Live data from Hacker News

Captchas are Becoming Ridiculous

andrewmunsell.com

71–80 of 201 posts

Re: Captchas are Becoming Ridiculous

#71

Earlier quoted context omitted.

It's a nice idea, but you have to consider the complexity of the word puzzles compared to the average human's brain power. Most people are quite dumb. If there aren't a sufficient number of problems/answers, or they're simple enough for computers to solve, or they're too complex for a minority of humans to solve, you're boned. The whole thing is a technology arm's race. The best solution would be one where you simply…

Except you lose the benefit of anonymity, which is a big draw for many of the places using Captchas. Unless I don't understand your idea, which is possible.

Well anonymity isn't the purpose of captchas. Captchas are intended to provide human-confirmation with the least friction possible, mainly for rate-limiting of services. Having to establish you are a specific individual takes effort, but just typing in a random word is simple. Anonymity is just a by-product of the frictionless [simple] part.

You can still come up with new ways to verify someone is a human for specific uses where you want anonymity, but they will always be part of the tech arms race if you want them frictionless. To avoid them getting more annoying you need a way to authenticate an individual identity, as that allows you to rate-limit access.

You could, of course, do TOTP and totally preserve anonymity. Unless the TOTP service provider is compromised, in which case all bets are off (but perfect-forward secrecy might solve that?)

Re: Captchas are Becoming Ridiculous

#72
post #61
post #43

Earlier quoted context omitted.

Analysis of audio captchas has led to a number of exploits for several captcha systems including recaptcha - which is what all that horrible obfuscation is trying to prevent.

It seems to be really good at preventing visually impaired users from using your site. Unless it is true that they really do develop better hearing.

I don't know how you would solve that problem, other than not having one at all, which of course wouldn't be fair. Having the audio clearly describe the solution would make the captcha useless.

Re: Captchas are Becoming Ridiculous

#73
post #58
post #3

The squished-up word is the control word, and the straight one is the unknown one. You only need to get the wavy word right and just guess at all the cut-off examples.

I've solved a lot of captcha's in my time, and really have never experienced the trouble the author is detailing. Not only am I relieved when I see a reCaptcha since they are some of the easiest and most forgiving challenges, but I don't recall ever having repeated bad/unsolvable challenges presented on the same page. Sure, maybe sometimes you get a weird one and fail it. But typically the next challenge is easy to p…

> Captcha's are not going anywhere anytime soon.

You're probably right. But the fact remains that captchas aren't good enough. They can be partially automated; blackhats can use captcha solving farms which will be at least as accurate as the average human (probably more accurate, I imagine).

A better solution might employ heuristics similar to DDoS mitigation techniques. I really don't know, but there is a need for something better here.

Re: Captchas are Becoming Ridiculous

#74
Here's something interesting. If I go to the ReCaptcha demo page in Chrome that is logged in to Google, I get all house numbers, a lot of which seem like easy OCR. If go to the same demo page in Incognito mode, I get the two word version instead, like this blog is complaining about.

http://www.google.com/recaptcha/demo/

Re: Captchas are Becoming Ridiculous

#75

I've recently seen a bunch of them with just one number. Just a single 7 or 4 on a white background and nothing else. Kind of scratch my head at those ones.

Do you mean the house numbers/street signs? Like these: http://i.imgur.com/yD1FrlH.jpg

If it's those, I guess google uses recaptcha to get data for streetview.

Re: Captchas are Becoming Ridiculous

#76

Is it not obvious in the first case that "secretary" is the unknown word? Clearly ocr wasn't able to read it due to the fading. Likewise, the cut off words spanning two lines in the later versions are obviously the unknown words. The author states right at the beginning that he understands there is a control and an unknown word; he then proceeds to "hope" that the obvious unknown word is the control in the first case…

What a concise description of why captchas as they exist today are just awful and we have to come up with a better solution!

There you are, talking on and on and on about some tiny unimportant but extremely specific implementation detail no one should ever have to care about. People shouldn’t have to read a manual about the inner workings of this captcha implementation (and have some experience with what types of text computer vision is good and bad at recognising!) to have any chance solving it.

In this case the author clearly had no idea how that control/unknown system works in detail (it seems like they, just like me, only know that you do not have to recognise both, but they didn’t really understand the reason for that – nor should they have to) but that doesn’t really matter for their argument even a tiny bit.

Re: Captchas are Becoming Ridiculous

#77
post #14
post #3

The squished-up word is the control word, and the straight one is the unknown one. You only need to get the wavy word right and just guess at all the cut-off examples.

^ This is the way to go. Don't waste any energy on the "unknown" word, just fill out the one that has been smeared out and fill in bogus for the rest. If you want to post on 4chan and don't have a Pass, you need to solve a captcha for every single post. It becomes easier with practice, I fail maybe 1 in 10 captchas. And the more captchas you solve correctly, the easier the captchas for your IP get.

If enough people colluded to use the same unknown word, say "foobar", then couldn't they train recaptcha to believe that is the true value of the word? If I understand recaptcha correctly, and assuming they don't detect collusion well, then eventually the known word pool would get poisoned with a surplus of foobars.

Re: Captchas are Becoming Ridiculous

#78
post #74

Here's something interesting. If I go to the ReCaptcha demo page in Chrome that is logged in to Google, I get all house numbers, a lot of which seem like easy OCR. If go to the same demo page in Incognito mode, I get the two word version instead, like this blog is complaining about. http://www.google.com/recaptcha/demo/

Yep, in incognito mode Google hasn't built up a profile of you yet so they assume you're a spammer.

Re: Captchas are Becoming Ridiculous

#79

What is everyone thoughts on this type of CAPTCHA? http://areyouahuman.com/site-owners/playthru/

Nice! I am playing with the idea to put it on my site for fun. :-)

I use it as an alternative captcha for contact forms on some WordPress sites I run.

Met a couple people who work at the company (I'm in Detroit and think that's where it is based) at some startup events a couple years ago. That's how I found out about it.

Re: Captchas are Becoming Ridiculous

#80
post #9

This made me remember: I once saw a website with a moving captcha. Can't remember where I saw. Anyone knows?

Comcast does that on their password reset pages. E.g., go to https://login.comcast.net/myaccount/reset , type in "foo", and click "Next." Edit: From checking the source, it looks like they're using NuCaptcha ( http://www.nucaptcha.com/ ). Looks like O2, Groupon, and StumbleUpon are also NuCaptcha customers. You can see examples on this page: http://nucaptcha.com/features/security-features

There is a blog post about defeating NuCaptcha here: http://www.elie.im/blog/security/how-we-broke-the-nucaptcha-...
Post reply on HN