Google's Street View computer vision can beat reCAPTCHA with 99% accuracy

Your underlying hypothesis here is that phone numbers are hard to get. But Twilio only charges $1/month per number, and presumably gets them for a lot less than that. If you use them for multiple nefarious purposes at once, your cost-per-evil could be pretty low.

And that's assuming that you just don't steal them outright. Suppose you boost somebody's Android game, repackage it, and add a little code that intercepts and replies to certain text messages. It'd basically be a SMS botnet.

SMS verification would make certain kinds of casual abuse harder, but I don't think it'd be a big barrier for well-organized assholes. E.g., the "Rachel from Cardholder Services" people that have been using the murkiness of the telephone network to sneak billions of illegal calls past the FTC.

This particular issue (AI performance on captchas) is really quite fascinating. It's an arms race, but the problem is, only one side can win. Google is claiming they have improved their system in some (understandably) unspecified way, but there's only so far this can go. Captchas need to detect whether someone is human, but it has to work for everyone, ideally, even those with disabilities. Any simple task a human can do will eventually be able to be automated. Tasks that aren't currently feasible to be automated, say some natural language processing tasks, have another problem: scalability. To prevent simple databases of problems -> solutions, the problems need to be generated en masse, and for cheap, which means a computer needs to generate the solutions in the first place. And of course, paying people to just do captchas all day already happens.

The street address/book scan approach that Google uses is interesting in that the exact solution is not known, so they presumably have to be somewhat forgiving in accepting answers (as their machine learning might have gotten it wrong). Perhaps this is what their "risk analysis" refers to--whether their response seems "human" enough according to their data, not necessarily whether it's correct.

I don't see a way around this problem for free services that still preserves privacy (so directly using some government-issued ID is off the table). Maybe some Persona-like digital signature system, where a person can go to a physical location with a government ID, and get a signature that says "Trusted authority X affirms that person Y is in fact a person". Obviously this still has problems, as you need to trust X, and it's a big pain in the ass.

There are parallels to the realm of passwords, which are also becoming obsolete (not that there's a good replacement...). Anything that a human can feasibly remember for a bunch of sites is becoming easier and easier for computers to guess.

So basically, computers are taking over the world, and we can't do anything to stop it. God help us all.

well there are a lot of Resolve CAPTCHA as a Service sites like http://www.9kw.eu/

Sounds like a bigger annoyance to spammers. I don't have to go out and enlist a captcha solving team in nigeria.