6 ms·
Good article! I don't know what you call those new Google captcha, where you have to press "I am not a robot" and then you are given a bunch of images and a que
by orliesaurus 9y ago
Good article!
I don't know what you call those new Google captcha, where you have to press "I am not a robot" and then you are given a bunch of images and a question that goes something like: "Select all images that contain cars"
Do you consider that a CAPTCHA? Or is it something else?
Now that's one system that I would like to see beaten.
From the article:
Yep, it generates 4-letter CAPTCHAs using a random mix of four different fonts.
And we can see that it never uses “O” or “I” in the codes
to avoid user confusion.
this seems to be a very simple CAPTCHA system to beat from a ML problem perspective, right?
- eXpl0it3r 9y agoI would like this NOT to be broken. reCAPTCHA is currently one of the few captcha systems the still work to some extend. It locks out most spam bots and keeps my sites clean. Of course it's a good idea to try and break it, to see how "secure" it is.
- tyteen4a03 9y agoOne thing I find works really well is context-based question captchas. You ask human visitors some very simple question about your site, and unless the robot brute-force, it's very hard for robot spammers to get it right.
- JorgeGT 9y agoYep, I saw this in rtl-sdr.com! They ask, for instance what does the S in SDR stands for, which obviously any legitimate commenter in such a niche site knows.
- sp332 9y agoI think it mostly works by inspecting your browser environment to see if it looks like a bot. I'm not really convinced that the pictures do much.
- ibelimb 9y agoUnfortunately the latest revision of reCAPTCHA has become such a pain that I've come very close to just giving up on signing up for whatever service it is I'm trying to use that has it implemented. I have to go through several attempts to verify myself because Google didn't like that I missed one box with a car in it and have to start all over looking for street signs.
- teddyfrozevelt 9y agoI often use a VPN and browser extensions that make the new one always asks me to verify. The new tests are just terrible (choose all photos with an apartment building??). It will sometimes take me a few minutes to complete the test when it asks me to check all boxes with a car and the slow fade animation that takes 5 seconds starts. Then it decides that I didn't choose them well enough and starts over again. The old CAPTCHA was much better and I didn't feel like I was just feeding Google's street view.
- astura 9y agoYeah, it frustrates me a lot too. If I need to pick the squares with street signs about half the time they want me to choose the squares that have the pole and half not! Ditto with the square with the tiny corner of the sign.
- orliesaurus 9y agoI became really good (or really bad) at them, that once I had to go through >8< rounds of reCAPTCHA to get through....I seriously was thinking it was never going to end!
- atomwaffel 9y agoI imagine that those are hard to beat with machine learning precisely because they stump Google's own algorithms. By answering them, you're helping train their neural networks (which is why I rather resent having to answer them).
- dokument 9y ago| Do you consider that a CAPTCHA? Yes:"Completely Automated Public Turing test to tell Computers and Humans Apart" But funny enough, I believe that data is used to help with machine learning to identify the objects, so we are CAPTCHA'ng ourselves into harder and harder CAPTCHA's. The "I am not a robot" types are interesting because they don't just test you, they monitor your behavior. "If it looks like a duck, swims like a duck, and quacks like a duck, then it probably is a duck."
- jeffwass 9y agoMany times I don't even get to the second step. I only click "I am not a robot" and I've passed. Are Captcha's a paid service and my examples are sites buying into only the lowest level of ID? Or is this something akin to a decision made vs my access frequency/behaviour where the algo decides it's reasonably sure I'm a human so no need to waste bandwidth on sending and confirming images?
- dylanfw 9y agoIf you're not asked anything after checking the box then your browser's fingerprint has already been determined to be a real human by enough partner sites using the Captcha. Try opening a private browsing window and checking the box to see the second verification part.
- rjbwork 9y agoThey're run by google, so if you're a known "good account" it just detects that you have their cookie/are logged in and lets you through. Pop it open in incognito and you should get one.
- freeflight 9y ago> I don't know what you call those new Google captcha Dunno what to call them, but I consider them educational interactions with AI [0] [0] https://xkcd.com/1897/ https://xkcd.com/1897/
- ageitgey 9y agoYep, this is a pretty simple CAPTCHA picked to illustrate a concept for teaching purposes. But more complex CAPTCHA images don't necessarily make anything more secure depending on how the whole system works. In fact, one of the most effective attacks against Google's ReCAPTCHA is more simple than anything in this article - you just request the audio version of the captcha, feed it to Google's own Speech Recognition API (or a competitor), and give Google back it's own result [1] [1] https://github.com/eastee/rebreakcaptcha https://github.com/eastee/rebreakcaptcha
- yborg 9y agoAccording to the linked blog, this worked for about a week before Google flagged the IP and started delivering an obfuscated audio challenge that can't be recognized by their own recognition API.