4 ms·

Hysterical: "A bot attempting to brute force a solution to the above example will need to work its way through (26)(25)(24) = 15,600 possible combinations. Aski

Hysterical: "A bot attempting to brute force a solution to the above example will need to work its way through (26)(25)(24) = 15,600 possible combinations. Asking for the identification of four unique features gives 358,800 possible combinations while 5 unique features will render 7,893,600 possible combinations"

zepolen 18y ago
Why?
- deleted 18y ago
  [deleted]
- jrockway 18y ago
  These numbers don't mean much, but it's "hilarious" because you could simply generate every image and compare them to the one on the site in about a second of CPU time. This is actually not a meaningful way to attack current CAPTCHAs, so now that I think about it... this 3D CAPTCHA would probably be less secure than the current ones that rely on OCR.
  - sratner 18y ago
    It is a meaningful way to attack many of the current captchas, if the alphabet and the space of transformations applied to it is sufficiently small. It is being done right now, in fact.
  - zepolen 18y ago
    The final image is rendered based on random variables /each time/ - Even just moving the light source would result in an entirely (from a bitmap point of view) different image. So even if you could get your hands on the 3D source file used for rendering, generating all possible images is impossible. The numbers don't refer to brute force since the answer changes on each try. If you used the same answer 'ABC' each time you'd take (assuming perfect random distribution) 15,600 tries before getting it right. I don't know about you, but after getting 15 thousand failed requests in a row from the same IP, I'd assume they were a bot ;)
    - jcl 18y ago
      While moving the light source results in different pixels, the object silhouettes don't change, and even internal edges will remain reasonably consistent under different lighting. Given an object under different lighting and vantage points, the captcha breaker can build a similar object and automatically generate a database of silhouettes from a sparsely sampled set of vantage points. Then, given a captcha image, he can search the database for an approximate silhouette match, then iteratively improve the vantage point by matching the silhouettes of nearby views. Since the vantage point and the labeled object entirely determines the captcha answer, this approach may be good enough to break the captcha. A more dynamic scene would be more challenging for this approach, but it would also be more difficult for the server to come up with human-solvable scenes.
      - zepolen 18y ago
        You are describing object recognition, which even on just a 2D static image is an insanely hard to get working correctly (I have experience as it was my university project). However in a 3D context there is no way a computer can infer what an object would look from a different vantage point, since not even a human can do this. For example, looking at a CRT and an LCD head on, would give you the same image - but would give you no information about the depth of the monitor. Multiple view points would help the computer figure out the full three dimensional object, but then again, object recognition comes into play, which object is which? This system works with humans because we have good 3D object recognition and a huge database of experience with which to compare it against, all of which is calculated in an instant. Replicating that behaviour in a computer is still a long way away.
        jcl 18y ago
        I realize that the general problem of object recognition can be arbitrarily difficult, but so is the general problem of text recognition: How can a computer determine if a downward stroke is a one, or a lowercase L, or an uppercase I? And yet the text-recognition captchas have been broken -- not because the problem is easy but because captcha breakers have exploited artifacts of individual captchas to get a correct answer a modest percentage of the time. The 3D captcha (as the article author described it) is highly constrained -- a small library of objects in static poses -- so it has similarly exploitable artifacts. The captcha-breaking computer has no need to infer what an object would look like from another view if someone has already manually reproduced the library of models; in that case the problem reduces to identifying which models from the library are in the picture and what angle they are being viewed from. Although the problem is no doubt difficult, the silhouette strategy I described is similar to other published object recognition approaches known to work, e.g.: http://citeseer.ist.psu.edu/bandlow98recognising.html http://citeseer.ist.psu.edu/bandlow98recognising.html And the approach doesn't need to work perfectly: the captcha breaker is only interested in improving his chances of guessing correctly. If an automated approach only guesses correctly even 20% of the time, the captcha is effectively broken. In the case where two images of objects are very similar -- like your CRT vs. LCD example -- even a human would have difficulty differentiating. By definition that makes these objects bad for the captcha, so the captcha author would either leave them out of the library of objects, or he would need to make the captcha more tolerant of human error, which makes things easier for the captcha-breaker.
froo 18y ago
This situation reminds me of a Simpson's quote funnily enough.. let me see if I can dig it up. Lisa: What have you done with my report? Bart: I've hidden it. To find it you'll need to decipher a series of clues, each more fiendish than... Lisa: Got it! Bart: D'oh!

zepolen 18y ago

Why?

deleted 18y ago
[deleted]
jrockway 18y ago
These numbers don't mean much, but it's "hilarious" because you could simply generate every image and compare them to the one on the site in about a second of CPU time. This is actually not a meaningful way to attack current CAPTCHAs, so now that I think about it... this 3D CAPTCHA would probably be less secure than the current ones that rely on OCR.
- sratner 18y ago
  It is a meaningful way to attack many of the current captchas, if the alphabet and the space of transformations applied to it is sufficiently small. It is being done right now, in fact.
- zepolen 18y ago
  The final image is rendered based on random variables /each time/ - Even just moving the light source would result in an entirely (from a bitmap point of view) different image. So even if you could get your hands on the 3D source file used for rendering, generating all possible images is impossible. The numbers don't refer to brute force since the answer changes on each try. If you used the same answer 'ABC' each time you'd take (assuming perfect random distribution) 15,600 tries before getting it right. I don't know about you, but after getting 15 thousand failed requests in a row from the same IP, I'd assume they were a bot ;)
  - jcl 18y ago
    While moving the light source results in different pixels, the object silhouettes don't change, and even internal edges will remain reasonably consistent under different lighting. Given an object under different lighting and vantage points, the captcha breaker can build a similar object and automatically generate a database of silhouettes from a sparsely sampled set of vantage points. Then, given a captcha image, he can search the database for an approximate silhouette match, then iteratively improve the vantage point by matching the silhouettes of nearby views. Since the vantage point and the labeled object entirely determines the captcha answer, this approach may be good enough to break the captcha. A more dynamic scene would be more challenging for this approach, but it would also be more difficult for the server to come up with human-solvable scenes.
    - zepolen 18y ago
      You are describing object recognition, which even on just a 2D static image is an insanely hard to get working correctly (I have experience as it was my university project). However in a 3D context there is no way a computer can infer what an object would look from a different vantage point, since not even a human can do this. For example, looking at a CRT and an LCD head on, would give you the same image - but would give you no information about the depth of the monitor. Multiple view points would help the computer figure out the full three dimensional object, but then again, object recognition comes into play, which object is which? This system works with humans because we have good 3D object recognition and a huge database of experience with which to compare it against, all of which is calculated in an instant. Replicating that behaviour in a computer is still a long way away.
      - jcl 18y ago
        I realize that the general problem of object recognition can be arbitrarily difficult, but so is the general problem of text recognition: How can a computer determine if a downward stroke is a one, or a lowercase L, or an uppercase I? And yet the text-recognition captchas have been broken -- not because the problem is easy but because captcha breakers have exploited artifacts of individual captchas to get a correct answer a modest percentage of the time. The 3D captcha (as the article author described it) is highly constrained -- a small library of objects in static poses -- so it has similarly exploitable artifacts. The captcha-breaking computer has no need to infer what an object would look like from another view if someone has already manually reproduced the library of models; in that case the problem reduces to identifying which models from the library are in the picture and what angle they are being viewed from. Although the problem is no doubt difficult, the silhouette strategy I described is similar to other published object recognition approaches known to work, e.g.: http://citeseer.ist.psu.edu/bandlow98recognising.html http://citeseer.ist.psu.edu/bandlow98recognising.html And the approach doesn't need to work perfectly: the captcha breaker is only interested in improving his chances of guessing correctly. If an automated approach only guesses correctly even 20% of the time, the captcha is effectively broken. In the case where two images of objects are very similar -- like your CRT vs. LCD example -- even a human would have difficulty differentiating. By definition that makes these objects bad for the captcha, so the captcha author would either leave them out of the library of objects, or he would need to make the captcha more tolerant of human error, which makes things easier for the captcha-breaker.

froo 18y ago

This situation reminds me of a Simpson's quote funnily enough.. let me see if I can dig it up. Lisa: What have you done with my report? Bart: I've hidden it. To find it you'll need to decipher a series of clues, each more fiendish than... Lisa: Got it! Bart: D'oh!