maybe) we like having nice things, or figure the audience is too in the know to fall for boring crypto spam.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#76

Post by mrtksn »

anonzzzies wrote: post #14

I guess validating a payment card is going to be the next step to sign up for whatever. Don’t allow pre paid BINs and let’s go. Gonna be pretty miserable, however someone needs to find something as I currently would rather pay 0.01$ instead of solving a captcha. Especially the select all the bicycles; it’s a waste of life.

The next step is device attestation. IIRC Safari already does this, so you should not see captcha on places that support it.

Something that can work on any browser can be like this: Scan the QR code in your iPhone or Android device that supports attestation. Will ask you if you approve login, then will attest for you. If you turn out to be a bad actor, the website can ban this device - so no flooding with a single device.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#77

Post by ric2b »

ArtTimeInvestor wrote: post #48

The solution could be a cryptocurrency which can be mined in the browser. Hashcash, which was one of the inspirations for Bitcoin, was initially invented to prevent email spam. Consumer devices have a lot of spare CPU and RAM. So a proof-of-work algorithm which consumes those resources for a minute might work? If it generates $0.01 for the website owner in that minute, maybe that would work?

Those devices have a lot of spare CPU and RAM but basically no spare battery capacity.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#78

Post by hiAndrewQuinn »

Roark66 wrote: post #60
_cjse wrote: post #28

Earlier quoted context omitted.

A market of human-oriented hardware keys, where the keys are only intended to be sold to actual human beings, with legal or otherwise cash bounties in place for people who can provide evidence of the keys being sold to or otherwise falling into the hands of non-human entities.

What's stopping a human buying a thousand to use for his bot farm?

As mentioned, a bounty system. Someone who buys a thousand to use would have to be very clever to evade the eyes of all the people interested in profiting off of revealing his actions and getting the chips turned off.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#79

Post by addandsubtract »

ponector wrote: post #56
cinntaile wrote: post #37

Earlier quoted context omitted.

Solving captchas is pretty rare nowadays. Now you usually just press a button and then it does some sort of fingerprinting to determine if you're a human.

Try to use VPN. You will get captcha with tons of bicycles to click...

Why is the UI such a pain in the ass, when it's designed to be used by humans?! Why do I have to click 8 individual boxes and can't just drag-select an area. I hate those captchas with a passion.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#80

Post by panny »

caymanjim wrote: post #42

Google CAPTCHAs were designed and deployed as a mechanism to train AIs. That's why they are the way they are. Any security theater surrounding them is entirely incidental. So it's no surprise that the AIs are now good at solving them. We've trained them for years.

>So it's no surprise that the AIs are now good at solving them

Funnily enough, AI may be better at solving them than people. I've encountered many Google captchas which reject the correct answers, because you know... bots trained it to accept incorrect ones. Anyway, at least it's not stop signs anymore. It must have been truly embarrassing that Google was simultaneously selling "self driving" cars but at the same time demonstrating that stop sign recognition couldn't be done by robots.

Post reply on HN