20 ms·

Many a time I receive multiple challenges on a site despite having selected all images perfectly, and can't help but wonder, "Hey, are they getting me to do mor

Many a time I receive multiple challenges on a site despite having selected all images perfectly, and can't help but wonder, "Hey, are they getting me to do more work than necessary because they're running behind on their labelling backlog?". There's definitely a conflict of incentives in this case. If you're a website owner, you're better off choosing a different service which doesn't have adverse incentives, otherwise it can affect your site experience. And please don't put captcha on GET requests. Use a CDN if you're unable to handle bot load. And don't even get me started on CDNs that throw captcha.

dmix 5y ago
Whoever made this new captcha I’m seeing starting to see everywhere: https://imgur.com/a/hoyjctl https://imgur.com/a/hoyjctl Thank you! itsso much easier than being a labeling bot for self driving cars.
- NavinF 5y ago
  That looks pretty easy for machines. I wouldn’t be surprised if CLIP could solve that out of the box. (Then again, I guess the same applies to “select all the traffic lights”)
- donkarma 5y ago
  yeah you won't be loving this one where they make you do 10 in a row and if you get one wrong you start again with 11 this time. also it'll fail you at random
zenexer 5y ago
I've noticed that some sites deliberately do this or have lousy code that fails to properly acknowledge captcha completions. Take archive.is/archive.fo/archive.today, for example. If you're using Cloudflare DNS (1.1.1.1) or iCloud Private Relay, and you visit https://archive.is/ https://archive.is/, you'll get what looks like a Cloudflare screening page. It's not, though: that page is part of archive.is and is served to Cloudflare DNS users (which includes iCloud Private Relay users)--the use of reCAPTCHA in place of hCaptcha is a giveaway. You can complete the captcha as many times as you like, but you'll never get in. And how many times have we completed a captcha on a form only to have it throw another captcha in our face without so much as an error message? Sometimes it's just lousy code.
- tough 5y ago
  I remember reading the CF founders about how archive.is didn't want cloudflare dns users to resolve to archive, so they respect that. https://news.ycombinator.com/item?id=28495204 https://news.ycombinator.com/item?id=28495204
azalemeth 5y ago
Google is _the worst_ for that. At least hCaptcha is a bit less culturally specific. Every time Google blocks me for refusing to label a motorbike as a "bicycle" I get utterly pissed off. And likewise with the traffic lights on the californian skies. Are the traffic lights the actual lights themselves, or the boom holding them up? I'm not a human very often, according to Google. hCaptcha tends to let me in...
- rosndo 5y ago
  - azalemeth 5y ago
    Don't forget that Recaptcha magically works better in Chrome, and even bettery-better if you're logged into a Google account. In FF (with tracking protection) you can expect to see the enforced wait and "Please try again". Honestly, it's awful. Half the time I have to second-guess what the average American would think which of the (noise-added, corrupted) images matches the description.
    - deadbunny 5y ago
      The reCaptcha check boxes straight up fail for me now in FF on Linux, have done for a few months.
  - geoduck14 5y ago
    Your comment suggests you would exchange money for an assassination. I know you are joking (right?), but this is not something that you should joke about.
    - rosndo 5y ago
      Oh no, I’d absolutely chip in. These people certainly deserve it.
      - 5y ago
MegaDeKay 5y ago
I've found it isn't about "perfection". It is about selecting the same tiles as an "average" person would. I might stare hard at an image, think that one of the tiles contains a tiny fragment of a traffic light, and select it. That isn't what most other people have already done, so the captcha thinks I'm a bot and gives me tougher and tougher challenges. Ever since I stopped pixel-peeping and started quickly selecting the tiles that obviously had a bus in them, the percentage of time that I've gotten by first try has gone way up.
- an_ko 5y ago
  I wonder if this means self-driving vehicles' detection of important traffic features will be at the level of an irritated and disinterested web user who is trying to just do the minimum work to please an algorithm.
  - kijin 5y ago
    Even if you're right, I doubt it's going to be much worse than the level of the average irritated driver.
  - WrtCdEvrydy 5y ago
    But it will be cheap! - The sound of 1000 business C-levels as your head gets removed by going under a truck.
  - FredPret 5y ago
    Pretty much a regular driver then!
    - _moof 5y ago
      Heck, better than a regular driver. At least what we're looking at is outside!
  - Kletiomdm 5y ago
    They probably have some statistics in the background which tells them some form of Trustlevel. You also need to assume that there are potentially control pictures in it as well. I think this is a very liable approach.
jjoonathan 5y ago
There's also a mode where it thinks you are a bot/sucker and gives you unlimited images until you give up. That's always fun.
- GameOfFrowns 5y ago
  >where it thinks you are a bot/sucker and gives you unlimited images until you give up. I frequently get these from Cloudflare when using Tor Browser. Google is basically unusable with Tor Browser.
  - deleted 5y ago
    [deleted]
- tzs 5y ago
  If anyone wants to see that, try launching the browser via Selenium. I used to do that to partially automate some activities, such as download bank statements. I'd have my Selenium using script open a browser and go to the bank, then wait for me to login and get to the account page. I'd login, dismiss any popup or interstitial promotions the bank decided to give me, get to the account page, and tell my script to continue. My script would then use Selenium to click the download button, click the "custom date range" radio button on download popup, fill in the range fields to cover the last 60 days, pick OFX for the download format, and start the download, prompting me to let it know when the download is finished. When the download finished, I could then go to one of my other accounts at that bank, tell the script I'm there, and that one gets downloaded, and so on. My bank isn't giving CAPTCHAs so that would still work if I were to get around to updating my script to deal with some redesigns they did of their pages which broke finding the relevant elements on the page. But I've found that if I do visit a site that uses hCaptcha while using the Selenium launched browser, it seems to get stuck. Click to tell it I'm not a bot. Then get an image test. Answer that correctly and get another image test. Answer that correctly. Then it goes back to the click if you are not a bot thing, and repeats--two more image tests and back to the beginning. Here's a program if anyone wants to try this and has the Selenium Webdriver package for Python3 installed. This will open a browser and take you to fanfiction.net. Trying to actually read any story will bring up the CAPTCHA. #!/usr/bin/env python3 from selenium.webdriver import Chrome driver = Chrome() driver.get("https://www.fanfiction.net") input("press enter when done") driver.close() driver.quit() I'm not sure if the looping is a Cloudflare thing or a fanfiction.net thing, because the latter is the only site I use that has Cloudflare's CAPTCHA. It used to be that if you added from selenium.webdriver import ChromeOptions and changed opening the driver to options = ChromeOptions() options.add_experimental_option("excludeSwitches", ["enable-automation"]) options.add_experimental_option('useAutomationExtension', False) options.add_argument("--disable-blink-features=AutomationControlled") driver = Chrome(options=options) you could get past the CAPTCHA, but that stopped working a while ago. There's this project to provide a Selenium Chrome driver that is supposed to not trigger anti-bot detectors [1], but it still hit the CAPTCHA loop when I tried it. [1] https://github.com/ultrafunkamsterdam/undetected-chromedriver https://github.com/ultrafunkamsterdam/undetected-chromedrive...
hnburnsy 5y ago
I have found many times that if select an incorrect tile and then unselect it before submitting, I am not presented with multiple challenges. My guess is a bot would not exhibit this behavior. Try it out next time.
- splintercell 5y ago
  Not anymore.
stefantalpalaru 5y ago
ashvant 5y ago
Usually in those cases, even if you make mistakes they get accepted. The larger the clicks, the less annotated / voted those images are, thus less severe their penalization method for wrong markings. I have observed sites that newly introduce such captcha basically accept if I just click 1/3rd of the right answers. Don't click the wrong answers as they are fully/partially introduced on purpose. It's just that you don't have to click all right answers.
Guest19023892 5y ago
I believe this is done to get answers for unsolved captchas. For example, I have a million photos of streets filled with cars, buses, motorcycles, streetlights, and crosswalks I want to add to my captcha database. I don't want to categorize them all myself, and I want the answers to be what the average person will identify, not what I or a machine will identify. So, I send everyone two captchas. One has a known answer and is required to be correct to access the service. The second captcha answer isn't yet known, so it doesn't matter what the user selects. However, when they get the known answer right, we log their answer for the unknown captcha. Once we get a large enough sample, we then have our top answers for the unknown captcha and can start using it for verification.
- flubflub 5y ago
  I always assumed that's how it works so would do the first correctly and random clicks for the second. This is as I was uninterested though doubt it is still that simple. I wonder, what are the minimum number of labels per image to ensure clean data?

dmix 5y ago

Whoever made this new captcha I’m seeing starting to see everywhere: https://imgur.com/a/hoyjctl https://imgur.com/a/hoyjctl Thank you! itsso much easier than being a labeling bot for self driving cars.

NavinF 5y ago
That looks pretty easy for machines. I wouldn’t be surprised if CLIP could solve that out of the box. (Then again, I guess the same applies to “select all the traffic lights”)
donkarma 5y ago
yeah you won't be loving this one where they make you do 10 in a row and if you get one wrong you start again with 11 this time. also it'll fail you at random

zenexer 5y ago

I've noticed that some sites deliberately do this or have lousy code that fails to properly acknowledge captcha completions. Take archive.is/archive.fo/archive.today, for example. If you're using Cloudflare DNS (1.1.1.1) or iCloud Private Relay, and you visit https://archive.is/ https://archive.is/, you'll get what looks like a Cloudflare screening page. It's not, though: that page is part of archive.is and is served to Cloudflare DNS users (which includes iCloud Private Relay users)--the use of reCAPTCHA in place of hCaptcha is a giveaway. You can complete the captcha as many times as you like, but you'll never get in. And how many times have we completed a captcha on a form only to have it throw another captcha in our face without so much as an error message? Sometimes it's just lousy code.

tough 5y ago
I remember reading the CF founders about how archive.is didn't want cloudflare dns users to resolve to archive, so they respect that. https://news.ycombinator.com/item?id=28495204 https://news.ycombinator.com/item?id=28495204

azalemeth 5y ago

Google is _the worst_ for that. At least hCaptcha is a bit less culturally specific. Every time Google blocks me for refusing to label a motorbike as a "bicycle" I get utterly pissed off. And likewise with the traffic lights on the californian skies. Are the traffic lights the actual lights themselves, or the boom holding them up? I'm not a human very often, according to Google. hCaptcha tends to let me in...

rosndo 5y ago
- azalemeth 5y ago
  Don't forget that Recaptcha magically works better in Chrome, and even bettery-better if you're logged into a Google account. In FF (with tracking protection) you can expect to see the enforced wait and "Please try again". Honestly, it's awful. Half the time I have to second-guess what the average American would think which of the (noise-added, corrupted) images matches the description.
  - deadbunny 5y ago
    The reCaptcha check boxes straight up fail for me now in FF on Linux, have done for a few months.
- geoduck14 5y ago
  Your comment suggests you would exchange money for an assassination. I know you are joking (right?), but this is not something that you should joke about.
  - rosndo 5y ago
    Oh no, I’d absolutely chip in. These people certainly deserve it.
    - 5y ago

MegaDeKay 5y ago

I've found it isn't about "perfection". It is about selecting the same tiles as an "average" person would. I might stare hard at an image, think that one of the tiles contains a tiny fragment of a traffic light, and select it. That isn't what most other people have already done, so the captcha thinks I'm a bot and gives me tougher and tougher challenges. Ever since I stopped pixel-peeping and started quickly selecting the tiles that obviously had a bus in them, the percentage of time that I've gotten by first try has gone way up.

an_ko 5y ago
I wonder if this means self-driving vehicles' detection of important traffic features will be at the level of an irritated and disinterested web user who is trying to just do the minimum work to please an algorithm.
- kijin 5y ago
  Even if you're right, I doubt it's going to be much worse than the level of the average irritated driver.
- WrtCdEvrydy 5y ago
  But it will be cheap! - The sound of 1000 business C-levels as your head gets removed by going under a truck.
- FredPret 5y ago
  Pretty much a regular driver then!
  - _moof 5y ago
    Heck, better than a regular driver. At least what we're looking at is outside!
- Kletiomdm 5y ago
  They probably have some statistics in the background which tells them some form of Trustlevel. You also need to assume that there are potentially control pictures in it as well. I think this is a very liable approach.

jjoonathan 5y ago

There's also a mode where it thinks you are a bot/sucker and gives you unlimited images until you give up. That's always fun.

GameOfFrowns 5y ago
>where it thinks you are a bot/sucker and gives you unlimited images until you give up. I frequently get these from Cloudflare when using Tor Browser. Google is basically unusable with Tor Browser.
- deleted 5y ago
  [deleted]
tzs 5y ago
If anyone wants to see that, try launching the browser via Selenium. I used to do that to partially automate some activities, such as download bank statements. I'd have my Selenium using script open a browser and go to the bank, then wait for me to login and get to the account page. I'd login, dismiss any popup or interstitial promotions the bank decided to give me, get to the account page, and tell my script to continue. My script would then use Selenium to click the download button, click the "custom date range" radio button on download popup, fill in the range fields to cover the last 60 days, pick OFX for the download format, and start the download, prompting me to let it know when the download is finished. When the download finished, I could then go to one of my other accounts at that bank, tell the script I'm there, and that one gets downloaded, and so on. My bank isn't giving CAPTCHAs so that would still work if I were to get around to updating my script to deal with some redesigns they did of their pages which broke finding the relevant elements on the page. But I've found that if I do visit a site that uses hCaptcha while using the Selenium launched browser, it seems to get stuck. Click to tell it I'm not a bot. Then get an image test. Answer that correctly and get another image test. Answer that correctly. Then it goes back to the click if you are not a bot thing, and repeats--two more image tests and back to the beginning. Here's a program if anyone wants to try this and has the Selenium Webdriver package for Python3 installed. This will open a browser and take you to fanfiction.net. Trying to actually read any story will bring up the CAPTCHA. #!/usr/bin/env python3 from selenium.webdriver import Chrome driver = Chrome() driver.get("https://www.fanfiction.net") input("press enter when done") driver.close() driver.quit() I'm not sure if the looping is a Cloudflare thing or a fanfiction.net thing, because the latter is the only site I use that has Cloudflare's CAPTCHA. It used to be that if you added from selenium.webdriver import ChromeOptions and changed opening the driver to options = ChromeOptions() options.add_experimental_option("excludeSwitches", ["enable-automation"]) options.add_experimental_option('useAutomationExtension', False) options.add_argument("--disable-blink-features=AutomationControlled") driver = Chrome(options=options) you could get past the CAPTCHA, but that stopped working a while ago. There's this project to provide a Selenium Chrome driver that is supposed to not trigger anti-bot detectors [1], but it still hit the CAPTCHA loop when I tried it. [1] https://github.com/ultrafunkamsterdam/undetected-chromedriver https://github.com/ultrafunkamsterdam/undetected-chromedrive...

hnburnsy 5y ago

I have found many times that if select an incorrect tile and then unselect it before submitting, I am not presented with multiple challenges. My guess is a bot would not exhibit this behavior. Try it out next time.

splintercell 5y ago
Not anymore.

stefantalpalaru 5y ago

ashvant 5y ago

Usually in those cases, even if you make mistakes they get accepted. The larger the clicks, the less annotated / voted those images are, thus less severe their penalization method for wrong markings. I have observed sites that newly introduce such captcha basically accept if I just click 1/3rd of the right answers. Don't click the wrong answers as they are fully/partially introduced on purpose. It's just that you don't have to click all right answers.

Guest19023892 5y ago

I believe this is done to get answers for unsolved captchas. For example, I have a million photos of streets filled with cars, buses, motorcycles, streetlights, and crosswalks I want to add to my captcha database. I don't want to categorize them all myself, and I want the answers to be what the average person will identify, not what I or a machine will identify. So, I send everyone two captchas. One has a known answer and is required to be correct to access the service. The second captcha answer isn't yet known, so it doesn't matter what the user selects. However, when they get the known answer right, we log their answer for the unknown captcha. Once we get a large enough sample, we then have our top answers for the unknown captcha and can start using it for verification.

flubflub 5y ago
I always assumed that's how it works so would do the first correctly and random clicks for the second. This is as I was uninterested though doubt it is still that simple. I wonder, what are the minimum number of labels per image to ensure clean data?