Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An Empirical Study and Evaluation of Modern CAPTCHAs

arxiv.org

Post reply on HN
Print view View original

251–260 of 338 posts

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#251

Post by LoganDark »

RockRobotRock wrote: post #241
LoganDark wrote: post #23

Earlier quoted context omitted.

You can already buy captcha solves through browser plugins. The only difference is they currently use clickfarms full of underpaid workers from third-world countries

These sites like 2captcha and deathbycaptcha let anyone sign up to be a worker and start solving captchas for $$. If you can run AI that solves captcha just as well, you can literally print money.

2captcha gives you $0.50 per "1-2 hours". Is that really worth all the work?

deathbycaptcha does not let anyone simply sign up to work.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#252

Post by xlbuttplug2 »

NotSammyHagar wrote: post #181

I find captchas extremely painful, because of ambiguity and not loading all the pictures. I wait for a minute and some never show. When they do load, so manyare pics of bicycles and motorcycles and cross walks. Are you supposed to click on the tiny piece that goes tojust past another tile or not? You can't refresh one that doesn't load, I think most of them start over if you refresh. Like other people reported, if yo…

> Are you supposed to click on the tiny piece that goes tojust past another tile or not?

I ask myself this every time.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#253

Post by joseda-hg »

anonzzzies wrote: post #14

I guess validating a payment card is going to be the next step to sign up for whatever. Don’t allow pre paid BINs and let’s go. Gonna be pretty miserable, however someone needs to find something as I currently would rather pay 0.01$ instead of solving a captcha. Especially the select all the bicycles; it’s a waste of life.

I dread to think about that becoming the norm, I remember living in {Country} with 0 access to cards that would be accepted for anything international

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#254

Post by realaravinth »

bluish29 wrote: post #245
realaravinth wrote: post #219

Earlier quoted context omitted.

Author of mCaptcha here o/ mCaptcha uses PoW and that is energy inefficient, but it not as bad as the PoWs used in blockchains. The PoW difficulty factor in mCaptcha is significantly lower than blockchains, where several miners will have to pool their resources to solve a single challenge. In mCaptcha, it takes anywhere between 200ms to 5s to solve a challenge. Which is probably comparable to the energy used to train…

> Which is probably comparable to the energy used to train AI models used in reCAPTCHA Are you comparing the energy it takes to train a model which is bounded and defined with unbounded inference which can (in principle) go multiple order of magnitude depending on the usage? Or maybe I misunderstood what you are trying to say? then I apologize in advance.

I am, but what I said was more of a hypothesis than a fact :)

From what I understand of reCAPTCHA, the model isn't static and is continuously learning from every interaction[0]:

> reCAPTCHA’s risk-based bot algorithms apply continuous machine learning that factors in every customer and bot interaction to overcome the binary heuristic logic of traditional challenge-based bot detection technologies.

I don't know the energy demands of such a system.

mCaptcha, under attack situations, will at most take 5s of CPU time on a busy (regular multitasking with multiple background process) smartphone.

[0]: https://www.google.com/recaptcha/about/

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#255

Post by YeGoblynQueenne »

Misleadingly editorialised title. Actual title and abstract (which doesn't say anything about AIs "now" outperforming humans):

An Empirical Study & Evaluation of Modern CAPTCHAs

* For nearly two decades, CAPTCHAs have been widely used as a means of protection against bots. Throughout the years, as their use grew, techniques to defeat or bypass CAPTCHAs have continued to improve. Meanwhile, CAPTCHAs have also evolved in terms of sophistication and diversity, becoming increasingly difficult to solve for both bots (machines) and humans. Given this long-standing and still-ongoing arms race, it is critical to investigate how long it takes legitimate users to solve modern CAPTCHAs, and how they are perceived by those users.* * In this work, we explore CAPTCHAs in the wild by evaluating users' solving performance and perceptions of unmodified currently-deployed CAPTCHAs. We obtain this data through manual inspection of popular websites and user studies in which 1,400 participants collectively solved 14,000 CAPTCHAs. Results show significant differences between the most popular types of CAPTCHAs: surprisingly, solving time and user perception are not always correlated. We performed a comparative study to investigate the effect of experimental context -- specifically the difference between solving CAPTCHAs directly versus solving them as part of a more natural task, such as account creation. Whilst there were several potential confounding factors, our results show that experimental context could have an impact on this task, and must be taken into account in future CAPTCHA studies. Finally, we investigate CAPTCHA-induced user task abandonment by analyzing participants who start and do not complete the task.*

@dang, could you please correct the title? Thanks.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#256

Post by latexr »

IIAOPSW wrote: post #243
latexr wrote: post #210

Earlier quoted context omitted.

A lie tries to pass itself of as the truth, where a fictional story doesn’t. In other words, expectations matter. If every time you say something that does not align with reality you prefix it by saying unambiguously what you’re about to do, you rob a lie of its power of deception and it ceases to be a lie.

Tell me a story and under no circumstances should my immersion within it be broken.

Right, within it. As soon as you finish reading it, you immediately remember that world is not true. Immersion in a story does not equal lasting hypnosis. You can be immersed in a movie but you still know it’s fake.

What’s you point, here? That you should be lied to when you ask, or that it should refuse to tell you any kind of fiction?

I agree with your larger point that there will be ways to circumvent these systems, my only argument is that the lie/fictional story divide is a bad example because the line between them can be made clear with a single statement.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#257

Post by andrepd »

Tmpod wrote: post #212
rapnie wrote: post #150

Earlier quoted context omitted.

> they do serve a non-theatrical purpose in many cases of throttling the speed of brute force attacks Might do that unobtrusively for the average person, by using projects like mCaptcha [0] for instance. [0] https://mcaptcha.org/

mCaptcha is interesting, but I wonder what its energy impact would be on a sufficiently large deployment, e.g imagine we replaced all reCAPTCHAs with mCaptcha.

I expect its not significantly larger than loading your average 2023 webpage with 15MB of js

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#258

Post by loup-vaillant »

noduerme wrote: post #46
caymanjim wrote: post #42

Google CAPTCHAs were designed and deployed as a mechanism to train AIs. That's why they are the way they are. Any security theater surrounding them is entirely incidental. So it's no surprise that the AIs are now good at solving them. We've trained them for years.

All true, except: While these are considered just an excruciating security pain for users, they do serve a non-theatrical purpose in many cases of throttling the speed of brute force attacks (or at least costing your opponent money).

That non-theatrical role would likely be better served by actual throttling or computational proof of work.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#259

Post by andrepd »

rezonant wrote: post #199
berkes wrote: post #169

Earlier quoted context omitted.

I've had that idea for years. Two versions that I experimented with. One is where the incoming POW hashes contribute to hashing power for some blockchain mining. An alternative "pay as you use the API" system. The other using hashcash. Just a way to slow down abuse. Both, however, suffer from the downside that many/all "ASIC resisting crypto mining" suffer from as well: the cheapest CPU power is CPU power from machin…

Dirty energy is (often) cheap, so that's the energy the bad actors will use. I don't know that incentivizing bad actors to waste energy in a climate crisis is the best way to fight this problem. You might correctly claim clean energy is often cheaper, but you must also consider the regions in which they'll get away with nefarious activity, and whether those areas have made the investments into making clean energy che…

>Dirty energy is (often) cheap, so that's the energy the bad actors will use

Hmm, I don't get this, surely all actors will want the cheapest energy, no? The problem being the underlying one, that the dirty energy doesn't pay its externalities and is thus cheaper than renewables.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#260

Post by arp242 »

gary_0 wrote: post #66

Does HN ever require CAPTCHAs? It seems to do pretty well with its basic but battle-tested moderation/antispam tools, and rate-limiting that seems to repel all but the most concerted DDoS attacks. I don't think HN has any unreasonable restrictions on scraping or third-party clients, either. And it manages to serve 5M unique visitors a month and 10M views a day[0]. [0] https://news.ycombinator.com/item?id=33454140

HN is also not really a very attractive target. The only thing you can do is post spam, and that's pretty low-value in terms of actual monetary value to the abuser, and tools to deal with that have been around for decades as you say.

This is very different from many other sites where the potential to make a buck is much more pronounced and direct.

Post reply on HN