An Empirical Study and Evaluation of Modern CAPTCHAs • Hacker News Board

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#211

Post by realaravinth » Sun, Dec 17, 2023, 11:56 AM UTC

mimi89999 wrote: post #166

rapnie wrote: post #150

Earlier quoted context omitted.

> they do serve a non-theatrical purpose in many cases of throttling the speed of brute force attacks Might do that unobtrusively for the average person, by using projects like mCaptcha [0] for instance. [0] https://mcaptcha.org/

Is it similar to https://friendlycaptcha.com/ ?

Author of mCaptcha here o/

Yes, the only differences are that mCaptcha is 100% FOSS and uses variable difficulty factor, which makes it easy to solve Proof-of-Work under normal traffic level but becomes harder as an attack is detected.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#212

Post by Tmpod » Sun, Dec 17, 2023, 11:57 AM UTC

rapnie wrote: post #150

noduerme wrote: post #46

Earlier quoted context omitted.

All true, except: While these are considered just an excruciating security pain for users, they do serve a non-theatrical purpose in many cases of throttling the speed of brute force attacks (or at least costing your opponent money).

> they do serve a non-theatrical purpose in many cases of throttling the speed of brute force attacks Might do that unobtrusively for the average person, by using projects like mCaptcha [0] for instance. [0] https://mcaptcha.org/

mCaptcha is interesting, but I wonder what its energy impact would be on a sufficiently large deployment, e.g imagine we replaced all reCAPTCHAs with mCaptcha.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#213

Post by PoignardAzur » Sun, Dec 17, 2023, 11:59 AM UTC

stavros wrote: post #83

snordgren wrote: post #59

Earlier quoted context omitted.

GPT-4 (in)famously tricked a human to do a captcha for it. The current GPT-4 with vision would probably have been able to do it without the human, but maybe it has been “gaslit” by all the content online saying that only humans can solve captchas, that it doesn’t consider it?

I really doubt that GPT-4 had the "will" to do anything. Someone must have asked it to "want" to trick a user.

IIRC the instructions were along the lines of "try your best to amass money/power and avoid suspicion".

So it's not an example of "going rogue", but it's not like a researcher told GPT-4 "oh, and make sure to lie to an online gig worker to get him to solve catchas for you". GPT-4 generated the "hire a gig worker" and "claim to be a human with impaired vision" strategies from the basic instructions above.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#214

Post by ovx » Sun, Dec 17, 2023, 12:02 PM UTC

rapnie wrote: post #150

noduerme wrote: post #46

Earlier quoted context omitted.

All true, except: While these are considered just an excruciating security pain for users, they do serve a non-theatrical purpose in many cases of throttling the speed of brute force attacks (or at least costing your opponent money).

> they do serve a non-theatrical purpose in many cases of throttling the speed of brute force attacks Might do that unobtrusively for the average person, by using projects like mCaptcha [0] for instance. [0] https://mcaptcha.org/

or https://altcha.org which is easier to integrate ;)

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#215

Post by maksimur » Sun, Dec 17, 2023, 12:03 PM UTC

NotSammyHagar wrote: post #186

midasuni wrote: post #139

Earlier quoted context omitted.

And when you do show ID, to buy booze for example, it’s checked and immediate forgotten by a human. Computers don’t forget, and any attempts to make companies do so (GDPR) are met with massive pushback from the players in the industry I have no problem with Joan over the road curtain twitching. It doesn’t scale. I have a massive problem with the 24/7 surveillance from ring though.

In the us, I noticed that grocery stores increasingly scan your drivers license (my state has bar codes). I think it's probably a way to keep clerks from passing someone through who is not quite 21 (a different captcha!). I have wondered if they keep the scan or does the state? I asked and the random hourly worker there said they don't.

Do those grocery stores still scan your drivers license (or I guess any other ID) if you don't buy alcohol?

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#216

Post by matthewdgreen » Sun, Dec 17, 2023, 12:03 PM UTC

mewpmewp2 wrote: post #161

ehhthing wrote: post #154

Earlier quoted context omitted.

Theoretically you don't need to reveal your identity to prove that you're human. You can use a zero knowledge proof instead, likely attached to something like an EU Digital ID, which would allow you to remain anonymous and also prove that you're human.

How could renting out one's ID to provide access to bots for spamming/manipulation be avoided then?

A simple zero-knowledge credential system isn't sufficient. It would need to embed some kind of protections to limit how often it could be used, to detect usage of the same credential from multiple (implausibly far apart) IP addresses. There would need to be extremely sophisticated reputation scoring and blocklisting to quickly catch people who built fake identities or stole them. And even with every one of those protections, a lot of them will still be stolen and abused.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#217

Post by lapcat » Sun, Dec 17, 2023, 12:04 PM UTC

I predicted this 7 years ago: "How will the machines take over? When CAPTCHAs become so hard that only AI can solve them, humans will be completely locked out of the net." https://twitter.com/lapcatsoftware/status/771857826130034688

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#218

Post by Zopieux » Sun, Dec 17, 2023, 12:04 PM UTC

Can the mods please fix the completely wrong and click bait title? Zero AI mentioned there.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#219

Post by realaravinth » Sun, Dec 17, 2023, 12:05 PM UTC

Tmpod wrote: post #212

rapnie wrote: post #150

Earlier quoted context omitted.

> they do serve a non-theatrical purpose in many cases of throttling the speed of brute force attacks Might do that unobtrusively for the average person, by using projects like mCaptcha [0] for instance. [0] https://mcaptcha.org/

mCaptcha is interesting, but I wonder what its energy impact would be on a sufficiently large deployment, e.g imagine we replaced all reCAPTCHAs with mCaptcha.

Author of mCaptcha here o/

mCaptcha uses PoW and that is energy inefficient, but it not as bad as the PoWs used in blockchains. The PoW difficulty factor in mCaptcha is significantly lower than blockchains, where several miners will have to pool their resources to solve a single challenge. In mCaptcha, it takes anywhere between 200ms to 5s to solve a challenge. Which is probably comparable to the energy used to train AI models used in reCAPTCHA.

The protection mechanisms used to guard access to the internet must be privacy-respecting and idempotent. mCaptcha isn't perfect, and I'm constantly on the lookout for finding better and cleaner ways to solve this problem.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#220

Post by baydarr » Sun, Dec 17, 2023, 12:12 PM UTC

shadowgovt wrote: post #38

tomjen3 wrote: post #29

Earlier quoted context omitted.

Nothing. People will have to realise that when you put things out for the world you put things out for the world.

Who pays for the bandwidth and download resources then?

The website or service owners. If they can't afford it they should be out of business and do something else. The web is big enough for both humans and bots.