What's up, bot? Google tries new Captcha method • Hacker News Board

Re: What's up, bot? Google tries new Captcha method

#21

Post by amix » Sat, Apr 18, 2009, 9:33 PM UTC

henning wrote: post #11

amix wrote: post #7

I have implemented something similar called "Visual captcha", where the user has to pick the cat out from 6 randomized Flickr pictures. The code is freely available and should not be hard to integrate into your own projects. Read more on: http://amix.dk/blog/viewEntry/19338

Is that really effective? Just take some face detection code and have it learn what cat fur looks like instead.

It's ok effective judging by my usages and I could just iterate over this solution if someone brute forced it or implemented a "cat fur detector" (which for my uses is pretty unrealistic).

Battling spammers is really a battle where you implement better protections and they implement better attacks. The conclusion so far has been that it isn't possible to check-mate them - - and it's very unlikely it will ever happen as a lot of spammers use "human bots"...

Using visual captcha is much more user friendly thought, so it's a win for the users.

Re: What's up, bot? Google tries new Captcha method

#22

Post by DenisM » Sat, Apr 18, 2009, 9:35 PM UTC

rarestnews wrote: post #9

omarchowdhury wrote: post #5

A lot of spam operations use humans to solve captchas, so this isn't much of a change for them (actually could make it easier for them).

Also it's sometimes used as porn-bait (i.e. enter captcha to enter the "free" site). Human solving is pretty cheap too. I've heard quotes about $2 for 1000 captchas. I guess with 1 click instead of 5-7 letters + enter - it's going to be cents per thousand soon enough, cause you don't even need to know keyboard well or type fast enough. So, I'd say that might be a step backwards.

I've heard this pron meme before, but didn't see any actual proof. Do you have sources?

Re: What's up, bot? Google tries new Captcha method

#23

Post by rarestnews » Sat, Apr 18, 2009, 10:12 PM UTC

DenisM wrote: post #22

rarestnews wrote: post #9

Earlier quoted context omitted.

Also it's sometimes used as porn-bait (i.e. enter captcha to enter the "free" site). Human solving is pretty cheap too. I've heard quotes about $2 for 1000 captchas. I guess with 1 click instead of 5-7 letters + enter - it's going to be cents per thousand soon enough, cause you don't even need to know keyboard well or type fast enough. So, I'd say that might be a step backwards.

I've heard this pron meme before, but didn't see any actual proof. Do you have sources?

You can't be that lazy :)

http://google.com/search?q=porn+captcha http://news.bbc.co.uk/2/hi/technology/7067962.stm http://www.concurringopinions.com/archives/2007/10/creative_... (note the quoted part from article) and probably a thousand others

Also I personally did stumble to Google's captcha in quite a few sites (borderline porn) posing it as their own for registration purposes (sometimes monochromed though). Google has easily recognizable captcha.

Re: What's up, bot? Google tries new Captcha method

#24

Post by rarestnews » Sat, Apr 18, 2009, 10:20 PM UTC

snprbob86 wrote: post #18

pavel_lishin wrote: post #15

I think one fascinating aspect of this whole thing is that by creating tougher and tougher captchas, Google and the like are actually helping make great strides in the field of image recognition by forcing spammers to adapt.

The truth of the whole thing is that Google primarily relies on _behavior_ to detect bots. Captures are just an added layer of defense and serve as a pretty good way of seeding the behavior database. If some user appears to be a bot, serve them a captcha. If they fail, then that behavior was bot-like. Google is using captchas as a way to learn image recognition as well as bot behavior patterns. They know full well th…

Actually I'm really tired of that Google's attempts. The other day I tried to find a something like a .txt file containing all the verbs. I tired searching for "finding resting searching" without quotes, Google kept giving me "find rest search", so I tried quoting it: " "finding" "resting" "searching" ", and adding more and more. Most of those were in anchors, not in text, I added: "allintext:"finding" ..." and here it is: "Looks like you are a bot! I can't allow you search for that." :)

Sometimes it's really tempting to write "Google" into Google. :)

Re: What's up, bot? Google tries new Captcha method

#25

Post by Goladus » Sat, Apr 18, 2009, 11:57 PM UTC

vaksel wrote: post #10

can't someone figure out an anti-spam method that doesn't require a captcha? I mean its not like captchas even work, I'm yet to see one that works 100%

The best you'll ever get is human to human contact.

But that doesn't scale cheaply.

Re: What's up, bot? Google tries new Captcha method

#26

Post by DenisM » Sun, Apr 19, 2009, 12:02 AM UTC

rarestnews wrote: post #23

DenisM wrote: post #22

Earlier quoted context omitted.

I've heard this pron meme before, but didn't see any actual proof. Do you have sources?

You can't be that lazy :) http://google.com/search?q=porn+captcha http://news.bbc.co.uk/2/hi/technology/7067962.stm http://www.concurringopinions.com/archives/2007/10/creative_... (note the quoted part from article) and probably a thousand others Also I personally did stumble to Google's captcha in quite a few sites (borderline porn) posing it as their own for registration purposes (sometimes monochromed though). Goo…

A few years back (probably in 2006 or 2007) I talked to a bunch of researches who were working on image recongition and they told me they searched high and low for any proof of this and didn't find it. So I have had a cached opinion since then until about 5 minutes ago. :-)

Re: What's up, bot? Google tries new Captcha method

#27

Post by tlrobinson » Sun, Apr 19, 2009, 1:30 AM UTC

pavel_lishin wrote: post #16

ctingom wrote: post #4

Earlier quoted context omitted.

Wow, I could barely make out the audio captcha!

But you could still make it out, right?

I certainly couldn't. Perhaps they rely on blind people having heightened auditory senses.

Re: What's up, bot? Google tries new Captcha method

#28

Post by whughes » Sun, Apr 19, 2009, 2:13 AM UTC

amix wrote: post #7

I have implemented something similar called "Visual captcha", where the user has to pick the cat out from 6 randomized Flickr pictures. The code is freely available and should not be hard to integrate into your own projects. Read more on: http://amix.dk/blog/viewEntry/19338

What is to stop a bot from just clicking randomly? A 1/6 chance of registering an account is good enough for botting purposes. That's the problem with these multiple-choice solutions. They simply aren't strong enough protection against a flood of tries.

Re: What's up, bot? Google tries new Captcha method

#29

Post by shader » Sun, Apr 19, 2009, 2:20 AM UTC

Goladus wrote: post #25

vaksel wrote: post #10

can't someone figure out an anti-spam method that doesn't require a captcha? I mean its not like captchas even work, I'm yet to see one that works 100%

The best you'll ever get is human to human contact. But that doesn't scale cheaply.

And there is the essence of the need for captchas ;)

You need to scale, so you employ computers instead of people. Now you have to have computers run a reverse turing test. Otherwise, it's much easier for spammers to scale as well.

It's easy to cut down on spam if you don't accept any incoming mail.

Re: What's up, bot? Google tries new Captcha method

#30

Post by nebula » Sun, Apr 19, 2009, 3:06 AM UTC

rarestnews wrote: post #24

snprbob86 wrote: post #18

Earlier quoted context omitted.

The truth of the whole thing is that Google primarily relies on _behavior_ to detect bots. Captures are just an added layer of defense and serve as a pretty good way of seeding the behavior database. If some user appears to be a bot, serve them a captcha. If they fail, then that behavior was bot-like. Google is using captchas as a way to learn image recognition as well as bot behavior patterns. They know full well th…

Actually I'm really tired of that Google's attempts. The other day I tried to find a something like a .txt file containing all the verbs. I tired searching for "finding resting searching" without quotes, Google kept giving me "find rest search", so I tried quoting it: " "finding" "resting" "searching" ", and adding more and more. Most of those were in anchors, not in text, I added: "allintext:"finding" ..." and here…

Dear God, what's wrong with a query like 'allintext:"finding"' ? I got curious and tried just this query, and sure enough Google said that the query looks like an automated one. It means it's not the pattern of the queries that you have sent that triggered this 'you are a bot' response from Google. It's just the one query allintext:"finding". Removing quotes allowed it to be processed.

I thought it might have to do with the fact that a single word is enclosed in quotes; i.e., when a person is searching generally there is no reason why one would put a single word in quotes. On the other hand an automated search might enclose search text in quotes by default without parsing the text and figuring out whether it contains multiple words or a single word. But it turns out that is not the reason. A query like allintext:"Google sucks" still elicits the 'you are a bot response'. It looks like they ban all queries that enclose text in quotes for an allintext. Might be a bug.