Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Captchas Are Becoming Ridiculous

blog.andrewmunsell.com

Post reply on HN
Print view View original

71–80 of 238 posts

Re: Captchas Are Becoming Ridiculous

#71

Post by Locke1689 »

ChuckMcM wrote: post #20
andrewmunsell wrote: post #10

Earlier quoted context omitted.

That's actually pretty interesting. With time the number of computers/processors required to do these tasks will go down, but for now and based on that experiment, it almost seems more efficient to use picture based captchas.

I don't think you 'get it' Andrew :-) The folks who bust captchas, 16,000 machines is chump change, they run botnets of hundreds of thousands of machines, they dynamically buy EC2 instances, they make a lot of money. That is the primary reason why I believe that people who use the term 'computationally unfeasible' (you see that a lot in crypto papers) never counted on the kinds of growth we've seen in computers coupl…

Exponential CPU growth rates are factored into cryptographic protocols. As long as growth rates don't become super-exponential they're safe.

Re: Captchas Are Becoming Ridiculous

#72

Post by lgeek »

mmuro wrote: post #21

I'm a big fan of logic captchas. Not only are they way more accessible than image captchas, but the frustration factor is not nearly as high.

Wolfram Alpha does solve some of them. It seems easy to detect the type of question and manually implement a way to parse each.

Here's an example that I got while trying to register an API account: https://www.wolframalpha.com/input/?i=One+%2B+3+equals+%3F

Re: Captchas Are Becoming Ridiculous

#73

Post by tjpaxton »

bhickey wrote: post #67
tjpaxton wrote: post #50

Earlier quoted context omitted.

Take a look at our product at areyouahuman.com We launched in January and are using games to make them easier for people. Some of our early testing showed captchas can decrease signups by up to 25% and we're able to recover almost all of that. We also monitor how you play the game (like mouse movement) so we can ramp up our security without having to make the task more difficult for people. Read more here http://arey…

Do you have any response to claims that your product is easily broken? http://news.ycombinator.com/item?id=4025791 I'm skeptical of your efforts to distinguish humans from bots by mouse movements and other inputs. Anything you can infer can be modeled. It's unreasonable to expect a smart captcha cracker to resemble a zero reaction time Counter Strike aimbot.

Thanks for asking. First, our main focus is on making something more usable for people. We also think captchas are only part of the solution and should be employed with other things (rate limiting, keyword filtering, etc)

That being said, we don't just ignore security. There are a lot of captcha alternatives out there that survive on just obscurity, if they were widely adopted, they wouldn't take much to get around (like a slide to unlock captcha). We analyze mouse movement and other behavior, to avoid this.

To test our algorithms, we write our own bots to break our game (as well as working with the AI lab at the university of michigan) and use that data in our machine learning algorithms. We're always tweaking the bot to see how we can beat it and then looking for new features from the data that we can use.

The main point being, that as people do write bots, we can learn from that and incorporate it. We can also adjust the threshold. Some of our customers care much more about usability and just want a minimum level of protection, other's want the threshold a little higher and accept the risk that humans might fail more often.

Re: Captchas Are Becoming Ridiculous

#74

Post by re_todd »

rhizome wrote: post #12
pizza wrote: post #4

Is there a way to report CAPTCHAs for illegibility?

There's a recycle button that will generate a new one.

Yeah, and a couple days ago I had to hit that button about 20 times before I got one I could decipher. I was about 1 or 2 clicks from giving up.

Re: Captchas Are Becoming Ridiculous

#75

Post by sesqu »

ricardobeat wrote: post #42

Isn't that a result of the massive deployment of reCaptcha? It appears that all the easy words have already been solved with enough confidence, so there's only garbled scans left. Add more books? That said, there are plenty of alternative solutions with good success rates (and far lower abandonment rates), like requiring the answer to a simple question (not math), photo captchas, randomizing inputs, using javascript…

That's what I was thinking. Originally reCAPTCHA had the control word be a scan as well, which meant that an attacker had to beat their OCR. Now that the control word is computer generated, the system has devolved into a regular CAPTCHA that further asks humans for recognition task work.

This version no longer advances OCR algorithms, but does provide cheap exception handling. I don't know when or why the change was made, but obsolescence is at the top of my mind. Either they've ran out of unrecognized words, or adversaries have beaten their OCR. Either way, it seems we're back to 2005.

edit: That said, Luis von Ahn mentioned that Google is experimenting with other image processing tasks, so there's hope yet.

Re: Captchas Are Becoming Ridiculous

#76

Post by Devilboy »

andrewmunsell wrote: post #6
ChuckMcM wrote: post #3

They are ridiculous, but they are so because what they are trying to achieve can no longer be easily achieved by solving the "visual acuity" problem. Think of it as an opportunity to create something better. Personally I think shared secret with physical device has longer legs here but it does have a distribution/cost/re-authentication hump that is large. So far that has prevented its adoption but as you can see capt…

I'd be curious to see the ability for a machine to solve picture based captcha systems. For example, given a lineup of 10 pictures of pets, choose the three that are cats. I've seen them before, just not widely implemented.

Even just randomly picking 3 images will be successful about 1% of the time which is more than enough for a bot.

Re: Captchas Are Becoming Ridiculous

#77

Post by Devilboy »

jvrossb wrote: post #33
Kilimanjaro wrote: post #22

Earlier quoted context omitted.

Bots would spam your site once every 26 tries.

I was going to say don't most modern sites limit multiple attempts in succession? Then I realized that spammers have thousands of computers at their disposal so the successive attempts would not come from the same IP. Shoot this is a hard problem...

Spammers have thousands of machines.

Re: Captchas Are Becoming Ridiculous

#79

Post by csense »

mmuro wrote: post #65
huhtenberg wrote: post #45

Earlier quoted context omitted.

Do give an example.

http://textcaptcha.com/demo

Seems like it would be fairly easy to parse many of these questions automatically. The only reason they work is probably that they're not widely used enough for spammers to care about.

Re: Captchas Are Becoming Ridiculous

#80

Post by wcoenen »

dereferenced2 wrote: post #56
freditup wrote: post #43

I feel like the author of this article is still slightly misunderstanding the reCaptcha. Not to criticize him, but it's almost immediately clear which word you are actually being tested on, because it's has the same general 'look' to it each time. Take the first one: 'Secretary' is clearly out of some book. The other thing is the real test. Now, reCaptcha never gives you real words as a test, so he shouldn't be surpr…

The author's blog post is retarded; "herp derp I don't know how recaptcha works and it's too hard for me." He has a pretty blog and a green name on HN, so everyone upvotes it. Pretty sad IMO.

Green names mean the opposite of what you think they mean. It's for accounts which are less than 5 days old.
Post reply on HN