Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's Street View computer vision can beat reCAPTCHA with 99% accuracy

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

61–70 of 159 posts

Re: Google's Street View computer vision can beat reCAPTCHA with 99% accuracy

#61

Post by dave_sullivan »

zwegner wrote: post #45

This particular issue (AI performance on captchas) is really quite fascinating. It's an arms race, but the problem is, only one side can win. Google is claiming they have improved their system in some (understandably) unspecified way, but there's only so far this can go. Captchas need to detect whether someone is human, but it has to work for everyone, ideally, even those with disabilities. Any simple task a human ca…

If you're curious about how the algorithm works, here's a recent talk from one of the authors of the paper where he talks about it: http://www.youtube.com/watch?v=iK3HIIsZGJY&t=1m32s

As to your questions, I think the way it's going with these convolutional neural nets, the idea of being able to tell a human from a computer with something like captcha isn't going to work. I'm thinking a captcha that still would work would be a randomly generated natural language instruction that a user has to interpret with some top down reasoning (possibly with a natural text answer). We've still got a ways to go before we can do that really effectively with software.

Re: Google's Street View computer vision can beat reCAPTCHA with 99% accuracy

#62

Post by chris_mahan »

return0 wrote: post #59
dmbass wrote: post #48

Earlier quoted context omitted.

That's not the endgame. Once machines pass the Turing test, it will be impossible to filter humans vs. machines.

What if you are interrogated offline? What if the police visits you every 3 months to make sure you haven't turned to a robot?

"The tortoise lays on its back, its belly baking in the hot sun beating its legs trying to turn itself over but it can't, not without your help, but you're not helping."

(http://www.trussel.com/bladerun.htm)

Re: Google's Street View computer vision can beat reCAPTCHA with 99% accuracy

#63

Post by Larrikin »

ashmud wrote: post #53
id wrote: post #15

Earlier quoted context omitted.

It has been like this for a while now. AFAIK you have either - the actual captcha and a word from a book (Google Books) - the actual captcha and a house number from Street View (Google Maps) Only the actual captcha has to be typed in correctly.

Do people ever intentionally type in nonsense for the non-captcha part, out of spite, for instance? If you could persuade enough people to provide non-answers for the non-captcha part, would Google stop using it (the non-captcha part)? My guess is it's like spam. As long as it works a small fraction of the time, it will still exist.

I don't think I've typed a whole captcha in over a year. It is always obvious which part it's necessary, and now that most of the time the unnecessary part is to improve Google's bottom line by checking addresses instead of helping digitize books I will continue typing dhgd instead. typing an intentionally wrong word is just as much a waste of time as typing the right word

Re: Google's Street View computer vision can beat reCAPTCHA with 99% accuracy

#64

Post by toyg »

Lambdanaut wrote: post #60
zwegner wrote: post #45

This particular issue (AI performance on captchas) is really quite fascinating. It's an arms race, but the problem is, only one side can win. Google is claiming they have improved their system in some (understandably) unspecified way, but there's only so far this can go. Captchas need to detect whether someone is human, but it has to work for everyone, ideally, even those with disabilities. Any simple task a human ca…

The suggestion to "go to a physical location to get a trusted government signature" has deeper flaws as well. What's to stop a bot writer from getting a signature and plugging it into his bot?

Blacklisting would soon force him to get hundreds or thousands of signatures, which would slow down the operation.

This said, i don't think "trusted authorities" are the way to go - we've seen the failure of that model with x.509, there is no need to repeat it elsewhere.

Re: Google's Street View computer vision can beat reCAPTCHA with 99% accuracy

#65

Post by zwegner »

Lambdanaut wrote: post #60
zwegner wrote: post #45

This particular issue (AI performance on captchas) is really quite fascinating. It's an arms race, but the problem is, only one side can win. Google is claiming they have improved their system in some (understandably) unspecified way, but there's only so far this can go. Captchas need to detect whether someone is human, but it has to work for everyone, ideally, even those with disabilities. Any simple task a human ca…

The suggestion to "go to a physical location to get a trusted government signature" has deeper flaws as well. What's to stop a bot writer from getting a signature and plugging it into his bot?

Presumably a service would only allow one (or a few) accounts per actual person. The end user will still need some amount of security. I had in mind some challenge-response mechanism, like:

  Person signs government ID number with public key, presents it to authority
  Authority signs public key and asserts it belongs to a real human
  Service presents random number at signup time
  Person signs the random number with the same public key, and presents the key signed by the authority

Re: Google's Street View computer vision can beat reCAPTCHA with 99% accuracy

#66

Post by t0lk »

mrsaint wrote: post #28

Captchas were meant to keep spammers at bay. Unfortunately, that's no longer the case. Thanks to "cloud technology" like DeathByCaptcha - that is, people in countries where labor is cheap solving captchas all day - spammers have no problem getting through reCaptcha-protected sites and forums to do their mischief. As a result, reCaptcha & co tend to be more of an annoyance to honest visitors than to spammers.

I have a mediawiki wiki and let me tell you there are tons of old spam bots out in the wild, ones that would fail at the presence of any captcha. Come to think of it, I've experienced most generations of spam bots since I started. With no protection I'd get spam links/registrations every day. With a simple question like 2+2=? I'd get one every 3-4 days or once a week and with reCaptcha I'd get them a little less frequently. I had to switch away from reCaptcha a few years back however when it appeared to no longer prevent spam (people are paid to solve them all day, etc).

Re: Google's Street View computer vision can beat reCAPTCHA with 99% accuracy

#67

Post by Lambdanaut »

zwegner wrote: post #65
Lambdanaut wrote: post #60

Earlier quoted context omitted.

The suggestion to "go to a physical location to get a trusted government signature" has deeper flaws as well. What's to stop a bot writer from getting a signature and plugging it into his bot?

Presumably a service would only allow one (or a few) accounts per actual person. The end user will still need some amount of security. I had in mind some challenge-response mechanism, like: Person signs government ID number with public key, presents it to authority Authority signs public key and asserts it belongs to a real human Service presents random number at signup time Person signs the random number with the sa…

I'm not entirely sure how that would mitigate people from passing the government signed public key to their bot and letting it take over from there.

Re: Google's Street View computer vision can beat reCAPTCHA with 99% accuracy

#69

Post by eggnet »

Lambdanaut wrote: post #60
zwegner wrote: post #45

This particular issue (AI performance on captchas) is really quite fascinating. It's an arms race, but the problem is, only one side can win. Google is claiming they have improved their system in some (understandably) unspecified way, but there's only so far this can go. Captchas need to detect whether someone is human, but it has to work for everyone, ideally, even those with disabilities. Any simple task a human ca…

The suggestion to "go to a physical location to get a trusted government signature" has deeper flaws as well. What's to stop a bot writer from getting a signature and plugging it into his bot?

Blacklisting the bad signature as well as being able to trace it back to a real person would be pretty significant deterrents.

That seems pretty obvious to me, making me wonder what you're really getting at.

Re: Google's Street View computer vision can beat reCAPTCHA with 99% accuracy

#70

Post by akgerber »

ashmud wrote: post #53
id wrote: post #15

Earlier quoted context omitted.

It has been like this for a while now. AFAIK you have either - the actual captcha and a word from a book (Google Books) - the actual captcha and a house number from Street View (Google Maps) Only the actual captcha has to be typed in correctly.

Do people ever intentionally type in nonsense for the non-captcha part, out of spite, for instance? If you could persuade enough people to provide non-answers for the non-captcha part, would Google stop using it (the non-captcha part)? My guess is it's like spam. As long as it works a small fraction of the time, it will still exist.

I did when Recaptcha came out and it was consistently obvious which was the unknown part. It's no longer so obvious, in my experience.

I believe ReCaptcha presents the same unknown value to several users, and rejects outliers.

Post reply on HN