Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA” • Hacker News Board

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#331

Post by ademarre » Wed, Dec 03, 2014, 9:39 PM UTC

logn wrote: post #312

ademarre wrote: post #277

Earlier quoted context omitted.

> Automated and instant CAPTCHA image solving How do they do that? This sounds like whitehat use of blackhat tools. Are they using captcha-solving farms?

They send the captcha to their servers and how they solve them is a secret. http://www.webvisum.com/en/main/faq#q15

The fact that this works shows that distorted-text captchas are no longer effective.

From the Google's blog post:

> our research recently showed that today’s Artificial Intelligence technology can solve even the most difficult variant of distorted text at 99.8% accuracy

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#332

Post by tracker1 » Wed, Dec 03, 2014, 9:48 PM UTC

fragmede wrote: post #297

nathas wrote: post #174

Earlier quoted context omitted.

"I have JS and cookies disabled" So imagine what bots often don't have. Adding JS interaction and cookies takes more effort on the part of the programmer writing a bot. So yeah, you'd look a lot more like a robot. How else would you quickly differentiate between human vs non-human based on a single request, or even a collection of requests over time? It's a game of stats at scale.

Here's a snippet of Python using the splinter library, to visit Google, type in a search query, and click 'search' (which is very Javascript heavy these days with their annoying 'instant' search). from splinter import Browser b = Browser() b.visit(' http://google.com' ) b.fill('q', 'browser automation') btn = b.find_by_name('btnG') btn.click() Not exactly 'more effort'...

Yeah, but if you are trying to automate thousands of simultaneous requests, you'll have to use a lot of servers, which is costly even in the cloud.

Right now google and bing will run sites with JS enabled to see the DOM after any JS changes take hold. Usually these crawls aren't nearly as often as the general crawling, because there is quite a lot more CPU/Memory overhead to such utilities. I can't speak for splinter, but similar tools in node or phantomjs have a lot over overhead to them.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#333

Post by Malstrond » Wed, Dec 03, 2014, 9:53 PM UTC

So we're actually training users to behave like what Google's behaviour model assumes to be the behaviour of humas. Because then they won't get annoying captchas.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#334

Post by xxs » Wed, Dec 03, 2014, 9:54 PM UTC

Houshalter wrote: post #200

joeframbach wrote: post #198

Earlier quoted context omitted.

Can you suggest a way to tell the difference between you and a bot? Merely throwing flags around without offering anything better isn't very helpful.

There isn't a way. As AI improves bots become increasingly indistinguishable from humans. All this does is rely on the fact that bots tend to use different browsers and behave in different ways than humans. But that can be fixed. But it doesn't matter. If a human user spams tons of links in the comments after creating 20+ accounts, who cares if they are a bot or are doing it manually? I believe that websites should i…

"bot" means no profit from ads. There you have it.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#335

Post by walterbell » Wed, Dec 03, 2014, 9:54 PM UTC

logn wrote: post #312

ademarre wrote: post #277

Earlier quoted context omitted.

> Automated and instant CAPTCHA image solving How do they do that? This sounds like whitehat use of blackhat tools. Are they using captcha-solving farms?

They send the captcha to their servers and how they solve them is a secret. http://www.webvisum.com/en/main/faq#q15

Is there a web service where one could purchase AI recognition of fuzzy text, e.g. a street sign or book cover in a photo?

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#336

Post by fooqux » Wed, Dec 03, 2014, 9:56 PM UTC

nojvek wrote: post #326

Computer Vision guy here. Okay so you've made some improvements for normal users. The captchas are still the old same, just not shown everytime. Still can be cracked with latest neural net techniques. The visual matching stuff can be guessed 6/10 times. You still have audio captchas, that can be cracked. If all fails you still have cheap labour from third world country. I don't see why this is revolutionary? Google w…

Even if the success rate of detecting robots stays the same, I would say this is still a win because the majority of humans won't have to mess with it any longer.

Even better: those with various disabilities won't have to mess with it. My parents' only disability that I know of is near-complete computer illiteracy and I can tell you from experience that every time they're presented with a normal CAPTCHA it's like somebody just handed them a Rubik's Cube and told them to solve it before they can create a profile. In every case I know of, they just turn the computer off and walk away. Now, these are what I would call normal humans (don't tell them I ever said that) so I can only imagine how aggravated those with visual and/or auditory problems get when presented with a crazy CAPTCHA. And when your revenue comes from getting people to submit these, I can see it still being a boon to the website, even if all they did was lower the barrier of entry for humans.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#337

Post by tracker1 » Wed, Dec 03, 2014, 9:59 PM UTC

the_af wrote: post #313

roc wrote: post #244

Earlier quoted context omitted.

Though you were joking, it's worth noting they're certainly not discriminating against robots. They're discriminating against your robots. Which is to say: they're perfectly willing to let your crawl-able content and internet use help train their robots, they just don't want their crawl-able content and internet use to train your robots.

Aren't we talking about spambots, mostly? While law-abiding bots should probably be allowed in most sites, nobody wants a spambot in their blog or forum. Isn't it right to block spambots? And if so, how do you tell regular bots from spambots?

Use re-captcha to prevent the spam-bots from posting... the real bots will just crawl anyway.

A couple months ago, I implemented some regular expressions to try and block a lot of bad actors, and have that include smaller search engines... our analytics traffic dropped around 5% the next week... our actual load on the servers dropped almost 40% though. Unfortunately it was decided the 5% hit wasn't worth reducing the load 40%.

Which sucks, moving forward a lot of output caching will be used more heavily with JS enhancements for logged in users on top of the nearly identical output rendering.

Server-side React with some useragent sniffing will break out three rendering server side. "xs" for those devices that are "mobile" (phones), "sm" for other tablet/mobile devices ("android", "ios", etc), and otherwise "md" ... "lg" will only bump up on the client-side from "md". It corresponds to the bootstrap size breaks.

In essence, I don't care. Bots get the same as everyone else.. if you don't have JS, you can't login or fill out forms. Recaptcha should go a step farther in helping deal with bots...

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#338

Post by tracker1 » Wed, Dec 03, 2014, 10:04 PM UTC

_lce0 wrote: post #162

cJ0th wrote: post #94

It says that they do take mouse movement into account but the cookie part makes me feel a little uneasy: > IP addresses and cookies provide evidence that the user is the same friendly human Google remembers from elsewhere on the Web. If this becomes a trend then major commercial websites will become unusable for people who are not accepting (third-party) cookies. "Because those damn bots" is a straw man argument to m…

I'm using a tablet device, thus no mouse, and it gives me a captcha whenever I'm not logged in.. Really is this the breakthrough of bot detection? They are just leveraging cookies --which is nice improv UX-- but why do I need to click? delay loading to relax servers?

Well, it's probably that most sites you get a captcha on, give one to everyone... this will only reduce that for real users.

On the flip side, there are other events to hook into... onfocus/onblur, keydown, etc, etc... which can all go into bot detection... if you fill out a form and didn't focus on anything, click on anything, or press any keys.. you're probably a bot... If you have JS disabled, you deserve what you get.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#339

Post by rudolf0 » Wed, Dec 03, 2014, 10:05 PM UTC

Aissen wrote: post #82

So now spammers will use botnets… Oh wait, they already do. They already have the botnets. Now they need to use those end-user machines as proxies, using the credentials already on the machine. They just need to figure out the other parameters: maybe it's running js code ? Then you can use a browser engine/selenium). Maybe it's the click pattern ? Just generate the json data and send it. They can even apply the same…

Yeah, I feel like it won't be too long before spammers start finding ways to emulate users without having to solve any CAPTCHAs. Google is likely going to need to switch their 98%/2% to something more like 80%/20% (that is, 20% of users will still need to enter CAPTCHAs).

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#340

Post by tracker1 » Wed, Dec 03, 2014, 10:07 PM UTC

chuckcode wrote: post #250

throwaway234 wrote: post #235

Earlier quoted context omitted.

Every "free" service from Google has the end goal of serving you personalized ads. That's their business.

Certainly correct. I guess it is new for me that I'm requiring my users to give their data so they can be served personalized ads.

And there are a number of sites using Analytics, Adwords/Adsense, DFP and a number of other points of connection. They've already offered/bought recaptcha, all this does is make it easier for most people (who have cookies and JS enabled).