9 ms·
Bots can complete CAPTCHAs quicker than humans
- jakubmazanec 3y agoWhat about proof of work based CAPTCHA like https://github.com/mCaptcha/mCaptcha https://github.com/mCaptcha/mCaptcha ? Since CAPTCHAs can be solved by bots, at least make it more costly for them.
- albert_e 3y ago"Please submit a DNA Sample to continue"
- mattw2121 3y ago"For distorted text fields, humans took 9-15 seconds with an accuracy of just 50-84 percent. Bots, on the other hand, beat the tests in less than a second with 99.8 percent accuracy." I'm guessing part of the answer is (and most likely already implemented in things like reCAPTCHA) is rate limiting and detecting bots when they solve these too quickly.
- timtom39 3y agoThe bots would just slow down then. Their time is ~free. reCAPTCHA is one of the better captcha because they do a decent amount of browser fingerprinting and their captcha are interactive. Still there are services for solving them. Fun thing is you only need to pay those services for first ~50K captcha and then you can train your own solver using the data you collected. Ultimately, captchas only serve to increase the cost of running bots. If what ever your trying to protect is worth more you will fail.
- Gasp0de 3y agoInteresting. The authors of the captcha solving bot papers claim 100% accuracy for reCaptcha and 98% accuracy for hCaptcha. That google does this is not really a surprise, since they earn money by letting bots through (bots are then counted as humans and google can bill for ads shown to the bot), but hCaptcha at least advertises the fact that their interest is actually detecting bots.
- mydriasis 3y agoI personally know someone who has specifically designed bots to defeat both, and also the ones that defeat the "drag the puzzle piece" and similar "bot-defeating" technologies!
- permo-w 3y agoat this point I think your best bet is security through obscurity. with the state of generally available AI tools and processing power, is there any general format can't be solved? surely the best option nowadays is to make your own or find an obscure one, and hope it's unusual enough that ready-made software doesn't exist that can easily solve it. then if and when it gets cracked to the degree it's impacting your content, move onto another one
- kobalsky 3y ago> with the state of generally available AI tools and processing power, is there any general format can't be solved? putting in a credit card? I'm wondering if paid services have problems with bots, or if they mind, since they are being paid.
- danillonunes 3y agoAh! Here is the funny thing: Now your issue is card testers blowing up your dispute rates!
- catboybotnet 3y agoPutting in a CC for a trial to access your service doesn't end up deterring anybody because you can just buy a massive CSV with stolen details for relatively cheap. Even if they're frozen/cancelled, the card numbers are still valid numbers. If you want to pay to authenticate each and every one of them, you'll probably run yourself dry. Can also just use old empty VISA gift cards, ethically sourced from relatives and friends of course.
- version_five 3y agoModern captchas are mostly about letting google or cloudflare track you anyway aren't they? When I am forced to actually click on stoplights (most of that stuff should be easy object detection) I usually just get stuck in an infinite loop. Actually mastering the cognitive task is not really important now.
- jsnell 3y agoNo, of course they aren't mostly about that. You can tell it because it's not actually Google or Cloudflare installing captchas on websites of third parties. They in fact cannot do it. It's done by the people operating the websites and who desperately need to protect it against abuse, and for whom letting a company track you is not even a hypothetical motive.
- version_five 3y agoI mean that determining if it's a human is based primarily on tracking.
- jsnell 3y agoAh, fair enough! Sorry for the misunderstanding. Even in the case where you're getting some kind of behavior or reputation verdict from past behavior (and possibly across multiple surfaces), you probably want a progressive set of outcomes rather than just a binary allow or deny. Even if some requests are clearly best just blocked and others should obviously be allowed, there's always going to be a grey area where you're not sure. You need something to do with those requests. Making an arbitrary choice is one option, but pretty harsh on the legit users. A captcha in another. Sometimes you have options for that gray area that are much better than captchas that you can do, e.g. request a phone number and do an SMS challenge. But that's both expensive and will lead to a massive dropoff for most sites as people won't be willing to give out their phone number to every site. (Also, the act of solving the puzzle can give you additional signals of whether the request is from a bot or not. Signal collection is kind of the entire point of the slider captchas in the first place.)
- 3y ago
- permo-w 3y agohas this not been the case for a very long time? besides a sneaky way for Google to train its models, I had the impression that Captchas are more like a way to increase the friction rather than anything that would actually stop a determined actor? they increase the processing/energy cost/set-up time/difficulty to the point where it may no longer be profitable to access that content, but no one really thought a powerful computer with the right software couldn't actually solve them at pace, right?
- timtom39 3y agoYes and No. They used to be much harder to solve but modern AI has made them much easier to solve in the last couple of years. Profitability. That is what it comes down to. The price of solving these have plummeted in last couple of years.
- permo-w 3y agopowerful image recognition software has been around longer than the last couple of years though, right?
- esperent 3y ago> New approaches are needed, like more dynamic approaches using behavioural analysis Does this set off alarm bells for anyone else? Of course the best way to know if a visitor is a human or a bot is to deeply analyze their behavior. But that's at odds with the right of us humans not to be analyzed by every website we visit. What happens if we do reach a standoff where the bots become good enough at mimicking human behavior that the only way to tell us apart is unacceptable and illegal behavioral analysis?
- araes 3y agoI recently wondered whether the good reviews on WWW shopping sites, are actually written by the bots. The market for astroturfing is so competitive, that the paid reviews probably learned a long time ago you need to leave quality reviews to get repeat customers. They also 'care' more than actual customers in many cases. Real customer -> "Stop sending me review reminders. It was a comb. Block." Bot -> "Dutifully review all kinds of products. 500 words on the life changing experience of hair brushing with this comb. A+ reviewer." I find it difficult to believe that the bot networks would not have just immediately rolled every single generative AI advance into their networks (write convincing reviews, generate convincing product examples without buying, beat captchas more reliably, automated screen clicking, human eye scan impersonation). Need to be better than every other group doing paid reviews. Need to be better than actual humans. They might write critical reviews. Also, lot of sites already doing some behavioral analysis. Popup every time you consider clicking 'leave' on websites lately? "Before you go..."
- runnerup 3y ago> I recently wondered whether the good reviews on WWW shopping sites, are actually written by the bots. Probably, but if these are just like, Amazon reviews/etc, they likely violate FTC regulations. Enforcement is lacking, but I'd still be very hesitant to break the law.
- clucas 3y agoObligatory: https://xkcd.com/810/ https://xkcd.com/810/
- merpkz 3y agoI tried to register for twa^Hitter yesterday and couldn't fill in all the captcha it was throwing at me. First it was some innocent point a train to station a letter shown in picture on the left and after I barely completed that it was throwing at me 6 pictures of different string knots where I was supposed to point out which picture has two strings or maybe just one. Funny thing is that after first 5 it throws 20 more and after 40 or 50 filled in total I just gave up - no twitter for me I guess and that is probably for the best.
- chankstein38 3y agoYou're _seriously_ not missing anything
- ghaff 3y agoI almost never get cat has on the first try any longer. It seems obvious that AIs will get better than humans at these things. It’s just a question of model cost and timing.
- thedaly 3y agoSame thing happened to me yesterday. I switched to my phone after it said 20 more, and it verified without a captcha.
- cantSpellSober 3y ago> [it was] 6 pictures of different string knots where I was supposed to point out which picture has two strings or [one] What?! I've never seen this, is this proprietary to The Site Formerly Known As Twitter? Users with cognitive impairments would struggle with this I speculate. (All humans, really)
- mikro2nd 3y agoYou appear to have trouble spelling xitter...
- dmonitor 3y ago> twa^Hitter genuinely, what did you mean by this?
- skilled 3y ago> Google's implementation, reCAPTCHA, eventually did away with much of these shenanigans to make the browser identify low-risk human users in the background, but the image verification method still pops up occasionally if risk cannot be ascertained. Can’t remember the last time I clicked reCAPTCHA and didn’t have to do the challenge, come to think of it - I can’t remember a single time, so if it has happened it is very rare, whereas the Cloudflare one always lets me through.
- rcxdude 3y agoTry using a browser which resists tracking more, you'll see it. And a lot of the time you see it it's not actually solvable: the captcha system has already decided you're a bot and will just try to tarpit you with ever slower-appearing challenges which will always fail.
- TheAceOfHearts 3y agoThe worst captcha are the ones on 4chan. I don't think I've ever gotten it right on my first try. It really discourages participation from all but the most dedicated of people. I swear it was added with the ultimate goal of reducing activity and getting regulars to pay for gold.
- kozzz 3y agoI prefer 4chan captcha to the bicycle selection though. Once you get an eye for it, it’s almost impossible to get it wrong
- flangola7 3y agoI find them easier than the stoplight clicking or puzzle piece dragging captchas, which is not saying much. >getting users to pay for gold Gold... a 4chan pass?
- Forgotthepass8 3y agoReally? Half of /g/ was using an auto solver on it. It's broken now I think still but the one that slides the letters works. When you get used to it it doesn't seem that hard... Twitter on the other hand is incredibly confusing with the visual one but the audio is easy
- ProxCoques 3y agoIf you ask me, the whole idea of trying to prevent bad actors from acting badly by throwing up barriers to EVERYONE trying to get access to your system is... weird. Better to deploy some light measures (tarpitting, RBLs etc.) on entry, then weed out the bad actors once they start acting bad inside the system, no? I mean CAPTCHA for everyone? Come on.
- jerf 3y agoCAPTCHAS exist precisely because those were inadequate 15 years ago. You may not have been around for it, but it's not like everyone was super duper excited to put these things on their web sites. It was something people were dragged into kicking and screaming, and even today there's a lot of those technologies deployed even so. You are probably underestimating the willingness of bad actors to make efforts to avoid these things. Is your model of a "bad actor" on the web some malicious guy writing a program and running it on his personal laptop from his home connection? Because in 2023, your threat model should be something more like a guy who rents a botnet out with millions of computers of all sorts on it (the difficulty of this rental being somewhat higher than AWS, but only somewhat so, it's not that hard at all really), collaborates with other bad actors to work out how to best bypass filtering, creates websites to do things like CAPTCHA proxying so that humans fill out the CAPTCHAs in return for free porn or something, trades rootkits and other exploits around both for home computers and for compromising web servers for their campaigns (for the URL cred), and so on. You're not up against some guy, you're up against a honed and tuned machine with years of experience, internal division of labor and skillsets, basically an entire parallel predator economy. Tarpitting and RBLs are not dead, but they became just one layer a long time ago.
- newaccount74 3y agoIn my experience Captchas are used a lot by inexperienced developers. As you stated, they are not particularly hard to circumvent, but they are incredibly easy to implement. So developers just install a Captcha and outsource the problem to Google. I think the primary way to deal with the problem should be to design services in a way to make them unsuitable for spammers.
- dist-epoch 3y agoMost CAPTCHA's today also look at meta signals. You can significantly increase your success rate by adding some "random human" actions: - wiggle the mouse a bit, don't go in a straight line - click multiple times in quick succession on a image - wait a bit before clicking the Submit button after selecting matching images - match a wrong image and then immediately unmatch it (as if a mistake) - click randomly on the page around the CAPTCHA - resize the window a bit, rotate the scroll mouse a bit And don't do the exact same thing every time, improvise, pick randomly 2-3 actions from the list.
- eigh0xohyeib6Te 3y agoI regard these as more or less slave labor and in the interest of polluting training data I've been intentionally making a minority of incorrect selections on these for years. I was surprised how rarely that I have to make more than one submission in spite of intentionally making incorrect selections. I'm looking forward to Google getting sued after a Waymo tries to make a right on red at a pontoon boat.
- gsky 3y agoCAPTCHAs have wasted a lot of my time that's why I choose not to enable it for my websites.
- jpalomaki 3y agoSometimes the value of the action a bot is trying to perform is simply so low, that even a simple obstacle is effective. Like how much compute you want to spend to write one spam message through a contact form.
- ChrisArchitect 3y agoSource/submitted few days back: https://news.ycombinator.com/item?id=37071490 https://news.ycombinator.com/item?id=37071490
- cpif 3y agoThe article being reported on does not make this conclusion. The study authors are interested only in the time it takes for (human) users to complete CAPTCHAs, and did not examine the speed at which bots solve them. The fact that bots can solve them -- and solve them fast -- is apparently a well-established fact in the literature. There is a table in the article comparing its (human) participants' solve times to a number of previous studies which examined how fast/accurate bots can be. The Register (and the New Scientist, which most of this is cribbed from) is looking for a headline, so whatever. But the study's authors say that the "surprising" part is that "solving time and user perception are not always correlated" for human users. Game-based CAPTCHAs with sliders may take longer, but the users in the study still enjoyed them more than image-selection-based ones.
- nottorp 3y agoSay, is there a Firefox extension that will solve captchas for me when i click on them? Don't need auto solving as in never see the captcha, I just don't want to look which of these blurry photos has palm trees and which has hills.
- underseacables 3y agoI’ve noticed that in order to defeat captcha sometimes I have to slow down and click the crosswalks one at a time, pausing between each, then count to 3 and click submit.