Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An Empirical Study and Evaluation of Modern CAPTCHAs

arxiv.org

Post reply on HN
Print view View original

111–120 of 338 posts

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#111

Post by jacquesm »

pyeri wrote: post #86
caymanjim wrote: post #42

Google CAPTCHAs were designed and deployed as a mechanism to train AIs. That's why they are the way they are. Any security theater surrounding them is entirely incidental. So it's no surprise that the AIs are now good at solving them. We've trained them for years.

Once they get fully trained then how will websites ever distinguish between an intelligent bot and real human? At least now, they are outsourcing that filtering to services like cloudflare. But with this kind of training, how will even cloudflare distinguish between bot and the human?

The human will be the slower one.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#113

Post by candiodari »

pyeri wrote: post #86
caymanjim wrote: post #42

Google CAPTCHAs were designed and deployed as a mechanism to train AIs. That's why they are the way they are. Any security theater surrounding them is entirely incidental. So it's no surprise that the AIs are now good at solving them. We've trained them for years.

Once they get fully trained then how will websites ever distinguish between an intelligent bot and real human? At least now, they are outsourcing that filtering to services like cloudflare. But with this kind of training, how will even cloudflare distinguish between bot and the human?

The thing about CAPTCHAs is that convnets were already better than the average human at reading most/all visual captchas, since ~2000. You still needed to program the logic of the captcha (it couldn't follow instructions like "find the red lights", but it could take a picture and find the red lights).

I wonder when we'll get to the point that employers can't tell the difference between transformers and real humans anymore ...

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#115

Post by JimDabell »

stavros wrote: post #83
snordgren wrote: post #59

Earlier quoted context omitted.

GPT-4 (in)famously tricked a human to do a captcha for it. The current GPT-4 with vision would probably have been able to do it without the human, but maybe it has been “gaslit” by all the content online saying that only humans can solve captchas, that it doesn’t consider it?

I really doubt that GPT-4 had the "will" to do anything. Someone must have asked it to "want" to trick a user.

It’s from here: https://cdn.openai.com/papers/gpt-4.pdf (search for "CAPTCHA"). It was an artificial exercise that got massively exaggerated. It was explicitly instructed to do nefarious things like lie to people, it didn’t do those things of its own accord.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#116

Post by SturgeonsLaw »

insanitybit wrote: post #62
ArtTimeInvestor wrote: post #48

The solution could be a cryptocurrency which can be mined in the browser. Hashcash, which was one of the inspirations for Bitcoin, was initially invented to prevent email spam. Consumer devices have a lot of spare CPU and RAM. So a proof-of-work algorithm which consumes those resources for a minute might work? If it generates $0.01 for the website owner in that minute, maybe that would work?

Wouldn't any proof of work be just as easy for a computer to achieve as a human?

Yeah but it would cost spammers who want to impersonate a large number of humans at once

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#117

Post by candiodari »

jacquesm wrote: post #111
pyeri wrote: post #86

Earlier quoted context omitted.

Once they get fully trained then how will websites ever distinguish between an intelligent bot and real human? At least now, they are outsourcing that filtering to services like cloudflare. But with this kind of training, how will even cloudflare distinguish between bot and the human?

The human will be the slower one.

Yeah, no offence, but sleep(2 + random.sample(coffee + toilet + sneezing + normal response time)) has been a required part of web scrapers since forever.

With coffee N(1,5 minutes, 20 seconds), toilet N(4 minutes, 30 seconds), ...

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#118

Post by JimDabell »

pyeri wrote: post #86
caymanjim wrote: post #42

Google CAPTCHAs were designed and deployed as a mechanism to train AIs. That's why they are the way they are. Any security theater surrounding them is entirely incidental. So it's no surprise that the AIs are now good at solving them. We've trained them for years.

Once they get fully trained then how will websites ever distinguish between an intelligent bot and real human? At least now, they are outsourcing that filtering to services like cloudflare. But with this kind of training, how will even cloudflare distinguish between bot and the human?

> how will websites ever distinguish between an intelligent bot and real human?

Things like Private Access Tokens: https://blog.cloudflare.com/eliminating-captchas-on-iphones-...

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#119

Post by szundi »

pyeri wrote: post #86
caymanjim wrote: post #42

Google CAPTCHAs were designed and deployed as a mechanism to train AIs. That's why they are the way they are. Any security theater surrounding them is entirely incidental. So it's no surprise that the AIs are now good at solving them. We've trained them for years.

Once they get fully trained then how will websites ever distinguish between an intelligent bot and real human? At least now, they are outsourcing that filtering to services like cloudflare. But with this kind of training, how will even cloudflare distinguish between bot and the human?

EU digital ID, asking for mobile number and sending text, so something that is linked to an ID and/or costs money to have. Goodbye anonimity, probably.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#120

Post by stavros »

JimDabell wrote: post #115
stavros wrote: post #83

Earlier quoted context omitted.

I really doubt that GPT-4 had the "will" to do anything. Someone must have asked it to "want" to trick a user.

It’s from here: https://cdn.openai.com/papers/gpt-4.pdf (search for "CAPTCHA"). It was an artificial exercise that got massively exaggerated. It was explicitly instructed to do nefarious things like lie to people, it didn’t do those things of its own accord.

Thank you for the link, I had found it after some Googling but neglected to post. Yep, they instructed GPT-4 to be nefarious, and it followed the instruction.

Hardly the AI uprising, though definitely a good tool for anyone, good or evil.

Post reply on HN