Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Breaking the 4Chan CAPTCHA

nullpt.rs

Post reply on HN
Print view View original

151–160 of 378 posts

Re: Breaking the 4Chan CAPTCHA

#151

Post by zoltrix303 »

wraptile wrote: post #135
somat wrote: post #130

I wonder if it would be better to pretend to have a captcha but really you are analysing the user timing and actions. Honestly I half suspect this is already going on. If you wanted to go full meta "never go full meta" you would train a AI to figure out if the agent on the other side was human or not. that is, invent the reverse turing test. it's a human if the ai is unable to differentiate it's responses from normal…

That's kinda what every major captcha distributor does already! Even before captcha is being served your TLS is first fingerprinted, then your IP, then your HTTP2, then your request, then your javascript environment (including font and image rendering capabilities) and browser itself. These are used to calculate a trust score which determines whether captcha will be served at all. Only then it makes sense to analyze…

Would it be possible to serve a fake fingerprint that appears legitimate? Or even better mimic the finger print of real users who've visited a site you own for example?

Re: Breaking the 4Chan CAPTCHA

#152

Post by nullpt_rs »

zoltrix303 wrote: post #151
wraptile wrote: post #135

Earlier quoted context omitted.

That's kinda what every major captcha distributor does already! Even before captcha is being served your TLS is first fingerprinted, then your IP, then your HTTP2, then your request, then your javascript environment (including font and image rendering capabilities) and browser itself. These are used to calculate a trust score which determines whether captcha will be served at all. Only then it makes sense to analyze…

Would it be possible to serve a fake fingerprint that appears legitimate? Or even better mimic the finger print of real users who've visited a site you own for example?

yep, but it can get tricky.

some projects worth checking out: https://github.com/refraction-networking/utls https://github.com/berstend/puppeteer-extra

Re: Breaking the 4Chan CAPTCHA

#153

Post by __turbobrew__ »

morkalork wrote: post #121
kattagarian wrote: post #120

I remember trying to use 4chan once and i couldn't even pass through the captcha.

I remember using it before it had a captcha

I tried to post and it gave me a 900 second cooldown, not even on vpn. I too remember the good old days when there was no capcha.

Re: Breaking the 4Chan CAPTCHA

#154

Post by normie3000 »

blackjackfoe wrote: post #46
normie3000 wrote: post #45

Earlier quoted context omitted.

How did this project help you to learn computer vision? I'd also like to write a basic captcha solver as an intro, but superficially this project just looks like a dump of generated code.

What do you mean by "generated code"? All of the code in the linked GitHub repo was written by me, with the assistance of a couple friends who helped here and there, but didn't request to be credited. I learned a lot because I had to do a ton of research and experimentation (fancy word for trial-and-error) to write the code and have it work as I expected.

I think there's been a misunderstanding. I didn't understand you were the author of the linked article, and read the following exchange to mean you'd found the code at https://github.com/drunohazarb/4chan-captcha-solver to be a helpful introduction:

> > I've built 3 iterations of captcha solvers for that crappy website based on https://github.com/drunohazarb/4chan-captcha-solver/issues/1

> This project was really my first decent introduction to computer vision and machine learning

I see now that your code is linked from the article, and looks really informative - thanks for sharing!

Re: Breaking the 4Chan CAPTCHA

#155

Post by normie3000 »

throwaway314155 wrote: post #119
normie3000 wrote: post #45

Earlier quoted context omitted.

How did this project help you to learn computer vision? I'd also like to write a basic captcha solver as an intro, but superficially this project just looks like a dump of generated code.

[flagged]

I'm not sure this is helpful - please see my other reply.

From https://news.ycombinator.com/newsguidelines.html

> Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith.

Re: Breaking the 4Chan CAPTCHA

#156

Post by numpad0 »

jabroni_salad wrote: post #138
gruez wrote: post #33

Earlier quoted context omitted.

What about users behind CGNAT, like mobile users?

I'm pretty sure all of t-mobile is rangebanned. Phoneposters are usually told to buy a pass.

That sounds old 2ch.net. Was that plan from Hiroyuki, by chance? IIRC they entrusted the key to kingdom to that guy, or am I mistaken...

Re: Breaking the 4Chan CAPTCHA

#157

Post by NoMoreNicksLeft »

blackjackfoe wrote: post #147
NoMoreNicksLeft wrote: post #144

I suspect really strongly that the available characters in the 4chan captcha were chose to be able to spell out the most racist/nazi/extreme slurs and slogans imaginable. For instance, not all numerals are ever used, but 1, 4, and 8 are. K is often there, and whatever the algo is, pseudorandom or not, it often doubles/triples characters. I've personally seen "kkk" twice over the years. Mind you, it does seem random.…

All the worst slurs I can think of in my limited vocabulary can't even be spelled with the characters available. I suspect the opposite - they might have been chosen to avoid spelling things like that.

You either know some radioactively hot slurs, or you've just not hung out there enough. Only the "i" is missing, and a week doesn't go by that someone doesn't post it with the 1 instead. Granted, I think that one's a repost (never bothered to try to check).

Re: Breaking the 4Chan CAPTCHA

#159

Post by Philpax »

shortrounddev2 wrote: post #65
OmarShehata wrote: post #20

Earlier quoted context omitted.

captchas are broken, forever. There is no way to prevent bots without also preventing a bottom tier of human users (visually impaired people, old people, or just impatient people). Like this xkcd [1] comic suggests, we need to just focus on rewarding and punishing specific behavior, regardless of whether the agent is human or not [1] https://xkcd.com/810/

Jokes aside, we don't want any bots at all. Even if they're posting constructive comments, we should interact with humans, not machines

In the interest of provoking discussion: why?

If a bot can meaningfully pass and act as a productive member of the community, what does it matter?

Re: Breaking the 4Chan CAPTCHA

#160

Post by bdjsiqoocwk »

jabroni_salad wrote: post #136
brian-armstrong wrote: post #128

Earlier quoted context omitted.

Makes me wonder what comes next. Could we create a forum where every member must do a 15 minute video interview with a moderator? I know this "doesn't scale" but I think it could make for a funny gimmick.

private torrent trackers are/were doing that. It was really just to make sure you understood how p2p culture works and what the expectations are, and really easy to pass if you just followed a guide. However, I did see many people fail their interview.

[dead]
Post reply on HN