Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Breaking the 4Chan CAPTCHA

nullpt.rs

Post reply on HN
Print view View original

161–170 of 378 posts

Re: Breaking the 4Chan CAPTCHA

#161

Post by skotobaza »

joe-collins wrote: post #102
alekratz wrote: post #57

Earlier quoted context omitted.

one of the biggest problems that 4chan has to combat is spam. unfortunately, at 4chan's scale, hcaptcha and recaptcha are not free. 4chan is not exactly a font of money, either. the only reason they turned to this awful homebrew captcha was because recaptcha stopped being free. is there any better way to do it with a single developer for a website that serves millions of people a day?

Not the rampant racism or sexism or simple misanthropy or outright calls to violence or overflowing hostility. It's the spam that tops the problem list.

That's the price you pay for ability to freely and anonymously voice different opinions. And even then 4chan is considered "soft", because mods still delete some egregiously "incorrect" opinions.

Re: Breaking the 4Chan CAPTCHA

#163

Post by YeahThisIsMe »

antirez wrote: post #13

Appropriate response by 4Chan to this: simplify the human work given that anyway it's simple to solve via NNs. We are at a point where designing very hard captchas has high probabilities to increase the human annoyance without decreasing the machine solvability.

We've been stuck at that point for at least 5, if not 10, years.

Re: Breaking the 4Chan CAPTCHA

#164

Post by winrid »

Dachande663 wrote: post #162

Semi-related but I needed a CAPTCHA on my site[0] mainly to block comment form spam and settled on repurposing a fun method I’d seen before. Is definitely not foolproof (or hard at all), but I really liked making it. [0] https://www.hybridlogic.co.uk/contact

It says I've been blocked when I try to view that. Not on a VPN.

Re: Breaking the 4Chan CAPTCHA

#165

Post by jcpham2 »

ranger_danger wrote: post #76
codetrotter wrote: post #55

Earlier quoted context omitted.

> simplify the human work given that anyway it's simple to solve via NNs. We are at a point where designing very hard captchas has high probabilities to increase the human annoyance without decreasing the machine solvability Or disallow free users to post at all, and require everyone to buy the 4chan Pass for $20 USD per year if they want to post. https://4chan.org/pass This is already available to not have CAPTCHA.…

Agreed, charging for accounts is the only halfway viable solution I have seen any service use that gives a sizable downtick in the sheer number of bots/spam. Of course it's not perfect, and it will still happen, but I have yet to hear any better solutions. Please prove me wrong though!

This is known as a Sybil [1] attack and it lays the groundwork for stuff like Adam Backs hashcash [2] protocol and it’s basically why things like proof of work [3] have a monetary value today.

Very chicken and egg this entire field- defending against the spammers while simultaneously operating a “free” system. How to do it without making it prohibitively expensive to join the system…

Any free system will be abused yada yada yada

[1] https://en.wikipedia.org/wiki/Sybil_attack

[2] https://en.wikipedia.org/wiki/Hashcash

[3] https://en.wikipedia.org/wiki/Proof_of_work

Re: Breaking the 4Chan CAPTCHA

#166

Post by encom »

wraptile wrote: post #135
somat wrote: post #130

I wonder if it would be better to pretend to have a captcha but really you are analysing the user timing and actions. Honestly I half suspect this is already going on. If you wanted to go full meta "never go full meta" you would train a AI to figure out if the agent on the other side was human or not. that is, invent the reverse turing test. it's a human if the ai is unable to differentiate it's responses from normal…

That's kinda what every major captcha distributor does already! Even before captcha is being served your TLS is first fingerprinted, then your IP, then your HTTP2, then your request, then your javascript environment (including font and image rendering capabilities) and browser itself. These are used to calculate a trust score which determines whether captcha will be served at all. Only then it makes sense to analyze…

This is how ClownFlare and its ilk, make life hell on the internet, when you use a "weird" browser on a "weird" OS.

Re: Breaking the 4Chan CAPTCHA

#167

Post by encom »

antirez wrote: post #13

Appropriate response by 4Chan to this: simplify the human work given that anyway it's simple to solve via NNs. We are at a point where designing very hard captchas has high probabilities to increase the human annoyance without decreasing the machine solvability.

4chan doesn't care about human annoyance. They just started doing a 15 minute post delay, which is infuriating. I had to whitelist 4chan in Cookie AutoDelete.

Re: Breaking the 4Chan CAPTCHA

#168

Post by PUSH_AX »

wraptile wrote: post #135
somat wrote: post #130

I wonder if it would be better to pretend to have a captcha but really you are analysing the user timing and actions. Honestly I half suspect this is already going on. If you wanted to go full meta "never go full meta" you would train a AI to figure out if the agent on the other side was human or not. that is, invent the reverse turing test. it's a human if the ai is unable to differentiate it's responses from normal…

That's kinda what every major captcha distributor does already! Even before captcha is being served your TLS is first fingerprinted, then your IP, then your HTTP2, then your request, then your javascript environment (including font and image rendering capabilities) and browser itself. These are used to calculate a trust score which determines whether captcha will be served at all. Only then it makes sense to analyze…

In that case why do I ever receive a captcha?

Re: Breaking the 4Chan CAPTCHA

#169

Post by jeroenhd »

encom wrote: post #166
wraptile wrote: post #135

Earlier quoted context omitted.

That's kinda what every major captcha distributor does already! Even before captcha is being served your TLS is first fingerprinted, then your IP, then your HTTP2, then your request, then your javascript environment (including font and image rendering capabilities) and browser itself. These are used to calculate a trust score which determines whether captcha will be served at all. Only then it makes sense to analyze…

This is how ClownFlare and its ilk, make life hell on the internet, when you use a "weird" browser on a "weird" OS.

My experience is that IP reputation does a lot more for Cloudflare than browsers ever did. I tried to see if they'd block me for using Ladybird and Servo, two unfinished browsers (Ladybird used to even have its own TLS stack), but I passed just fine. Public WiFi in restaurants and shared train WiFi often gets me jumping through hoops even in normal Firefox, though.

I can't imagine what the internet must be like if you're still on CG-NAT, sharing an IP address with bots and spammers and people using those "free VPN" extensions donating their bandwidth to botnets.

Re: Breaking the 4Chan CAPTCHA

#170

Post by supriyo-biswas »

TravisPeacock wrote: post #134
andrewflnr wrote: post #123

Earlier quoted context omitted.

How many people are there like that, and how much damage are they collectively likely to do? If you're a random spammer, how hard will it be to hire that person? Again, not aiming for impossibility, just reducing the damage.

I've been working for myself for over a decade doing random projects for clients while also doing my own thing. My resume looks awful and the job market is trash. If be willing to take a job as a jr developer and work my way up (or a sys admin). I used to run one of the world's largest ebook piracy websites but want to put that life behind me. Recently work came across my desk to create tens of thousands of accounts…

If I were you, I'd probably try looking at companies working in the web scraping and reverse engineering fields, who might even appreciate the skills even if they were acquired in a, let's just say, "different" way.
Post reply on HN