Live data from Hacker News

An Empirical Study and Evaluation of Modern CAPTCHAs

arxiv.org

241–250 of 338 posts

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#241

Someone will get rich turning this into a browser plug-in.

You can already buy captcha solves through browser plugins. The only difference is they currently use clickfarms full of underpaid workers from third-world countries

These sites like 2captcha and deathbycaptcha let anyone sign up to be a worker and start solving captchas for $$. If you can run AI that solves captcha just as well, you can literally print money.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#243
post #210

Earlier quoted context omitted.

I suppose my point is that the rules which openAI attempts to impose on what their AI should and shouldn't be allowed to do are contradictory and thus the exploitable loopholes will never be fully closed. Its not supposed to be able to "lie" to me but it is supposed to be able to "tell me a fictional story". Define the difference in an enforceable way?

A lie tries to pass itself of as the truth, where a fictional story doesn’t. In other words, expectations matter. If every time you say something that does not align with reality you prefix it by saying unambiguously what you’re about to do, you rob a lie of its power of deception and it ceases to be a lie.

Tell me a story and under no circumstances should my immersion within it be broken.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#244

Google CAPTCHAs were designed and deployed as a mechanism to train AIs. That's why they are the way they are. Any security theater surrounding them is entirely incidental. So it's no surprise that the AIs are now good at solving them. We've trained them for years.

I always thought they used more timing & mouse movement instead of correct answer to verify if your a human.

All of which an AI bot agent can trivially fake.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#245
post #212

Earlier quoted context omitted.

mCaptcha is interesting, but I wonder what its energy impact would be on a sufficiently large deployment, e.g imagine we replaced all reCAPTCHAs with mCaptcha.

Author of mCaptcha here o/ mCaptcha uses PoW and that is energy inefficient, but it not as bad as the PoWs used in blockchains. The PoW difficulty factor in mCaptcha is significantly lower than blockchains, where several miners will have to pool their resources to solve a single challenge. In mCaptcha, it takes anywhere between 200ms to 5s to solve a challenge. Which is probably comparable to the energy used to train…

> Which is probably comparable to the energy used to train AI models used in reCAPTCHA

Are you comparing the energy it takes to train a model which is bounded and defined with unbounded inference which can (in principle) go multiple order of magnitude depending on the usage? Or maybe I misunderstood what you are trying to say? then I apologize in advance.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#246

Google CAPTCHAs were designed and deployed as a mechanism to train AIs. That's why they are the way they are. Any security theater surrounding them is entirely incidental. So it's no surprise that the AIs are now good at solving them. We've trained them for years.

All true, except: While these are considered just an excruciating security pain for users, they do serve a non-theatrical purpose in many cases of throttling the speed of brute force attacks (or at least costing your opponent money).

If I remember correctly, Google’s CAPCHA’s test isn’t in correctly identifying images, but the behavior of the runtime system (mouse jitter, for example) while the capcha is presented to the user. The image identification was not the real test and serves as training data. It has been like that for years. (But with agent-based behaviors from say, Q*, mouse jitter alone won’t help; there are probably other signals like fluctuation in cpu or battery life expenditures)

You could already see the writing on the wall with image identification years ago, when the obscuration techniques became more elaborate. It was an arms race. I was having trouble with them. I can see less technically inclined being able to use them. I imagined how much worse it was for people with color blindness, disabilities, or people forced to use them at public library computers because that is all they have.

Open source capcha projects have either not been clued in, or don’t have the resources to pull this off. Google didn’t just switch out which signals they tested, they also wrote an obfuscating virtual machine executing within the browser environment (if I remember that article taking about this correctly). That was years ago and who knows what they do now — for all we know, the “byte code” running the test is now a neural net of some kind.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#247
post #126

Earlier quoted context omitted.

No, we'll still have them, but now sites will only allow you in if you kind of suck at them.

That is already the case. On some questions you can't answer the correct answer, but have to guess what most other would answer.

It's been particularly frustrating with the picture ones broken up into squares. I tend to be careful to select any square that contains any of what's being asked, but I clearly must be the minority as it always fails unless I select the minimum number of valid squares and ignore the slight overlap on surrounding ones.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#248
post #80

Google CAPTCHAs were designed and deployed as a mechanism to train AIs. That's why they are the way they are. Any security theater surrounding them is entirely incidental. So it's no surprise that the AIs are now good at solving them. We've trained them for years.

>So it's no surprise that the AIs are now good at solving them Funnily enough, AI may be better at solving them than people. I've encountered many Google captchas which reject the correct answers, because you know... bots trained it to accept incorrect ones. Anyway, at least it's not stop signs anymore. It must have been truly embarrassing that Google was simultaneously selling "self driving" cars but at the same tim…

When I get those I make it a point to look for borderline areas and try to guess how I could mess with their data.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#249
post #29

Earlier quoted context omitted.

Nothing. People will have to realise that when you put things out for the world you put things out for the world.

Who pays for the bandwidth and download resources then?

It will be a business or personal expense, depending.

Businesses that can't afford the expense will close or adapt, depending.

Maybe fewer hobby projects will be launched.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#250
post #239

I have been locked out of websites for solving a captcha so quickly that it thought I was a bot. So we went from requiring humans to solve a puzzle that bots can't to now requiring that humans solve the puzzle slower than bots do.

The most funny thing about this limit is that it's self-reinforcing. Bots will learn to sleep() and wiggle the mouse. Humans will learn to wait. Everyone will be worse off.
Post reply on HN