3 ms·

> Solving most of these CAPTCHAs are easy, and you could probably repurpose and retrain existing solutions given enough data. You are right that you can probab

by Closi 5y ago

> Solving most of these CAPTCHAs are easy, and you could probably repurpose and retrain existing solutions given enough data. You are right that you can probably repurpose / retrain solutions fairly quickly, but if the CAPTCHA-creators can create frameworks to create new Captcha-types fast enough (e.g. put a structure in place so it takes 1 person a day to create a new type, and you can have a team of 20 people churning out new ones constantly) then the economics of running a captcha-solving team becomes exponentially harder, and building a captcha-solver involves a lot more work. i.e. If it is quicker to create a Captcha rather than solve it, and the people who are creating the Captcha's have more resources than the Captcha-crackers, they will stay ahead. Security through obscurity is a valid strategy to slow down efforts, and will definetly help when you have teams of people working to defeat your security.

vidarh 5y ago
For many tasks it's cheap enough to hire captcha solvers. From that we should assume that a vastly larger number of tasks become cheap enough if someone trains automated solvers on the output of the human solvers. It doesn't need to be perfect either in most cases - just good enough that you can drive down cost progressively by trying an automated solver first before passing it on to a human if it fails. Ultimately you'll only stop people in those cases where the monetary value of bypassing it is very low. (EDIT: And because such solvers are reusable, you need to effectively never re-use captcha types between high-value targets and low-value targets or people will end up training solvers on high-value targets as part of paid services and they'll trickle down to lower value targets as soon as they're automated fully) Frankly, some captcha's are getting obnoxious enough that we're getting close to the point where I'd be willing to pay for a subscription service to have people solve captchas for me just for my own personal use.

by Closi 5y ago

vidarh 5y ago

For many tasks it's cheap enough to hire captcha solvers. From that we should assume that a vastly larger number of tasks become cheap enough if someone trains automated solvers on the output of the human solvers. It doesn't need to be perfect either in most cases - just good enough that you can drive down cost progressively by trying an automated solver first before passing it on to a human if it fails. Ultimately you'll only stop people in those cases where the monetary value of bypassing it is very low. (EDIT: And because such solvers are reusable, you need to effectively never re-use captcha types between high-value targets and low-value targets or people will end up training solvers on high-value targets as part of paid services and they'll trickle down to lower value targets as soon as they're automated fully) Frankly, some captcha's are getting obnoxious enough that we're getting close to the point where I'd be willing to pay for a subscription service to have people solve captchas for me just for my own personal use.