Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An Empirical Study and Evaluation of Modern CAPTCHAs

arxiv.org

Post reply on HN
Print view View original

81–90 of 338 posts

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#81

Post by csydas »

bb123 wrote: post #51
noduerme wrote: post #47

Earlier quoted context omitted.

Tesla, the company that just recalled 2 million self driving cars? In fairness, the company best positioned to harness user input to an AI that avoids crashes would probably be Rockstar. OTOH, that AI would definitely not obey stop signs or pedestrians.

By recall you mean a completely routine OTA software update done while the driver is asleep.

A recall for essential maintenance is just that. I would focus on the need for an urgent update due to the flaws rather than the issuing agency's lack of more accurate terminology for a relatively new element to cars. Rolling around in semantic mud on the term recall is not sensible, as the definition in regards to cars is fairly specific [0]. Basically a recall just means there is a safety defect that must be addressed by the manufacturer. In Tesla's case, yes, they can push out an update, but the delivery mechanism of the means of addressing the defect should not be the focus.

0 - https://www.progressive.com/lifelanes/on-the-road/understand...

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#82

Post by diputsmonro »

bheadmaster wrote: post #50
noduerme wrote: post #47

Earlier quoted context omitted.

Tesla, the company that just recalled 2 million self driving cars? In fairness, the company best positioned to harness user input to an AI that avoids crashes would probably be Rockstar. OTOH, that AI would definitely not obey stop signs or pedestrians.

Tesla recalled two million vehicles after federal officials said it had not done enough to make sure that drivers remained attentive when using the system. Not because their self-driving system sucks, or whatever you were trying to imply.

If the self driving system were worth it's salt, it wouldn't matter if the drivers weren't paying attention. Ergo, the system sucks, or is at the very least not nearly as good as Tesla likes to tout.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#83

Post by stavros »

snordgren wrote: post #59
noduerme wrote: post #46

Earlier quoted context omitted.

All true, except: While these are considered just an excruciating security pain for users, they do serve a non-theatrical purpose in many cases of throttling the speed of brute force attacks (or at least costing your opponent money).

GPT-4 (in)famously tricked a human to do a captcha for it. The current GPT-4 with vision would probably have been able to do it without the human, but maybe it has been “gaslit” by all the content online saying that only humans can solve captchas, that it doesn’t consider it?

I really doubt that GPT-4 had the "will" to do anything. Someone must have asked it to "want" to trick a user.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#84

Post by resolutebat »

lakpan wrote: post #17
mdale wrote: post #7

I think captchas disappear next year or so. Already was soft human determination.

That’s excessively optimistic. The most likely scenario is that we’ll have captchas for the next 30 years but only humans will be bothered by them.

This. There are plenty of government websites etc out there that have completely antiquated captchas next to the helpful "works best in Internet Explorer 6" suggestion.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#85

Post by trompetenaccoun »

ArtTimeInvestor wrote: post #74
swinglock wrote: post #70

Earlier quoted context omitted.

Proof of work can already be implemented without a token. Tor has such a feature for denial of service protection. https://blog.torproject.org/introducing-proof-of-work-defens... A benefit of a token is you can recycle previous proof of work by using a small amount of Bitcoin, which could be transferred using Lightning. The value could also be transferred back some amount of time after registration given no bad behav…

With a token, you probably get a higher efficiency. Similar to how a heatpump is more efficient than a heater. If you only consume resources on the client side, then you hope that an attacker thinks "I won't invest $0.01 of resources just to log in here". If you also transfer the consumed resources to the server, you get an additional benefit: The server thinks "$0.01 is enough to cover the costs of a fake signup". A…

I think a fairer solution will be some form of proof of personhood that isn't PoW-based. Your idea isn't bad but it gives more power to those who can afford a lot of devices. You know those Chinese mobile phone click farms they use to game app stores? It will be like that, PoW can prevent spam only to a certain degree and with all the social media and networks we have today there is a lot of money in influencing the users. So spending a few million dollars on devices can be very profitable if it lets you boost certain messages.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#86

Post by pyeri »

caymanjim wrote: post #42

Google CAPTCHAs were designed and deployed as a mechanism to train AIs. That's why they are the way they are. Any security theater surrounding them is entirely incidental. So it's no surprise that the AIs are now good at solving them. We've trained them for years.

Once they get fully trained then how will websites ever distinguish between an intelligent bot and real human? At least now, they are outsourcing that filtering to services like cloudflare. But with this kind of training, how will even cloudflare distinguish between bot and the human?

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#88

Post by Xenoamorphous »

addandsubtract wrote: post #79
ponector wrote: post #56

Earlier quoted context omitted.

Try to use VPN. You will get captcha with tons of bicycles to click...

Why is the UI such a pain in the ass, when it's designed to be used by humans ?! Why do I have to click 8 individual boxes and can't just drag-select an area. I hate those captchas with a passion.

And does the post count as traffic light?

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#89

Post by trompetenaccoun »

insanitybit wrote: post #62
ArtTimeInvestor wrote: post #48

The solution could be a cryptocurrency which can be mined in the browser. Hashcash, which was one of the inspirations for Bitcoin, was initially invented to prevent email spam. Consumer devices have a lot of spare CPU and RAM. So a proof-of-work algorithm which consumes those resources for a minute might work? If it generates $0.01 for the website owner in that minute, maybe that would work?

Wouldn't any proof of work be just as easy for a computer to achieve as a human?

'Proof of Work' as it's generally understood is done by computers only. But I guess I understand what you're asking and the answer is yes, that is a problem. For Sybil resistance it's better to know if someone is a unique human, not if they're a machine that has paid the toll: https://en.wikipedia.org/wiki/Proof_of_personhood

There are exotic solutions like the 'Idena Network'. But sadly I have to admit the best solution I've seen so far is Sam Altman's Worldcoin. Not that I'm a fan, I still hope we can find something better than scanning everyone's eyeball.

Post reply on HN