Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Captchas Are Becoming Ridiculous

blog.andrewmunsell.com

Post reply on HN
Print view View original

171–180 of 238 posts

Re: Captchas Are Becoming Ridiculous

#171

Post by bnr »

hk__2 wrote: post #106
tjpaxton wrote: post #50

Earlier quoted context omitted.

Take a look at our product at areyouahuman.com We launched in January and are using games to make them easier for people. Some of our early testing showed captchas can decrease signups by up to 25% and we're able to recover almost all of that. We also monitor how you play the game (like mouse movement) so we can ramp up our security without having to make the task more difficult for people. Read more here http://arey…

This is so stupid. Your CAPTCHA is unusable by blind people, and your audio CAPTCHA is inaccessible (you have to see the element to know where to click to access to the audio CAPTCHA). Do you consider that blind people are bots?

Look at the "download MP3" link's URL, the audio captcha comes from google.com/recaptcha.

I agree that the button itself should be easier to discover for blind people, like an image link with a title tag.

Re: Captchas Are Becoming Ridiculous

#172

Post by iaskwhy »

anonymous wrote: post #93

He seems a bit ignorant on how reCaptcha works nowadays. You are presented with two strings - a potential word scanned from a book and a random mash of letters. You only need to enter the random letters correctly, you can write whatever you want for the word from the book. Meaning, if one of the two is obviously a bug in OCR software (or is non-latin characters you can't type), just write your favourite curse word --…

From the article: "t’s important to note the way reCAPTCHA works. Each user (or bot) is presented with a control word, and a word unrecognized by OCR. This control word is already known to Google (who runs reCAPTCHA). If you get this first word right, it is assumed that you get the second word correct as well. So, in reality, you only need to guess the key word correctly.

I decided to just guess the first word and hope “secretary” was the control. It wasn’t."

How is that being ignorant?

Re: Captchas Are Becoming Ridiculous

#173

Post by 0x09 »

anonymous wrote: post #93

He seems a bit ignorant on how reCaptcha works nowadays. You are presented with two strings - a potential word scanned from a book and a random mash of letters. You only need to enter the random letters correctly, you can write whatever you want for the word from the book. Meaning, if one of the two is obviously a bug in OCR software (or is non-latin characters you can't type), just write your favourite curse word --…

> If you must use reCaptcha on your website, do it like 4chan

This is not how Yotsuba's captcha works. If you screw up, you're still taken to the post submitted page, with the error "You seem to have mistyped the CAPTCHA. Please try again." and you must return to the page you tried to post from. What you're talking about is a feature of 4chan X.

Re: Captchas Are Becoming Ridiculous

#174

Post by morsch »

raverbashing wrote: post #133
Jach wrote: post #124

Earlier quoted context omitted.

Oh, you mean just for that IP? Torify. Cookies? Bots don't need to accept them. Do you have something better?

Having to wait 1s between attempts (per user) could be enough to prevent brute force attacks Of course, if one ip is making too many requests, it gets blocked or captchaed

That prevents brute force attacks against one specific account, but not against an attack against all users of a site. If you have the capability to make, say, 10k login attempts per second (no idea if that's realistic), you don't slow down to 1 attempt/second, you just attack 10k different accounts once every second.

IP blocks can be countered in other ways (botnets, tor, etc).

I'm not saying it's a bad idea though, there doesn't seem to be any downside apart from the book-keeping required. You could probably start with a higher delay (5 to 10 seconds seems very reasonable) and increase it to several minutes. But please don't make it 24 hours after 3 failed attempts, which happened to me when I tried to order train tickets online and forced me to make a trip to a physical ticket vending machine.

Re: Captchas Are Becoming Ridiculous

#175

Post by geon »

tjpaxton wrote: post #73
bhickey wrote: post #67

Earlier quoted context omitted.

Do you have any response to claims that your product is easily broken? http://news.ycombinator.com/item?id=4025791 I'm skeptical of your efforts to distinguish humans from bots by mouse movements and other inputs. Anything you can infer can be modeled. It's unreasonable to expect a smart captcha cracker to resemble a zero reaction time Counter Strike aimbot.

Thanks for asking. First, our main focus is on making something more usable for people. We also think captchas are only part of the solution and should be employed with other things (rate limiting, keyword filtering, etc) That being said, we don't just ignore security. There are a lot of captcha alternatives out there that survive on just obscurity, if they were widely adopted, they wouldn't take much to get around (…

> our main focus is on making something more usable for people

Considering that your games can be played by a random number generator with something like 10% success rate, you can just skip the captcha completely. Much more user friendly.

The other things you look at to increase security, like detecting patterns and behaviors that indicates bots can be done without a captcha.

Re: Captchas Are Becoming Ridiculous

#177

Post by morsch »

adrianN wrote: post #96
andrewfelix wrote: post #69

Earlier quoted context omitted.

Why not pose questions with answers that are obvious to humans but difficult for ai. Eg. 'What's 4 times four?' or 'How many times does the word four appear within this sentence?'

Natural Language Processing has become better in recent years. > http://www.wolframalpha.com/input/?i=what%27s+4+times+four

I'm not sure you'd want to involve NLP. I think it's more down to the fact that it's relatively easy to reverse engineer the function generating the question and get the parameters that way.

Wolfram Alpha won't answer very many questions of that sort[0] but a cracker can spent a couple of hourse to enumerate all kinds of questions and writing tailored functions (and a detection routine) for each. If your detection routine is naive (e.g. choose randomly) and some or all of your answering functions work badly, no problem, you only have to get it right occasionally anyway.

[0] And indeed it fails unsurprisingly if comically for the second question How many times does the word four appear within this sentence?, trimming it to How many times and showing details about the British newspaper.

Re: Captchas Are Becoming Ridiculous

#178

Post by morsch »

iaskwhy wrote: post #172
anonymous wrote: post #93

He seems a bit ignorant on how reCaptcha works nowadays. You are presented with two strings - a potential word scanned from a book and a random mash of letters. You only need to enter the random letters correctly, you can write whatever you want for the word from the book. Meaning, if one of the two is obviously a bug in OCR software (or is non-latin characters you can't type), just write your favourite curse word --…

From the article: "t’s important to note the way reCAPTCHA works. Each user (or bot) is presented with a control word, and a word unrecognized by OCR. This control word is already known to Google (who runs reCAPTCHA). If you get this first word right, it is assumed that you get the second word correct as well. So, in reality, you only need to guess the key word correctly. I decided to just guess the first word and ho…

It's ignorant because he then goes on to refresh recaptchas that are "impossible" to solve where the OCR word was gibberish (cut-off, etc.) but the key word was discernible.

Re: Captchas Are Becoming Ridiculous

#179

Post by emiliobumachar »

dchichkov wrote: post #102
rorrr wrote: post #51

I see two possible long-term solutions to the captcha problem 1) Ask user to do a relatively expensive computation. This can be done in the background while the user is typing his post. 2) Request a small amount of money (10c) per comment. Good websites will return the money to non-spam commenters, will keep spammer's money. This however requires working microtransactions.

1) Asking a computer to do a computation is not such a great idea. Low powered devices (think iPads) running javascript would be at a great disadvantage to highly efficient botnet clusters that spammers own. 2) Requesting a small amount of money may work. Alternatively requesting a user to do some useful task (like Amazon Turk HIT) to get some funds.

Some computations just cannot be parallelized. (Yet. I'd be ironic if spammers advanced the field of parallel computing) The speed difference for single processors remain, but that's a single order of magnitude, except in extreme cases.

Re: Captchas Are Becoming Ridiculous

#180

Post by sams99 »

Many months into this experiment I barely get 2 spam comments a month on my blog, I totally respect reCAPTCHA, but demanding JavaScript, doing some minimal tests and perhaps an amount of computation (1 sec on iPad) is the FIRST thing we should be doing http://samsaffron.com/archive/2011/10/04/Spam+bacon+sausage+...
Post reply on HN