6 ms·

So you replace the hard to read CAPTCHAs with easy to read ads. Of which presumably there will be a limited number in circulation at any one time. Sounds kinda

by almost 16y ago

So you replace the hard to read CAPTCHAs with easy to read ads. Of which presumably there will be a limited number in circulation at any one time. Sounds kinda easy to circumvent...

aristidb 16y ago
Indeed. Without some form of randomisation (which advertisers probably do not want), this would drastically lower the price of solving a captcha. Because you need to submit each ad to a human solver network only once, and can store the solution.
mseebach 16y ago
A longtime standing solution to hard-to-read captchas are easy to read (but hard to process) captchas. E.g. show a picture of an animal or a shape and ask what it is, or even just ask a simple math problem or riddle in writing. Problem with those are that they need to be constantly updated from a reliable source, or else, once the solution becomes popular, the spammer can bruteforce it in linear time (no matter how high N is, there are only N possible patterns). This seems to be an attempt at fixing this. Ads are often relatively short lived so by the time the spammer has them bruteforced, it might be out of circulation - and more importantly, there are new ads in. It's an armsrace, and this is a way to pay our troops. Also, it's trivial for advertisers to make many different variations (e.g. one for each sales bulletpoint), so there are many variations in circulation. Since there's often more textual content than the password in the ad, they're not prone to simple OCR, while still easy to comprehend for the user. Obvious shortcomings are if ads are not so shortlived, and if it's easy to identify and break classes of ads (e.g. if it's yellow and has the IE logo in position X, OCR area Y, done). Also, it's a bit of a dealbreaker if I'm forced to open and visit a website to get the password.
- olegk 16y ago
  You have no idea what you're talking about. > show a picture of an animal or a shape and ask what it is, Ok, so let's say you come up with pictures of 20 different animals. A spam script that picks the same answer every time will have a 5% success rate. > or even just ask a simple math problem or riddle in writing. Computers are way better at solving most math problems than people.
  - mseebach 16y ago
    Please read my post. Specifically the second paragraph where exactly this issue is addressed.
    - olegk 16y ago
      Still doesn't make sense. If you display 10 random animals (or shapes), and ask a user to pick the right one, a dumb spam script would have a 10% success rate. If you display one image of an animal and give 10 possible answers, a dumb spam script would have a 10% success rate.
      - mseebach 16y ago
        So if I have a library of 10s of thousands of images of animals, shapes, things etc. that are all easily recognisable to English speakers -- e.g. cat, dog, house, drum, road, tree, book, horse -- and ask them to write in what is it, AND I constantly update that library and retire pictures that's been used many time -- what is your dumb script's success rate? What if I combine three pictures in each challenge - e.g. "cat house triangle"?
        olegk 16y ago
        My spam script would always answer "cat", so among 8 options (cat, dog, house, drum, road, tree, book, horse), I'd get a 12.5% success rate. Plus you constantly have to update your image library, which a huge pain. Also, recognizing 10,000 images will take me around one day and less than $1000 with Amazon turk, thus giving me a perfect 100% success rate. After that you would have to completely renew your image database.
        mseebach 16y ago
        sigh .. etc. There would be more than 8 options, many more. YES, it would be a pain to update the library, which is why I'm commending this particular concept for solving that problem ...
- pedalpete 16y ago
  Your argument is somewhat flawed from a technical level as Olegk mentioned, but also from a business marketing stand-point. Specific ads may be in circulation for a short time, or there may be many running concurrently, but it is the message that the advertiser is trying to get across, the tagline, and it would be of most benefit to the advertiser to get the user to associate their brand with a single concept. Using the example in the article, Subaru may want to be associated with "outback", not "four wheel drive" or "comfy" or "sporty". Businesses who try to target too many things or too wide an audience end up not getting their message across. I'm not saying that what Solve Media is trying to do isn't a great idea. I think it has lots of potential, but they clearly still have more to work on.
- shalmanese 16y ago
  This was the process used by the Microsoft Research project ASSIRA (http://research.microsoft.com/en-us/um/redmond/projects/asirra/ http://research.microsoft.com/en-us/um/redmond/projects/asir...) which used images of kittens and puppies put up for adoption as a constant fresh source of input data. This was later, awesomely riffed on by HotCaptcha (http://valleywag.gawker.com/246656/a-face-only-a-bot-could-love http://valleywag.gawker.com/246656/a-face-only-a-bot-could-l...) which pulled HotOrNot data and asked you to select the 3 hot women out of 9. Sadly, the site is down now but I remember trying it and it was remarkably useful and a hell of a lot more fun than word captchas.
il 16y ago
You know, most modern capchas are not solved by bots, but by people in third world countries solving them for pennies. The current going rate is about $1/1000 and there are easy to use captcha solving APIs for any platform. capcha has long provided an illusion of security, nothing more. Any and all captchas will be broken.
- jchonphoenix 16y ago
  I know the founders of reCaptcha. This is easier to prevent than you think. Its also quite rare.
  - il 16y ago
    Heh, I know people who are working on breaking reCaptcha. Maybe they should get together and learn from each other. If you're saying that it's possible to prevent manual, outsourced captcha solving, I would have to strongly disagree. It's similar to the futility of DRM as an antipiracy measure. As long as I can see the captcha, I can pay someone in another country to solve it for me. I will agree that it's rare- but the most sophisticated and high-volume spammers do it, and they're the ones you have to worry about. In case people start giving me sideways glances I want to make it clear that I haven't done any blackhat stuff in a very long time, but I'm still interested in the blackhat community from a security researcher's perspective.
    - jchonphoenix 16y ago
      I'm not saying that its possible to do it in an automated way. I'm just saying that tools exist to create red flags that would make thing easily verified by a human. They have ways in which they deal with these things. All I'm saying is so far, its been working for them.
      - il 16y ago
        You're probably not going to tell me more about these tools, although I would be very curious to learn how they work. All I have is anecdotal evidence- I know several people who are making their living spamming Craigslist and outsourcing their ReCaptcha solving. Since they can make $XX per post, paying pennies for captcha is a tiny expense. I don't condone this behavior, but be aware- it happens more than you think. Anyway, probably best to take the discussion to email if you want more...perspective from the other side.

by almost 16y ago

So you replace the hard to read CAPTCHAs with easy to read ads. Of which presumably there will be a limited number in circulation at any one time. Sounds kinda easy to circumvent...

aristidb 16y ago

Indeed. Without some form of randomisation (which advertisers probably do not want), this would drastically lower the price of solving a captcha. Because you need to submit each ad to a human solver network only once, and can store the solution.

mseebach 16y ago

A longtime standing solution to hard-to-read captchas are easy to read (but hard to process) captchas. E.g. show a picture of an animal or a shape and ask what it is, or even just ask a simple math problem or riddle in writing. Problem with those are that they need to be constantly updated from a reliable source, or else, once the solution becomes popular, the spammer can bruteforce it in linear time (no matter how high N is, there are only N possible patterns). This seems to be an attempt at fixing this. Ads are often relatively short lived so by the time the spammer has them bruteforced, it might be out of circulation - and more importantly, there are new ads in. It's an armsrace, and this is a way to pay our troops. Also, it's trivial for advertisers to make many different variations (e.g. one for each sales bulletpoint), so there are many variations in circulation. Since there's often more textual content than the password in the ad, they're not prone to simple OCR, while still easy to comprehend for the user. Obvious shortcomings are if ads are not so shortlived, and if it's easy to identify and break classes of ads (e.g. if it's yellow and has the IE logo in position X, OCR area Y, done). Also, it's a bit of a dealbreaker if I'm forced to open and visit a website to get the password.

olegk 16y ago
You have no idea what you're talking about. > show a picture of an animal or a shape and ask what it is, Ok, so let's say you come up with pictures of 20 different animals. A spam script that picks the same answer every time will have a 5% success rate. > or even just ask a simple math problem or riddle in writing. Computers are way better at solving most math problems than people.
- mseebach 16y ago
  Please read my post. Specifically the second paragraph where exactly this issue is addressed.
  - olegk 16y ago
    Still doesn't make sense. If you display 10 random animals (or shapes), and ask a user to pick the right one, a dumb spam script would have a 10% success rate. If you display one image of an animal and give 10 possible answers, a dumb spam script would have a 10% success rate.
    - mseebach 16y ago
      So if I have a library of 10s of thousands of images of animals, shapes, things etc. that are all easily recognisable to English speakers -- e.g. cat, dog, house, drum, road, tree, book, horse -- and ask them to write in what is it, AND I constantly update that library and retire pictures that's been used many time -- what is your dumb script's success rate? What if I combine three pictures in each challenge - e.g. "cat house triangle"?
      - olegk 16y ago
        My spam script would always answer "cat", so among 8 options (cat, dog, house, drum, road, tree, book, horse), I'd get a 12.5% success rate. Plus you constantly have to update your image library, which a huge pain. Also, recognizing 10,000 images will take me around one day and less than $1000 with Amazon turk, thus giving me a perfect 100% success rate. After that you would have to completely renew your image database.
        mseebach 16y ago
        sigh .. etc. There would be more than 8 options, many more. YES, it would be a pain to update the library, which is why I'm commending this particular concept for solving that problem ...
pedalpete 16y ago
Your argument is somewhat flawed from a technical level as Olegk mentioned, but also from a business marketing stand-point. Specific ads may be in circulation for a short time, or there may be many running concurrently, but it is the message that the advertiser is trying to get across, the tagline, and it would be of most benefit to the advertiser to get the user to associate their brand with a single concept. Using the example in the article, Subaru may want to be associated with "outback", not "four wheel drive" or "comfy" or "sporty". Businesses who try to target too many things or too wide an audience end up not getting their message across. I'm not saying that what Solve Media is trying to do isn't a great idea. I think it has lots of potential, but they clearly still have more to work on.
shalmanese 16y ago
This was the process used by the Microsoft Research project ASSIRA (http://research.microsoft.com/en-us/um/redmond/projects/asirra/ http://research.microsoft.com/en-us/um/redmond/projects/asir...) which used images of kittens and puppies put up for adoption as a constant fresh source of input data. This was later, awesomely riffed on by HotCaptcha (http://valleywag.gawker.com/246656/a-face-only-a-bot-could-love http://valleywag.gawker.com/246656/a-face-only-a-bot-could-l...) which pulled HotOrNot data and asked you to select the 3 hot women out of 9. Sadly, the site is down now but I remember trying it and it was remarkably useful and a hell of a lot more fun than word captchas.

il 16y ago

You know, most modern capchas are not solved by bots, but by people in third world countries solving them for pennies. The current going rate is about $1/1000 and there are easy to use captcha solving APIs for any platform. capcha has long provided an illusion of security, nothing more. Any and all captchas will be broken.

jchonphoenix 16y ago
I know the founders of reCaptcha. This is easier to prevent than you think. Its also quite rare.
- il 16y ago
  Heh, I know people who are working on breaking reCaptcha. Maybe they should get together and learn from each other. If you're saying that it's possible to prevent manual, outsourced captcha solving, I would have to strongly disagree. It's similar to the futility of DRM as an antipiracy measure. As long as I can see the captcha, I can pay someone in another country to solve it for me. I will agree that it's rare- but the most sophisticated and high-volume spammers do it, and they're the ones you have to worry about. In case people start giving me sideways glances I want to make it clear that I haven't done any blackhat stuff in a very long time, but I'm still interested in the blackhat community from a security researcher's perspective.
  - jchonphoenix 16y ago
    I'm not saying that its possible to do it in an automated way. I'm just saying that tools exist to create red flags that would make thing easily verified by a human. They have ways in which they deal with these things. All I'm saying is so far, its been working for them.
    - il 16y ago
      You're probably not going to tell me more about these tools, although I would be very curious to learn how they work. All I have is anecdotal evidence- I know several people who are making their living spamming Craigslist and outsourcing their ReCaptcha solving. Since they can make $XX per post, paying pennies for captcha is a tiny expense. I don't condone this behavior, but be aware- it happens more than you think. Anyway, probably best to take the discussion to email if you want more...perspective from the other side.