4 ms·
One thing that the author has clearly misunderstood is the following: "I must admit, I do feel a bit sorry for the folks sitting there endlessly solving a neve
by TheSeb 15y ago
One thing that the author has clearly misunderstood is the following:
"I must admit, I do feel a bit sorry for the folks sitting there endlessly solving a never ending stream of CAPTCHAs; frankly, just one drives me a bit nuts! But what must have been even worse – and I need to take some blame here – is that while testing I kept submitting the same CAPTCHA over and over and over again. I can picture the poor operator sitting there thinking “WTF is this guy doing already?!” Then again, maybe they made some quick bucks because recognising the same pattern time and again becomes more efficient."
For the majority of the captcha solving services out there the same captcha is just solved ONCE. When a request is submitted to the API the image data is typically read from the image file and encoded in Base64 or in a similar format. The Base64 string representing the image is then sent to the captcha API.
The API will use the Base64 string as a key and check if it exists in a database/key-value store. If it exists, return the value for the Base64 string, if it doesn't exist, send it to one of the available workers. When the captcha is solved by a worker it is saved in the database. If someone would send in the same captcha next time (thus resulting in an identical Base64-encoded string representation of the image), the solved captcha text would just be sent back without any human interference.
I talked to one guy running one of these services a while ago and they set it up the following way:
1. Requests are sent using JSON to their API.
2. The Base64-encoded string representation of the image is checked against Redis to see if it has already been solved. If it has, return it to the client requesting it. Award the person who originally solved it 50% of the fee that the client is paying for it (thus enabling these captcha solvers to earn some kind of passive income).
3. If it hasn't been solved, run it through OCR-software. Is the result reliable enough? Save it in redis and return it to the client.
4. Is the OCR result not reliable enough? Send it off to a human worker. The worker solves the captcha, the captcha text is saved in Redis as a value associated with the key (the original Base64-representation of the image). Award the worker 75% of the fee the client paid. Return the solved captcha text to the client.
5. Deal with invalid captchas (remove entry from Redis, subtract from due commission to worker etc.)
6. Rinse and repeat. Scale with more servers + more workers.
Pretty cool stuff :D
- shalmanese 15y agoIf that were the case, why did he get a 94% success rate with the same image?
- TheSeb 15y agoDid I say that all captcha solving services work the way I described? I said "most of them". Haven't tried the service he was using but I've used quite a few other providers.
- user24 15y agoBut the captcha is randomly distorted afresh each time, so each captcha image will never have been seen before. You'll never get an exact hash match unless you're looking at an extremely naive implementation.
- TheSeb 15y agoDepends on the implementation, just as you suggested. There are actually quite a few sites that use really simple captchas that don't randomly destort letter placements, lines, colors etc.
- troyhunt 15y agoDuring my testing, I literally had a saved bitmap on my local machine which I reissued many, many times. Obviously this meant it was an exact match on each submission.
- user24 15y agobut that's obviously an edge case rather than something you'd optimise for in the system.
- troyhunt 15y agoInteresting insight, thanks for that. I suppose the success of that strategy depends on both the frequency with which CAPTCHAs are reused and the practicality of storing the encoded previous CAPTCHAs (considering the potential volume). In my testing, reissuing the same CAPTCHA I had saved locally over and over again didn't make a difference to the duration in which it was solved. Now it could be that they throttle responses for pre-solved CAPTCHAs, but then of course they're also throttling their revenue stream. In this case, I'm more inclined to conclude that Antigate don't have a CAPTCHA reuse mechanism in place.