Hacker News Search

Hamuko 5y ago
The first version of reCAPTCHA made it very obvious as to which word was the classified one and which was the unclassified one, so people had a pretty easy way to inject bad data into the process.
- Sohcahtoa82 5y ago
  Yeah, I remember my days on 4chan where people kept posting a campaign to substitute a racial slur for the one that looked unclassified.
Spare_account 5y ago
One of my hobbies is figuring out which captcha prompts are the unclassified data so that I can answer wrong and stick it to the man.

kkcorps 5y ago

Makes sense since other than the ones mentioned I received a lot of crosswalks, traffic lights and bicycles.

q1w2 5y ago
It's odd that it never asks for pedestrians.

danjac 5y ago

When they start doing captchas along the lines of "check all pictures of potential terrorists" we'll know they're training data sets for military drone manufacturers.

intricatedetail 5y ago
- d82nsjk9 5y ago
  How so?
  - finiteseries 5y ago
    They’re implying having recorded video of a bunch of westerners on TikTok = western recognition tech.
    - intricatedetail 5y ago
      And metadata.
- deleted 5y ago
  [deleted]
- NavinF 5y ago
  Pretty sure they could have done that with just YouTube and Twitch lol
  - intricatedetail 5y ago
    these platforms don't give access to personal data that they can use to aid training.
zxcvbn4038 5y ago
That wouldn't work well. I was in Texas during 9/11 and they were firebombing all the hispanic people's cars because the locals don't really have a good eye for different ethnicities. Its pretty much black/white/terrorist and hasn't improved all that much in the time since. Austin has grown a lot since I lived there are a lot of people from outside Texas have moved there so I'm sure the culture has changed - but when I was there going from north Austin to south Austin seemed to be this epic trip the locals would only do on a weekend -- and probably pack water and sandwiches for the drive across town. A really exotic senior trip "abroad" for students might be to Houston or Galveston. You probably met your future spouse in grade school. Not very worldly.
- dfee 5y ago
  This sounds nothing like my experience living in Austin 2009-2017. In fact, this is unrecognizable. > they were firebombing all the hispanic people's cars Weird. This is sort of unbelievable. I think I know many Hispanics who lived in ATX during 2001, but they’ve never mentioned their car being firebombed.
  - dylan604 5y ago
    The only part of that story that sounds plausible was: >>You probably met your future spouse in grade school. Not very worldly.
    - JasonFruit 5y ago
      That sounds nice though.
      - dylan604 5y ago
        Not sure how serious you are, but on the chance you are... The meeting spouse in grade school/not worldly typically implies not leaving the area they grew up in at any point. I grew up in a smallish town where this happens frequently. So many people never leave the state let alone the country. Some people never even left the county. Their biggest travel is for school sporting events. In otherwords, it's not really a term of endearment as much as another "bless your heart"
        JasonFruit 5y ago
        I still think it sounds nice. Is the place you grew up intrinsically so much worse than the rest of the world? Would it be so bad to be invested in a single community for a lifetime, and to have a deep connection to the people there? I feel like I lack that, deep connections where the pull of cultural influence goes both ways. I'm not convinced that the cosmopolitan breadth of experience we may have gained outweighs the deep experience of locality that we sacrificed to get it.
__s 5y ago
They already are https://www.theguardian.com/technology/2018/mar/07/google-ai-us-department-of-defense-military-drone-project-maven-tensorflow https://www.theguardian.com/technology/2018/mar/07/google-ai...
collegeburner 5y ago
https://img.ifunny.co/images/d36b2c891b620a864e87a57b869e84228df1724b0e4b0ac311569d7c5d0871db_1.jpg https://img.ifunny.co/images/d36b2c891b620a864e87a57b869e842...
bell-cot 5y ago
It'd be nice if the military actually cared enough about drone targets to even attempt this...

potamic 5y ago

Many a time I receive multiple challenges on a site despite having selected all images perfectly, and can't help but wonder, "Hey, are they getting me to do more work than necessary because they're running behind on their labelling backlog?". There's definitely a conflict of incentives in this case. If you're a website owner, you're better off choosing a different service which doesn't have adverse incentives, otherwise it can affect your site experience. And please don't put captcha on GET requests. Use a CDN if you're unable to handle bot load. And don't even get me started on CDNs that throw captcha.

dmix 5y ago
Whoever made this new captcha I’m seeing starting to see everywhere: https://imgur.com/a/hoyjctl https://imgur.com/a/hoyjctl Thank you! itsso much easier than being a labeling bot for self driving cars.
- NavinF 5y ago
  That looks pretty easy for machines. I wouldn’t be surprised if CLIP could solve that out of the box. (Then again, I guess the same applies to “select all the traffic lights”)
- donkarma 5y ago
  yeah you won't be loving this one where they make you do 10 in a row and if you get one wrong you start again with 11 this time. also it'll fail you at random
zenexer 5y ago
I've noticed that some sites deliberately do this or have lousy code that fails to properly acknowledge captcha completions. Take archive.is/archive.fo/archive.today, for example. If you're using Cloudflare DNS (1.1.1.1) or iCloud Private Relay, and you visit https://archive.is/ https://archive.is/, you'll get what looks like a Cloudflare screening page. It's not, though: that page is part of archive.is and is served to Cloudflare DNS users (which includes iCloud Private Relay users)--the use of reCAPTCHA in place of hCaptcha is a giveaway. You can complete the captcha as many times as you like, but you'll never get in. And how many times have we completed a captcha on a form only to have it throw another captcha in our face without so much as an error message? Sometimes it's just lousy code.
- tough 5y ago
  I remember reading the CF founders about how archive.is didn't want cloudflare dns users to resolve to archive, so they respect that. https://news.ycombinator.com/item?id=28495204 https://news.ycombinator.com/item?id=28495204
azalemeth 5y ago
Google is _the worst_ for that. At least hCaptcha is a bit less culturally specific. Every time Google blocks me for refusing to label a motorbike as a "bicycle" I get utterly pissed off. And likewise with the traffic lights on the californian skies. Are the traffic lights the actual lights themselves, or the boom holding them up? I'm not a human very often, according to Google. hCaptcha tends to let me in...
- rosndo 5y ago
  - azalemeth 5y ago
    Don't forget that Recaptcha magically works better in Chrome, and even bettery-better if you're logged into a Google account. In FF (with tracking protection) you can expect to see the enforced wait and "Please try again". Honestly, it's awful. Half the time I have to second-guess what the average American would think which of the (noise-added, corrupted) images matches the description.
    - deadbunny 5y ago
      The reCaptcha check boxes straight up fail for me now in FF on Linux, have done for a few months.
  - geoduck14 5y ago
    Your comment suggests you would exchange money for an assassination. I know you are joking (right?), but this is not something that you should joke about.
    - rosndo 5y ago
      Oh no, I’d absolutely chip in. These people certainly deserve it.
      - 5y ago
MegaDeKay 5y ago
I've found it isn't about "perfection". It is about selecting the same tiles as an "average" person would. I might stare hard at an image, think that one of the tiles contains a tiny fragment of a traffic light, and select it. That isn't what most other people have already done, so the captcha thinks I'm a bot and gives me tougher and tougher challenges. Ever since I stopped pixel-peeping and started quickly selecting the tiles that obviously had a bus in them, the percentage of time that I've gotten by first try has gone way up.
- an_ko 5y ago
  I wonder if this means self-driving vehicles' detection of important traffic features will be at the level of an irritated and disinterested web user who is trying to just do the minimum work to please an algorithm.
jjoonathan 5y ago
There's also a mode where it thinks you are a bot/sucker and gives you unlimited images until you give up. That's always fun.
- GameOfFrowns 5y ago
  >where it thinks you are a bot/sucker and gives you unlimited images until you give up. I frequently get these from Cloudflare when using Tor Browser. Google is basically unusable with Tor Browser.
  - deleted 5y ago
    [deleted]
- tzs 5y ago
  If anyone wants to see that, try launching the browser via Selenium. I used to do that to partially automate some activities, such as download bank statements. I'd have my Selenium using script open a browser and go to the bank, then wait for me to login and get to the account page. I'd login, dismiss any popup or interstitial promotions the bank decided to give me, get to the account page, and tell my script to continue. My script would then use Selenium to click the download button, click the "custom date range" radio button on download popup, fill in the range fields to cover the last 60 days, pick OFX for the download format, and start the download, prompting me to let it know when the download is finished. When the download finished, I could then go to one of my other accounts at that bank, tell the script I'm there, and that one gets downloaded, and so on. My bank isn't giving CAPTCHAs so that would still work if I were to get around to updating my script to deal with some redesigns they did of their pages which broke finding the relevant elements on the page. But I've found that if I do visit a site that uses hCaptcha while using the Selenium launched browser, it seems to get stuck. Click to tell it I'm not a bot. Then get an image test. Answer that correctly and get another image test. Answer that correctly. Then it goes back to the click if you are not a bot thing, and repeats--two more image tests and back to the beginning. Here's a program if anyone wants to try this and has the Selenium Webdriver package for Python3 installed. This will open a browser and take you to fanfiction.net. Trying to actually read any story will bring up the CAPTCHA. #!/usr/bin/env python3 from selenium.webdriver import Chrome driver = Chrome() driver.get("https://www.fanfiction.net") input("press enter when done") driver.close() driver.quit() I'm not sure if the looping is a Cloudflare thing or a fanfiction.net thing, because the latter is the only site I use that has Cloudflare's CAPTCHA. It used to be that if you added from selenium.webdriver import ChromeOptions and changed opening the driver to options = ChromeOptions() options.add_experimental_option("excludeSwitches", ["enable-automation"]) options.add_experimental_option('useAutomationExtension', False) options.add_argument("--disable-blink-features=AutomationControlled") driver = Chrome(options=options) you could get past the CAPTCHA, but that stopped working a while ago. There's this project to provide a Selenium Chrome driver that is supposed to not trigger anti-bot detectors [1], but it still hit the CAPTCHA loop when I tried it. [1] https://github.com/ultrafunkamsterdam/undetected-chromedriver https://github.com/ultrafunkamsterdam/undetected-chromedrive...
hnburnsy 5y ago
I have found many times that if select an incorrect tile and then unselect it before submitting, I am not presented with multiple challenges. My guess is a bot would not exhibit this behavior. Try it out next time.
- splintercell 5y ago
  Not anymore.
stefantalpalaru 5y ago
ashvant 5y ago
Usually in those cases, even if you make mistakes they get accepted. The larger the clicks, the less annotated / voted those images are, thus less severe their penalization method for wrong markings. I have observed sites that newly introduce such captcha basically accept if I just click 1/3rd of the right answers. Don't click the wrong answers as they are fully/partially introduced on purpose. It's just that you don't have to click all right answers.
Guest19023892 5y ago
I believe this is done to get answers for unsolved captchas. For example, I have a million photos of streets filled with cars, buses, motorcycles, streetlights, and crosswalks I want to add to my captcha database. I don't want to categorize them all myself, and I want the answers to be what the average person will identify, not what I or a machine will identify. So, I send everyone two captchas. One has a known answer and is required to be correct to access the service. The second captcha answer isn't yet known, so it doesn't matter what the user selects. However, when they get the known answer right, we log their answer for the unknown captcha. Once we get a large enough sample, we then have our top answers for the unknown captcha and can start using it for verification.
- flubflub 5y ago
  I always assumed that's how it works so would do the first correctly and random clicks for the second. This is as I was uninterested though doubt it is still that simple. I wonder, what are the minimum number of labels per image to ensure clean data?

hnthrowaway0315 5y ago

I wonder if there is a way to pollute the data. Since I always click the captchas correctly, what happens if someone just randomly clicks stuffs? Is he/she banned from the website?

pastullo 5y ago
Glad you asked. Since i despise the horrible UX of these Captcha where i get exploited to train a neural network, i very often click on the majority of correct result plus one wrong one. On average the captcha let me go through which is actually very scary, since it looks like it prioritize algorithm training over bot detection... Does anyone else do this?
- arbitrage 5y ago
  No, because it is a waste of time. Your answer set is compared with many other answers, and eventually the wrong answer is disregarded completely by the AI. You gave it a mostly correct answer, which it can cope with -- by design. It let you through, after all. You're not really accomplishing anything by being defiant, other than making yourself feel slightly better.
  - pastullo 5y ago
    Fully agree that the system propose the same challenge to many people and fully agree that my wrong answer is just diluted in a bunch of correct answers. That's exactly why i was asking if other people were doing that. If i'm the only one..then yes, it's only useful for myself to fell less like a exploited brain, but if say 20% of the people start dumping random error on purpose...than the situation changes quite a lot...and potentially even the business model of shit-captcha might not work.
    - wizzwizz4 5y ago
      If they do the same kinds of error, yeah.
  - umeshunni 5y ago
    > You're not really accomplishing anything by being defiant, other than making yourself feel slightly better. Isn't that the goal of all virtue signaling?
  - hnthrowaway0315 5y ago
    Maybe someone can build a re-capture extension for Chrome/Firefox so that more people can join the fun. But again it needs to train data first :D
jokethrowaway 5y ago
If I were to make this system I would design for this and present the same captcha to a high number of people. The higher the number of people, the lower the chance someone would make a mistake (intentionally or not) and the higher the confidence in the results.
- pastullo 5y ago
  of course bro, i'm sure that no self-driving car is gonna crash as soon as i deliberatly click on the wrong bicycle picture.
  - jazzyjackson 5y ago
    lol I'm imagining a captcha that says "please hurry" to disambiguate a situation in realtime
    - MauranKilom 5y ago
      https://xkcd.com/1897/ https://xkcd.com/1897/
      - wyre 5y ago
        “Twitch plays drive an autonomous vehicle”

jokethrowaway 5y ago

I disagree, Google captchas in my experience are much quicker compared to hcaptcha When cloudflare switched to hcaptcha I definitely noticed it.

SXX 5y ago
Sorry, but Google captcha is specifically designed to annoy real people in some cases. They literally implemented slow fade-in / fade-out for images. This does absolutely nothing against actual bots, but annoying as hell for a real person. Literally any other captcha is better than this.
- jandrese 5y ago
  I thought the fade thing was specifically to trip up bots. Like bots know what the picture is long before it is shown to the user, so if the bot clicks on it then the CAPCHA knows something is up.
  - justsomehnguy 5y ago
    Which is solved exactly after this is encountered the first time, eg if opacity -ne 100% do_not_click_yet = true So this is totally useless to prevent bots from solving it.
    - pbhjpbhj 5y ago
      Surely then they look at timing, people will click anywhere from, let's say 50% opacity, but bots always wait?
      - bluGill 5y ago
        Easy for a bot to fake that with a random number generator. If nothing else bot authors can collect their own statistics. I understand the bots have an army of people in the background for images they don't understand yet, just collect timing data from that set and have your random number generator emulate that timing data. (I'm guessing a bell curve)
        SXX 5y ago
        Actually having army of people it's exactly how complex recaptha's are bypassed. It's less than $1 for 1000 captcha: https://anti-captcha.com/ https://anti-captcha.com/ There of course options with image recognition, but they're less reliable.
        azalemeth 5y ago
        Honestly, that service looks like something I'm almost tempted to pay for myself. $1 per 1000 recaptchas is a lot cheaper than how I value my time, at the very least. It's not like google couldn't pay people to do these ML training datasets; I resent giving them free labour.
        SXX 5y ago
        Unfortunately I doubt that "recaptcha solver" can be built as browser extension. Most of advanced bots for parsing automation built on proprietary platforms like ZennoPoster and they basically heavily modify Firefox / Chromium. Also latency of human-recognition service is quite high so while you wouldn't need to solve it you'll need to wait for number of seconds anyway.
        bluGill 5y ago
        I wonder if we could get Firefox to automatically solve them. That is in the main version so nobody has to see those stupid things again.
        SXX 5y ago
        Few years ago back when I created such bots I had similar idea . For certain this can't be mainlined. And if we talk about extensions then at least in past extension code didnt have enough capacities to automatically bypass recaptchas. This would require fake mouse pointer control and it's obviously not one of features that extension api expose.
      - SXX 5y ago
        Do you seriously think that people who programm the bots incapable of taking it into account? Bypass for this fading was obviously implementrd next day this first appear on reCaptcha.
        Rastonbury 5y ago
        Isn't it more for rate limiting?
        SXX 5y ago
        You dont need fade-in / fade-out effects for rate limiting. Bots are obviously get to see images instantly once they're returned by the server as they dont need to wait for fade-in to complete. Because bots API is injected into browser internals instead. If rate limiting is needed there is always CloudFlare way where you're literally show user "wait" and refresh page a bit later. This is annoying, but nowhere as much as reCaptcha fading is.
- deleted 5y ago
  [deleted]
notatoad 5y ago
people tend to have very different experiences with google captchas based on how normal they are. if you block everything and try to anonymize your browsing as much as possible and otherwise do everything you can to look like a bot, you're going to get a very difficult captcha to somebody with all their browser settings on default.
- throwawayboise 5y ago
  Yeah I do my routine browsing in private mode, no 3rd party cookies, no history, and an ad blocker. I get captchas everwhere.
- jorvi 5y ago
  Yup. This reminds me of the ‘introduction’ of an old hacker simulation game from 2004 that was quite prescient. “ In the year 2012, the corporations of the world paved over the Internet, designing their own network system. Keeping the same name, they developed a system where every piece of information was audited and paid for before it was passed on to the world at large. Those who still followed the ideology of an open and uncontrolled Internet gathered what resources they could and formed the SwitchNet. Build mostly out of discarded technologies and backdoors in the current Internet, it allowed some manner of uncontrolled communication around the world. The "Hacker Outpost" is in need of new recruits to perform missions in information gathering against the corporations, which will allow them to increase the presence of the SwitchNet in the world.” And the slightly different press release one: “ In 2012, a new Internet was introduced--one that prohibited users from posting anything on personal home pages, prohibited them from using software of their choice, and from having an e-mail address. Having no place to stay, hackers created the SwitchNet, an underground network operating on the old wires and infrastructure of the original Internet”

luckydata 5y ago

That's about as much attention the average driver pays anyways. I drive a motorcycle, I KNOW that.

Shared404 5y ago
That's an interesting idea - maybe it would be smart to have captcha's do a "Point out all the motorcycles" or "Click all the pedestrians" setup.
- pbhjpbhj 5y ago
  I love a rant on this one... Sometimes the bus/boat/truck has motorbikes sometimes bicycles. Is that a petrol-powered bicycle, or a motorbike to the [USAmerican?] person who wrote the rules!? Are all large yellow vehicles buses in USA or do you have minibuses, oh wait, are minibuses buses. I've worked out fire engines are trucks for captchas, not sure about Transit-type vehicles, lorries are trucks apparently but goods trucks on railways are not trucks! Is a traffic light only the lens/led array or the black light-holder too? Do pedestrian lights count as traffic lights? Are those weird lights hanging in the middle of junctions 'traffic lights'. Wish they'd just tell you what counts. I have noticed that times I realise after clicking that I missed a square they tend to go through whilst many times I get repeated captchas when I know I got it right. Success, as a user, seems impossible to predict.
  - HeyLaughingBoy 5y ago
    > lorries are trucks apparently but goods trucks on railways are not trucks! In the US, lorry == truck. Never heard the term goods truck before today, but I think it's what we call a boxcar.
    - perl4ever 5y ago
      A "truck" on a railway car is apparently a "bogie" in the UK. A bogie in India seems to be a railway car in the US. Then there are intermodal containers, smaller than boxcars, I think they are hauled by truck (lorry) after being unloaded from a flatcar.
      - HeyLaughingBoy 5y ago
        > flatcar AKA "flatbed" or "flatbed trailer" :-)
_moof 5y ago
I was always tempted to knock on people's driver-side windows when I saw them looking at their phone. Never did - figured they'd probably startle, with a non-zero chance they'd accidentally fling the car into me.
- HeyLaughingBoy 5y ago
  I yell at them. Loudly! Loud enough that people a block away turn to look. But then, when you're staring at your phone while driving your car out of a parking lot and across the sidewalk where you only miss hitting me (before driving into oncoming traffic!) because I stopped, well you deserve that minor inconvenience of being embarrassed.