Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An Empirical Study and Evaluation of Modern CAPTCHAs

arxiv.org

Post reply on HN
Print view View original

261–270 of 338 posts

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#261

Post by saberience »

hosh wrote: post #246
noduerme wrote: post #46

Earlier quoted context omitted.

All true, except: While these are considered just an excruciating security pain for users, they do serve a non-theatrical purpose in many cases of throttling the speed of brute force attacks (or at least costing your opponent money).

If I remember correctly, Google’s CAPCHA’s test isn’t in correctly identifying images, but the behavior of the runtime system (mouse jitter, for example) while the capcha is presented to the user. The image identification was not the real test and serves as training data. It has been like that for years. (But with agent-based behaviors from say, Q*, mouse jitter alone won’t help; there are probably other signals like…

For those with elderly parents the writing has been on the wall for years. It’s sad but my mother has for some time been effectively locked out of parts of the internet as she is unable to complete these kinds of captures due to eyesight issues.

I mean, I’ve sometimes had to try three or four times with certain captures and I have perfect eyesight (with my glasses). I feel so badly for those with vision or hearing issues with an empathy I never had when I was younger. They are so often simply forgotten.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#262

Post by graphe »

saberience wrote: post #261
hosh wrote: post #246

Earlier quoted context omitted.

If I remember correctly, Google’s CAPCHA’s test isn’t in correctly identifying images, but the behavior of the runtime system (mouse jitter, for example) while the capcha is presented to the user. The image identification was not the real test and serves as training data. It has been like that for years. (But with agent-based behaviors from say, Q*, mouse jitter alone won’t help; there are probably other signals like…

For those with elderly parents the writing has been on the wall for years. It’s sad but my mother has for some time been effectively locked out of parts of the internet as she is unable to complete these kinds of captures due to eyesight issues. I mean, I’ve sometimes had to try three or four times with certain captures and I have perfect eyesight (with my glasses). I feel so badly for those with vision or hearing is…

There's audio captcha. Try to click the headphone logo (Google captcha has it).

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#263

Post by baydarr »

shadowgovt wrote: post #224
baydarr wrote: post #220

Earlier quoted context omitted.

The website or service owners. If they can't afford it they should be out of business and do something else. The web is big enough for both humans and bots.

No thank you. I prefer to live by the code "Every request is a two way conversation. The client may accept, and the server may choose to emit." Just because I emit to other clients does not obligate me to emit to yours, any more than my emission of ads obligates you to accept and render them (but if you don't, or if you choose to ignore my CAPTCHAs, I may choose not to emit to you).

That's fighting a losing battle. Clients find their way around any restriction, which by itself risks your service or website losing ground and being overtaken by the alternatives.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#264

Post by hooverd »

mrtksn wrote: post #76
anonzzzies wrote: post #14

I guess validating a payment card is going to be the next step to sign up for whatever. Don’t allow pre paid BINs and let’s go. Gonna be pretty miserable, however someone needs to find something as I currently would rather pay 0.01$ instead of solving a captcha. Especially the select all the bicycles; it’s a waste of life.

The next step is device attestation. IIRC Safari already does this, so you should not see captcha on places that support it. Something that can work on any browser can be like this: Scan the QR code in your iPhone or Android device that supports attestation. Will ask you if you approve login, then will attest for you. If you turn out to be a bad actor, the website can ban this device - so no flooding with a single de…

Sounds terrible.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#265

Post by J_Shelby_J »

graphe wrote: post #262
saberience wrote: post #261

Earlier quoted context omitted.

For those with elderly parents the writing has been on the wall for years. It’s sad but my mother has for some time been effectively locked out of parts of the internet as she is unable to complete these kinds of captures due to eyesight issues. I mean, I’ve sometimes had to try three or four times with certain captures and I have perfect eyesight (with my glasses). I feel so badly for those with vision or hearing is…

There's audio captcha. Try to click the headphone logo (Google captcha has it).

I’ve switched to audio captchas completely because it’s quicker and sometimes the image captchas just won’t work.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#267

Post by TrackerFF »

wouldbecouldbe wrote: post #226
caymanjim wrote: post #42

Google CAPTCHAs were designed and deployed as a mechanism to train AIs. That's why they are the way they are. Any security theater surrounding them is entirely incidental. So it's no surprise that the AIs are now good at solving them. We've trained them for years.

I always thought they used more timing & mouse movement instead of correct answer to verify if your a human.

So instead of running some script

checkbox = getPos(checkbox='notRobot')

button = getPos(button='submit')

cursor()

.transition(pos=checkbox)

.click()

.transition(pos=button)

.click()

They now

checkbox = getPos(checkbox='notRobot')

button = getPos(button='submit')

cursor()

.sleep(time=random(distribution='human_captcha'))

.transition(pos=checkbox , method='human_captcha')

.sleep(time=random(distribution='human_captcha'))

.click()

.sleep(time=random(distribution='human_captcha'))

.transition(pos=button, method='human_captcha')

.sleep(time=random(distribution='human_captcha'))

.click()

Where sleep and transitioning are sampled from some random distribution that is close to actual human behavior, which should be pretty trivial to model.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#269

Post by pixl97 »

saberience wrote: post #261
hosh wrote: post #246

Earlier quoted context omitted.

If I remember correctly, Google’s CAPCHA’s test isn’t in correctly identifying images, but the behavior of the runtime system (mouse jitter, for example) while the capcha is presented to the user. The image identification was not the real test and serves as training data. It has been like that for years. (But with agent-based behaviors from say, Q*, mouse jitter alone won’t help; there are probably other signals like…

For those with elderly parents the writing has been on the wall for years. It’s sad but my mother has for some time been effectively locked out of parts of the internet as she is unable to complete these kinds of captures due to eyesight issues. I mean, I’ve sometimes had to try three or four times with certain captures and I have perfect eyesight (with my glasses). I feel so badly for those with vision or hearing is…

>captures due to eyesight issues.

I'm kinda surprised that ADA doesn't allow them to sue site owners about this.

Re: An Empirical Study and Evaluation of Modern CAPTCHAs

#270

Post by barbazoo »

I wish captcha providers universally had to provide a way to shut down their use by bad actors. Here in Canada I get tons of scam texts pointing me to a fake banking or postal service website asking me to pay a fake bill. I want to ddos them with fake payment data but they’re all protected by hcaptcha.
Post reply on HN