4 ms·

Was curious about the "text captcha" service. It's a collection of questions with MD5 sums of acceptable answers. They provide an API, but I think this is a c

Was curious about the "text captcha" service. It's a collection of questions with MD5 sums of acceptable answers. They provide an API, but I think this is a case of a project being a "service" to keep the database of questions from being free. There's no technical reason for this to be a service, and it's not a terribly complicated product that would be difficult to scale. It's a static database! Might be neat to create an open-source bank of these CAPTCHA questions. Maybe I'll throw something together this weekend.

elliottcarlson 16y ago
Wouldn't an open-source bank of CAPTCHA questions open the door for an open-source bank of answers to these questions?
- joelvh 16y ago
  Ha! Valid point!
- torme 16y ago
  Yeah, exactly, I think this is why it necessitates it being a service and kind of assume that it's not a static database for that reason. If you have a fixed list of questions, it's easy to get answers to those once and never have to do it again. Again, I think its a safe assumption that these are in some way generated on the fly.
- joelvh 16y ago
  If you were able to analyze the sentence structure of all 180 million questions, how many different sentence structures would there be? This all points to the fact that you can build algorithms to guess the answers eventually.
  - elliottcarlson 16y ago
    Not even just guess them but accurately determine them. A few years back I was hired by a third party to build a system to break the CAPTCHA on a popular site for various evil deeds. Morals set aside, the money was good and I had a wedding to pay for. A CAPTCHA system becomes quite breakable when it becomes predictable. The system in question used an image based CAPTCHA that used the same (albeit annoying) font for each image, as well as a static distortion overlay and a second set of random distortion. By extracting a thousand sample images I was able to build a system in Perl that could determine the text with an estimated 98% success rate - and when it failed you would just request a new CAPTCHA. My solution would be to mix up images with logic. I.E. In the following list of images, which image number contains the green animal: {pic of zebra}, {pic of frog}, {pic of giraffe} This would require image recognition as well as logic.
    - moshezadka 16y ago
      It can't work the way you explained it: I just solved your CAPTCHA with 33% success rate (waaay too high for a useful CAPTCHA). Perhaps if you ask for "the three pictures of X animal out of those 9", and you had a database with which animal has which property (and you also ran some fuzz over the images so no two images would ever be the same). I'm still skeptical...
      - elliottcarlson 16y ago
        That would assume that it is multiple choice - however if it's still free form text input, requiring the input to equal "frog" would solve that issue. Text + images + logic would offer a lot more hurdles than just any single one of those.
    - joelvh 16y ago
      Interestingly enough, WolframAlpha can generate a CAPTCHA image of each of these text questions, as to make it harder for a bot to decode AND answer the question! Check it out: http://www.wolframalpha.com/input/?i=CAPTCHA+What+is+seven+hundred+and+forty+four+as+a+number%3F http://www.wolframalpha.com/input/?i=CAPTCHA+What+is+seven+h...
- jluxenberg 16y ago
  No, that's the reason the answers are hashed. You can't get the answer from the hash, since a hash is a one-way function. This is the same reason you never store passwords in your database in plaintext, but rather hash them first.
  - elliottcarlson 16y ago
    That's not the issue - as soon as you make a list of questions available for the world, all it takes is one spammer to create a matching list of answers and they can go to town. By providing that list of answers as open source you are making it easier for someone to create the counter part answer database.
    - joelvh 16y ago
      Exactly!
    - nodata 16y ago
      http://xkcd.com/810/ http://xkcd.com/810/
      - eru 16y ago
        http://xkcdexplained.com/post/1395792545/constructive http://xkcdexplained.com/post/1395792545/constructive
        archgoon 16y ago
        Captchas are not restricted to reddit and social news site, despite what your link claims.
        eru 16y ago
        Oh, that was just to make fun of xkcd. I don't think xkcd links are really that good an addition to a discussion here.
  - 16y ago
joelvh 16y ago
Also think about the way algorithms (like WolframAlpha) interpret the structure of the questions. Like some of the other commenters, switching some words around makes WolframAlpha fail. It might be interesting to come up with a methodology for question structure that is harder for algorithms to interpret...?
_JC_ 16y ago
http://jclg.fr/projects/textcaptchahack/ http://jclg.fr/projects/textcaptchahack/ Just tell me if you need the source code ;P

elliottcarlson 16y ago

Wouldn't an open-source bank of CAPTCHA questions open the door for an open-source bank of answers to these questions?

joelvh 16y ago
Ha! Valid point!
torme 16y ago
Yeah, exactly, I think this is why it necessitates it being a service and kind of assume that it's not a static database for that reason. If you have a fixed list of questions, it's easy to get answers to those once and never have to do it again. Again, I think its a safe assumption that these are in some way generated on the fly.
joelvh 16y ago
If you were able to analyze the sentence structure of all 180 million questions, how many different sentence structures would there be? This all points to the fact that you can build algorithms to guess the answers eventually.
- elliottcarlson 16y ago
  Not even just guess them but accurately determine them. A few years back I was hired by a third party to build a system to break the CAPTCHA on a popular site for various evil deeds. Morals set aside, the money was good and I had a wedding to pay for. A CAPTCHA system becomes quite breakable when it becomes predictable. The system in question used an image based CAPTCHA that used the same (albeit annoying) font for each image, as well as a static distortion overlay and a second set of random distortion. By extracting a thousand sample images I was able to build a system in Perl that could determine the text with an estimated 98% success rate - and when it failed you would just request a new CAPTCHA. My solution would be to mix up images with logic. I.E. In the following list of images, which image number contains the green animal: {pic of zebra}, {pic of frog}, {pic of giraffe} This would require image recognition as well as logic.
  - moshezadka 16y ago
    It can't work the way you explained it: I just solved your CAPTCHA with 33% success rate (waaay too high for a useful CAPTCHA). Perhaps if you ask for "the three pictures of X animal out of those 9", and you had a database with which animal has which property (and you also ran some fuzz over the images so no two images would ever be the same). I'm still skeptical...
    - elliottcarlson 16y ago
      That would assume that it is multiple choice - however if it's still free form text input, requiring the input to equal "frog" would solve that issue. Text + images + logic would offer a lot more hurdles than just any single one of those.
  - joelvh 16y ago
    Interestingly enough, WolframAlpha can generate a CAPTCHA image of each of these text questions, as to make it harder for a bot to decode AND answer the question! Check it out: http://www.wolframalpha.com/input/?i=CAPTCHA+What+is+seven+hundred+and+forty+four+as+a+number%3F http://www.wolframalpha.com/input/?i=CAPTCHA+What+is+seven+h...
jluxenberg 16y ago
No, that's the reason the answers are hashed. You can't get the answer from the hash, since a hash is a one-way function. This is the same reason you never store passwords in your database in plaintext, but rather hash them first.
- elliottcarlson 16y ago
  That's not the issue - as soon as you make a list of questions available for the world, all it takes is one spammer to create a matching list of answers and they can go to town. By providing that list of answers as open source you are making it easier for someone to create the counter part answer database.
  - joelvh 16y ago
    Exactly!
  - nodata 16y ago
    http://xkcd.com/810/ http://xkcd.com/810/
    - eru 16y ago
      http://xkcdexplained.com/post/1395792545/constructive http://xkcdexplained.com/post/1395792545/constructive
      - archgoon 16y ago
        Captchas are not restricted to reddit and social news site, despite what your link claims.
        eru 16y ago
        Oh, that was just to make fun of xkcd. I don't think xkcd links are really that good an addition to a discussion here.
- 16y ago

joelvh 16y ago

Also think about the way algorithms (like WolframAlpha) interpret the structure of the questions. Like some of the other commenters, switching some words around makes WolframAlpha fail. It might be interesting to come up with a methodology for question structure that is harder for algorithms to interpret...?

_JC_ 16y ago

http://jclg.fr/projects/textcaptchahack/ http://jclg.fr/projects/textcaptchahack/ Just tell me if you need the source code ;P