6 ms·

Geohot tries to break Google's recaptcha

90 points by artf 10y ago

meowface 10y ago
Clever idea, but Google also has some bot (and maybe also captcha farm) detections to try to ban captcha gamers. I think you'd also need a distributed and human-seeming proxy network.
photogrammetry 10y ago
Good luck, geohot.
trdtaylor1 10y ago
fight the power geo!
badcc 10y ago
Geohot - https://www.youtube.com/watch?v=9iUvuaChDEg https://www.youtube.com/watch?v=9iUvuaChDEg
- mwambua 10y ago
  I'm never really sure how I feel about Geohot. I know for sure I liked people like him a lot more when I was younger and thought that everything was within close reach. I hope that he keeps on winning... maybe it will inspire youngsters to try the impossible before reality knocks the wind out of them.
GFK_of_xmaspast 10y ago
If only he had put that much effort into answering the NHTSA...
- elmar 10y ago
  always easier to deal with code than bureaucrats.
  - mwfunk 10y ago
    No, not really. He's got no one to blame but himself for that one.
- vippy 10y ago
  George, file paperwork? lel.
g3o 10y ago
Bot that shit
krackers 10y ago
Why only street signs though? The new captchas I've seen ask you all sorts of random image recognition things, like identifying the squares with grass, with tea, with eggs, etc.
- blechschmidt 10y ago
  A possibility to break these might consist in using Google's image reverse search and check whether the word which you are supposed to identify images for appears on the result pages. However, the Google search is protected by reCaptcha - so you could build your own image reverse search or you use one implementing captchas which are easier to break. Otherwise, if you own a highly frequented website, you could ask your users to solve the captchas for you by proxying the challenges to them.
- doughj3 10y ago
  For the "which image is..." type captchas, there is always an option to "refresh" the captchas and get a different challenge. After 1 or 2 refreshes, you almost always get a street sign challenege. I was playing around with breaking Google's captchas a few weeks back and tensorflow's basic image recognition demo is actually already good enough that it too can almost always correctly identify which of the 9 or 12 images contain street signs. So I think that's a good start- exploiting the fact that Google favors showing street signs, and that in many cases you can already programatically identify street signs with image recognition. Obviously it's not perfect or Google wouldn't need to farm users to aid in improving image recognition , but it's good enough where you can break the captcha roughly 50% of the time.
- chiefalchemist 10y ago
  Pardon me if this is stating the obvious, but the captcha images being decoded serve a second purpose. In short, Goggle is crowdsourcing the decoding of those images in a mechanical Turk sorta way. Why street signs and house numbers? Because when your taken as much Street level photos as they have some are gonna need human review.
  - mgurlitz 10y ago
loopdoend 10y ago
This problem was solved long ago to the apparent satisfaction of the marketplace: http://bypasscaptcha.com http://bypasscaptcha.com George, the devil is in the details. You can't do everything overnight. 0% chance of success.
- photogrammetry 10y ago
  Thanks, dang and sctb, for encouraging people to flag and neg my comment wishing Geohot good luck.
  - loopdoend 10y ago
    Perhaps your "good luck" was snipey and didn't add anything...
    - photogrammetry 10y ago
      It wasn't. Perhaps we should be thanking sama, on the other hand.
tomphoolery 10y ago
> I go on some dates in NYC tomorrow so maybe we finish this today? It's good to hear that one of the top programmers in the world (IMHO) is getting some. Possibly. If he plays his cards right. But in all seriousness, this is really fun to read.
- angry-hacker 10y ago
  What does he mean by dates? Girls? Is it humor? Sorry, I don't really get it but I'm interested to understand. I only know he unlocked iPhone and was sued by Sony...
bmpafa 10y ago
You have to admire the showmanship: using a language Google created to try and break a Google-made system.
- rubyfan 10y ago
  Should use Tensor Flow for his classifier
  - Xorlev 10y ago
    Should use Google Cloud Machine Learning to host the resultant model.
Dolores12 10y ago
Current solutions on the market solve new google recaptcha with up to 50% accuracy. Let's see what Geohot can do.
desdiv 10y ago
>the Google Self Driving Car Cheaters How is the Google self-driving car team cheating? Or is he just being a sore loser about how his own self-driving car venture didn't work out?
- vidyesh 10y ago
  I think he wants to imply that everyone who is trying to build a self driving car is working on it in house, testing and tweaking while collecting data to make it better and possible. But what Google has done is, they tried and couldn't get the ball rolling that well in the commercial market as expected and eventually they created 'Waymo' which will partner with car manufacturers who will create prototypes for them to make ride sharing autonomous cars. Which sounds more like a mashup of Tesla and Uber.
- alphabettsy 10y ago
  Pretty sure he abandoned the car project when he realized how much of a massive liability that was.
  - rando444 10y ago
    No, not quite. They got a letter from the NHSTA asking to clarify a bunch of stuff with regard to safety, and rather than respond, they decided not to sell their product. The details are a little strange, but easily found with a quick Google search.
    - Oletros 10y ago
      That doesn't contradict what the op said
- ztratar 10y ago
  Correct me if I'm wrong, but comma.ai still exists.
- commaai 10y ago
  lol, comma.ai still exists and is still winning self driving cars. https://github.com/commaai/openpilot https://github.com/commaai/openpilot We have some amazing things scheduled for 2017 This repo is literally a joke for George to learn Go, in a similar vain to https://github.com/geohot/lowqualityraytracer https://github.com/geohot/lowqualityraytracer being about learning raytracing. Google is "cheating" because they are crowdsourcing labels with CAPTCHA, but then of course there's https://www.producthunt.com/posts/comma-coloring https://www.producthunt.com/posts/comma-coloring
hartator 10y ago
Geohot never stops to amaze me, at least.
felippee 10y ago
He was the biggest hacker, tried to be an entrepreneur, now he is working hard to became the biggest comedian of Silicon Valley. Seems like the comedian role might actually work out.
- kabes 10y ago
  He never was the biggest hacker.
  - felippee 10y ago
    Nevertheless he's got the chance to become the biggest comedian :) I think Hollywood would work out better for that...
  - samfisher83 10y ago
    He cracked the ps3 and iPhone. PS3 haven't been hacked for a long time.
zitterbewegung 10y ago
Has he read this paper? https://www.blackhat.com/docs/asia-16/materials/asia-16-Sivakorn-Im-Not-a-Human-Breaking-the-Google-reCAPTCHA-wp.pdf https://www.blackhat.com/docs/asia-16/materials/asia-16-Siva...
arcticfox 10y ago
Here's my solution: rerecaptcha. 1) Own or work with a very popular site with people filling captchas often 2) Instead of showing a full random captcha, use the recaptcha technique against itself: show a small random captcha alongside a full recaptcha that you want to break 3) Use the random known captcha for validation and profit from the user entered recaptcha
problems 10y ago
... this code literally just scrapes images from recaptcha right now, and it barely does that. If you want it broken, all you have to do is take these images and feed them through a captcha cracking service that uses humans and get them to input numbers for the corresponding squares. Works fairly well in my experience. And $1/1k you can't argue with.
- neurostimulant 10y ago
  That price is inhumane. Assuming the worker can solve 1 captcha every 10s in average, when working full time at 25 working day and 8 hours / day, a worker can clear 72000 captcha per month, grossing $72. The take home pay might be like half of it? Even in developing countries, $36 per month is too damn low for that mentally taxing work.
  - compsciphd 10y ago
    a good solver should be able to do it much faster than 1 every 10s. As someone who sees a lot of recaptcha captchas (i.e. per week I solve probably 1k+ working on a similar project) you notice patterns, that makes it much quicker and not particularly mentally taxing. With the proper tools, someone should be able to on average do them in under 5s and perhaps even faster. I just did a test, and I was able to do 20 recaptchas in a bit over a minute (65-70s, rough timer) Now, I wouldn't want to do for pay 8 hours a day, but at 3s a captcha it and at $1 per 1K captchas, one is looking at about $1/hr, which probably isn't bad in some parts of the world. (per a quick google search, "In 2009, the average monthly income in India was Rs 3000 [1]. If we assume 160 hours worked per month, that comes out to Rs 18.75 per hour, which is about 0.40 USD per hour. Given that about half of the country lives on a dollar per person per day [2], this estimate sounds reasonable.Oct 28, 2011")
wodenokoto 10y ago
Wonder if anybody commenting has read the readme. This is just a learning experiment. Is it really wrong for a famous hacker to dip his toes in a new language by doing something that is not state of the art?

90 points by artf 10y ago

Clever idea, but Google also has some bot (and maybe also captcha farm) detections to try to ban captcha gamers. I think you'd also need a distributed and human-seeming proxy network.

photogrammetry 10y ago

Good luck, geohot.

trdtaylor1 10y ago

fight the power geo!

badcc 10y ago

Geohot - https://www.youtube.com/watch?v=9iUvuaChDEg https://www.youtube.com/watch?v=9iUvuaChDEg

mwambua 10y ago
I'm never really sure how I feel about Geohot. I know for sure I liked people like him a lot more when I was younger and thought that everything was within close reach. I hope that he keeps on winning... maybe it will inspire youngsters to try the impossible before reality knocks the wind out of them.

GFK_of_xmaspast 10y ago

If only he had put that much effort into answering the NHTSA...

elmar 10y ago
always easier to deal with code than bureaucrats.
- mwfunk 10y ago
  No, not really. He's got no one to blame but himself for that one.
vippy 10y ago
George, file paperwork? lel.

g3o 10y ago

Bot that shit

krackers 10y ago

Why only street signs though? The new captchas I've seen ask you all sorts of random image recognition things, like identifying the squares with grass, with tea, with eggs, etc.

blechschmidt 10y ago
A possibility to break these might consist in using Google's image reverse search and check whether the word which you are supposed to identify images for appears on the result pages. However, the Google search is protected by reCaptcha - so you could build your own image reverse search or you use one implementing captchas which are easier to break. Otherwise, if you own a highly frequented website, you could ask your users to solve the captchas for you by proxying the challenges to them.
doughj3 10y ago
For the "which image is..." type captchas, there is always an option to "refresh" the captchas and get a different challenge. After 1 or 2 refreshes, you almost always get a street sign challenege. I was playing around with breaking Google's captchas a few weeks back and tensorflow's basic image recognition demo is actually already good enough that it too can almost always correctly identify which of the 9 or 12 images contain street signs. So I think that's a good start- exploiting the fact that Google favors showing street signs, and that in many cases you can already programatically identify street signs with image recognition. Obviously it's not perfect or Google wouldn't need to farm users to aid in improving image recognition , but it's good enough where you can break the captcha roughly 50% of the time.
chiefalchemist 10y ago
Pardon me if this is stating the obvious, but the captcha images being decoded serve a second purpose. In short, Goggle is crowdsourcing the decoding of those images in a mechanical Turk sorta way. Why street signs and house numbers? Because when your taken as much Street level photos as they have some are gonna need human review.
- mgurlitz 10y ago

loopdoend 10y ago

This problem was solved long ago to the apparent satisfaction of the marketplace: http://bypasscaptcha.com http://bypasscaptcha.com George, the devil is in the details. You can't do everything overnight. 0% chance of success.

photogrammetry 10y ago
Thanks, dang and sctb, for encouraging people to flag and neg my comment wishing Geohot good luck.
- loopdoend 10y ago
  Perhaps your "good luck" was snipey and didn't add anything...
  - photogrammetry 10y ago
    It wasn't. Perhaps we should be thanking sama, on the other hand.

tomphoolery 10y ago

> I go on some dates in NYC tomorrow so maybe we finish this today? It's good to hear that one of the top programmers in the world (IMHO) is getting some. Possibly. If he plays his cards right. But in all seriousness, this is really fun to read.

angry-hacker 10y ago
What does he mean by dates? Girls? Is it humor? Sorry, I don't really get it but I'm interested to understand. I only know he unlocked iPhone and was sued by Sony...

bmpafa 10y ago

You have to admire the showmanship: using a language Google created to try and break a Google-made system.

rubyfan 10y ago
Should use Tensor Flow for his classifier
- Xorlev 10y ago
  Should use Google Cloud Machine Learning to host the resultant model.

Dolores12 10y ago

Current solutions on the market solve new google recaptcha with up to 50% accuracy. Let's see what Geohot can do.

desdiv 10y ago

>the Google Self Driving Car Cheaters How is the Google self-driving car team cheating? Or is he just being a sore loser about how his own self-driving car venture didn't work out?

vidyesh 10y ago
I think he wants to imply that everyone who is trying to build a self driving car is working on it in house, testing and tweaking while collecting data to make it better and possible. But what Google has done is, they tried and couldn't get the ball rolling that well in the commercial market as expected and eventually they created 'Waymo' which will partner with car manufacturers who will create prototypes for them to make ride sharing autonomous cars. Which sounds more like a mashup of Tesla and Uber.
alphabettsy 10y ago
Pretty sure he abandoned the car project when he realized how much of a massive liability that was.
- rando444 10y ago
  No, not quite. They got a letter from the NHSTA asking to clarify a bunch of stuff with regard to safety, and rather than respond, they decided not to sell their product. The details are a little strange, but easily found with a quick Google search.
  - Oletros 10y ago
    That doesn't contradict what the op said
ztratar 10y ago
Correct me if I'm wrong, but comma.ai still exists.
commaai 10y ago
lol, comma.ai still exists and is still winning self driving cars. https://github.com/commaai/openpilot https://github.com/commaai/openpilot We have some amazing things scheduled for 2017 This repo is literally a joke for George to learn Go, in a similar vain to https://github.com/geohot/lowqualityraytracer https://github.com/geohot/lowqualityraytracer being about learning raytracing. Google is "cheating" because they are crowdsourcing labels with CAPTCHA, but then of course there's https://www.producthunt.com/posts/comma-coloring https://www.producthunt.com/posts/comma-coloring

hartator 10y ago

Geohot never stops to amaze me, at least.

felippee 10y ago

He was the biggest hacker, tried to be an entrepreneur, now he is working hard to became the biggest comedian of Silicon Valley. Seems like the comedian role might actually work out.

kabes 10y ago
He never was the biggest hacker.
- felippee 10y ago
  Nevertheless he's got the chance to become the biggest comedian :) I think Hollywood would work out better for that...
- samfisher83 10y ago
  He cracked the ps3 and iPhone. PS3 haven't been hacked for a long time.

zitterbewegung 10y ago

Has he read this paper? https://www.blackhat.com/docs/asia-16/materials/asia-16-Sivakorn-Im-Not-a-Human-Breaking-the-Google-reCAPTCHA-wp.pdf https://www.blackhat.com/docs/asia-16/materials/asia-16-Siva...

arcticfox 10y ago

Here's my solution: rerecaptcha. 1) Own or work with a very popular site with people filling captchas often 2) Instead of showing a full random captcha, use the recaptcha technique against itself: show a small random captcha alongside a full recaptcha that you want to break 3) Use the random known captcha for validation and profit from the user entered recaptcha

problems 10y ago

... this code literally just scrapes images from recaptcha right now, and it barely does that. If you want it broken, all you have to do is take these images and feed them through a captcha cracking service that uses humans and get them to input numbers for the corresponding squares. Works fairly well in my experience. And $1/1k you can't argue with.

neurostimulant 10y ago
That price is inhumane. Assuming the worker can solve 1 captcha every 10s in average, when working full time at 25 working day and 8 hours / day, a worker can clear 72000 captcha per month, grossing $72. The take home pay might be like half of it? Even in developing countries, $36 per month is too damn low for that mentally taxing work.
- compsciphd 10y ago
  a good solver should be able to do it much faster than 1 every 10s. As someone who sees a lot of recaptcha captchas (i.e. per week I solve probably 1k+ working on a similar project) you notice patterns, that makes it much quicker and not particularly mentally taxing. With the proper tools, someone should be able to on average do them in under 5s and perhaps even faster. I just did a test, and I was able to do 20 recaptchas in a bit over a minute (65-70s, rough timer) Now, I wouldn't want to do for pay 8 hours a day, but at 3s a captcha it and at $1 per 1K captchas, one is looking at about $1/hr, which probably isn't bad in some parts of the world. (per a quick google search, "In 2009, the average monthly income in India was Rs 3000 [1]. If we assume 160 hours worked per month, that comes out to Rs 18.75 per hour, which is about 0.40 USD per hour. Given that about half of the country lives on a dollar per person per day [2], this estimate sounds reasonable.Oct 28, 2011")

wodenokoto 10y ago

Wonder if anybody commenting has read the readme. This is just a learning experiment. Is it really wrong for a famous hacker to dip his toes in a new language by doing something that is not state of the art?