Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The No CAPTCHA problem

homakov.blogspot.com

Post reply on HN
Print view View original

61–70 of 100 posts

Re: The No CAPTCHA problem

#61

Post by yhlasx »

homakov wrote: post #58
NotOscarWilde wrote: post #55

Earlier quoted context omitted.

> Do you really think that they would go ahead and implement a such system without rigorous testing of effectiveness? I am sure that they tested it extensively with users, AND with bots, and decided that it is better than the current system, and ONLY then deployed it. I think the gap between the marketing material for nocaptcha (a simplified website, a youtube video with animations) and the seemingly lacking actual i…

That's exactly why I wrote this post. I wish Google proved me wrong and demonstrate us how they use cool tech to detect bots instead of user.isGoogleUser? and user.acceptedCaptchas > 5

>>>So what Google is trying to sell us as a comprehensive bot detecting algorithm is simply a whitelist based on your previous online behavior, CAPTCHAs you solved.

That is a bold statement, something presented as a fact, not a hypothesis.

Re: The No CAPTCHA problem

#62

Post by RubyPinch »

raverbashing wrote: post #44
corobo wrote: post #39

Earlier quoted context omitted.

With both of your examples (and many others I've come across) those question type captchas can be done with a quick ping to Google and a sanity check on the answer "what popular figure comes through your chimney in December" -> "Santa Claus - Wikipedia, the free encyclopedia" "what's 1+1" -> "2" They only really work if maybe the question is in the market of the site you're registering for "What's 's last name" etc

And that's why Google can make you answer a captcha if it thinks you're a bot doing searches.

~$1.30 for 100 capachas, $50 for 10000 google searches per day, along with other search engines filling the same role.

probably the most damning thing is they are questions and answers from a database, unless you bother to make your DB unique (so no using openly available Q/A databases), everyone is going to have access to the right answers.

also, similar to paying people to answer capachas, you can pay people to answer questions

Re: The No CAPTCHA problem

#63

Post by scribu »

unreal37 wrote: post #36
probably_wrong wrote: post #16

Earlier quoted context omitted.

Here's a scenario: a dissident living in a third world country with pervasive surveillance. He accesses the net using TOR, and disables cookies. Now his IP is blacklisted, because there are lots of people using the same exit node; his reputation is low for the same reason, and the cookie is rejected. There's a good chance that this one person will be blocked, even though he didn't do anything wrong. For a simpler cas…

I would argue that the problem of spam and hackers is a greater burden on society as a whole than someone in Iran not being able to get past a captcha.

Yeah, seeing a few spam links on a website is much more burdensome than free speech!

Re: The No CAPTCHA problem

#64

Post by xlayn »

yhlasx wrote: post #54
xlayn wrote: post #42

People love not to think... Google is a business and the primary objective of any business is to make money (the vision/mission and others is for the people who love free lunch) Why captcha? to provide a service in a trade for "free" human recognition capabilities. Q//But google now is better at recognizing those numbers.... A//Right... that's why they now request the next "way to expensive" to implement "free" servi…

>>People love not to think O_O judging by the comment you wrote right after that, I would assume you are one of the people who likes not to think. They are making people click checkboxes and deviating from the old model of recognition. Your comment makes no sense.

Yeah every once in a while... a little bit of heuristics, a little bit of laziness.

Re: The No CAPTCHA problem

#65

Post by homakov »

yhlasx wrote: post #60
homakov wrote: post #56

Earlier quoted context omitted.

>So my guess would be they analyze users behaviour on the page where captcha is located, things like mouse movements If they can track mouse movements why in incognito mode i'm not a human for them anymore? I was expecting same but from what I see it's just a whitelist. And it's OK. Problem is, which you probably didn't care to read, is it's vulnerable to simple clickjacking which opens another weakness - i can use y…

>>which you probably didn't care to read I did read it. My point is, you, or I, or anyone for that matter does not know the inner details of how it works. >>If they can track mouse movements why in incognito mode i'm not a human for them anymore? Maybe having a clean cookie history is not good enough during the risk assessment. Look, my entire point is, google is not a joke company. I am certain that they tested it f…

> I did read it.

So what do you think about clickjacking issue? I made an assumption about their algo and maybe I'm wrong and they do track your mouse, but there's exploitable weakness. My post is 1) your algo seems simple 2) here's a bug in it.

Re: The No CAPTCHA problem

#66

Post by mikejarema »

egsec wrote: post #46

How many photos are in the universe of possible photos? How long would it take for outsourcing the process to tag all photos so a script could then do the matching? Is the whole point of this to encourage hackers to get working on this AI challenge of identifying similar photos? Either they need to hire a lot of people to sit around making these sets or they have an automated way of creating these sets which can be r…

I think a good chunk of the images are captured by way of Google's Streetview vehicles [1]. I'm seeing blurry images of house and apartment numbers all the time. So I'd imagine there are always new images popping up that Google can feed into the recaptcha system that haven't been seen before.

[1] http://www.google.com/recaptcha/intro/#creation-of-value

Re: The No CAPTCHA problem

#68

Post by ultramancool »

austenallred wrote: post #34
geerlingguy wrote: post #4

This is why I still recommend using other form spam prevention techniques before sacrificing usability for a CAPTCHA. One of the most effective combinations for 80%+ of the sites I've ever dealt with is having a honeypot field in the form, plus some amount of time required to pass before the form can be submitted successfully. There are other ways to mitigate bots as well, but these two alone have sufficed for quite…

The weird thing about this entire No Captcha solution, in my opinion, is that it assumes that a captcha is the most efficient method for defeating spam. In most blackhat circles, captchas are an afterthought. You figure out everything else (IPs, original content), then plug in a service like deathbycaptcha that solves the captcha for... looks like $1.39 per 1000 (thanks to ultramancool for the correction). ( http://d…

Just a small correction, it's $1.39 per 1000. Some competing services are as low as $1 per 1000.

> If your site does anything abnormal (whether it's 'what's n+n?' or 'what popular figure comes through your chimney in December?') a bot is hopeless.

Check out https://github.com/kbhomes/TextCaptchaBreaker for a great example of how trivial these are to break. And free too. Not to mention you could convert them to an image and feed them to a site like deathbycaptcha, antigate, etc. I've tried feeding some fun stuff like this through these services, you get interesting results and will likely have a high failure rate, but you'll get enough right to pass around 50-70% of the time.

Honeypot fields are pointless as a good bot just rips the whole form and fills in what it wants, if needed, executes JS too.

Of course, I'm assuming a determined attacker going after your individual site, not a bot just spamming random web forms. So it really depends on your threat model.

Re: The No CAPTCHA problem

#70

Post by egsec »

mikejarema wrote: post #66
egsec wrote: post #46

How many photos are in the universe of possible photos? How long would it take for outsourcing the process to tag all photos so a script could then do the matching? Is the whole point of this to encourage hackers to get working on this AI challenge of identifying similar photos? Either they need to hire a lot of people to sit around making these sets or they have an automated way of creating these sets which can be r…

I think a good chunk of the images are captured by way of Google's Streetview vehicles [1]. I'm seeing blurry images of house and apartment numbers all the time. So I'd imagine there are always new images popping up that Google can feed into the recaptcha system that haven't been seen before. [1] http://www.google.com/recaptcha/intro/#creation-of-value

Correct, I am referencing the new nocaptcha system. Those images would get stale as opposed to those in the traditional scanned book, street signs, house numbers in the recaptcha.
Post reply on HN