5 ms·

AreYouHuman CAPTCHAs defeated using SimpleCV

25 points by kscottz 14y ago

dexen 14y ago
From the video, the `AreYouHuman' captcha strikes me as quite culture-specific. `Put the tools in toolbox', `make pancakes' -- some people will know what and how to, others will not. Meanwhile, a simple bot, as demonstrated, achieves high success rate. Could also be improved with automated learning , using suitable AI library; such libraries are freely available for making games. With both false negatives and false positives high, the captcha's either done for, or at least needs some serious tweaks.
koide 14y ago
Why does the captcha allow infinite retries? And why it lets you keep trying once you solved it? Not that any of that would really fix the captcha, you'd just need to improve the code accordingly.
neil_s 14y ago
From my brief time playing around with the demo on the AreYouHuman page, it seems like the game is loaded onto the client side, and the javascript then initiates a callback to the php form indicating the results. Since the client has complete control over the javascript, it seems like it would be possible to simply send the server fake acknowledgement that the user has completed the game successfully. This seems fundamentally flawed and differs from regular captcha, where the client side has no awareness of right and wrong answers, and can't give immediate feedback. It simply acts an input to the server, which then judges the correctness, and if it isn't correct, returns a different problem, so a bot would have to start all over again. So I think beating this captcha wouldn't require computer vision and stuff, simply sniffing the traffic on a successful run of the game and then replicating it appropriately later. Also, how will this captcha system scale? They'll have to keep coming up with new sets of objects where some of them belong on a target and some don't.
tocomment 14y ago
How does the script move the mouse?
- fluffyllemon 14y ago
  There are many python libraries available for controlling the mouse/keyboard. Here are a few I've used or heard of: Autopy: https://github.com/msanders/autopy https://github.com/msanders/autopy PyMouse: http://code.google.com/p/pymouse/wiki/Documentation http://code.google.com/p/pymouse/wiki/Documentation Dogtail: https://fedorahosted.org/dogtail/ https://fedorahosted.org/dogtail/ If you're on Windows, I believe win32api / win32con also can work.
  - tocomment 14y ago
    Cool. I don't suppose there is anything cross platform?
    - fluffyllemon 14y ago
      I know Autopy is cross platform, and I'm pretty sure PyMouse is too. Not sure about Dogtail.
- neil_s 14y ago
  It isn't used in this case, but Autohotkey is quite a popular scripting/macro language that allows you to simulate mouse and keyboard use programmatically. It's cross platform, and can be run straight through the interpreter or compiled into native executables on many platforms by bundling the interpreter.
haberman 14y ago
Image-based CAPTCHAs are already getting to the point where I can barely make out the letters. I'm guessing half the time and get annoyed when my guess was incorrect. The computers will only get better at solving them; what happens when there's no easy way for a computer to verify that it's talking to a person?
- ZenPsycho 14y ago
  Disable comments! Batten the hatches, skew the mizzenmast, Turing to starboard! Knuth to port! There's a mean storm ahead and I'm not losing any more men. NOT ON MY WATCH.
h84ru3a 14y ago
The whole CAPTHCA concept (while it is certainly clever) just seems backwards. Why are we trying to stop automation? It seems like we should be designing systems that accomodate automation, not try to stop it. If "automation is the problem", then something is wrong with the larger system. It would mean, e.g., that Googlebot is a problem because it is an automaton and not human. We cannot just assume that everything that is automated is something we need to stop simply because it is automated. Maybe the design of email is the problem? Maybe the design of blog comment systems are the problem? CAPTCHA's are aimed at stopping automation. That appears to be the only criteria they filter on. It just seems strange. Of course CAPTCHA's will eventually be useless. Because most of us are working our tails off trying to push automation forward, not find ways to block it simply because it is automation.
- eurleif 14y ago
  >Maybe the design of blog comment systems are the problem? How would you design a blog comment system that doesn't get spam without using a CAPTCHA?
  - meric 14y ago
    If technology was advanced enough: An automaton that sweeps comments, keeps only ones that are relevant and deletes the rest. Both automatons and humans can comment, as long as their comment is relevant.
    - chc 14y ago
      So you just have your bot Google the article's keywords and repost content it finds along with spam links. Or heck, just repost part of the article or another comment. Practically guaranteed relevance. Some bots already do this. Even this fictional ridiculously smart AI is not up tithe task.
      - ZenPsycho 14y ago
        in my greatly hubristic and obscenely self absorbed and self important opinion, the best way to have comments on a blog is moderation only, with a fake out instapost that confuses spammers, along with whatever pixie dust gmail uses to filter spam email.
desaiguddu 14y ago
I have created Image Based CAPTCHA. which is combination of Normal CAPTCHA and advanced CAPTCHA. You can find the research details here. If any CAPTCHA scientist want to further research on my CAPTCHA, I can OpenSource it completely. http://dndcaptcha.blogspot.in/2010/04/textareaid.html http://dndcaptcha.blogspot.in/2010/04/textareaid.html

25 points by kscottz 14y ago

dexen 14y ago

From the video, the `AreYouHuman' captcha strikes me as quite culture-specific. `Put the tools in toolbox', `make pancakes' -- some people will know what and how to, others will not. Meanwhile, a simple bot, as demonstrated, achieves high success rate. Could also be improved with automated learning , using suitable AI library; such libraries are freely available for making games. With both false negatives and false positives high, the captcha's either done for, or at least needs some serious tweaks.

koide 14y ago

Why does the captcha allow infinite retries? And why it lets you keep trying once you solved it? Not that any of that would really fix the captcha, you'd just need to improve the code accordingly.

neil_s 14y ago

From my brief time playing around with the demo on the AreYouHuman page, it seems like the game is loaded onto the client side, and the javascript then initiates a callback to the php form indicating the results. Since the client has complete control over the javascript, it seems like it would be possible to simply send the server fake acknowledgement that the user has completed the game successfully. This seems fundamentally flawed and differs from regular captcha, where the client side has no awareness of right and wrong answers, and can't give immediate feedback. It simply acts an input to the server, which then judges the correctness, and if it isn't correct, returns a different problem, so a bot would have to start all over again. So I think beating this captcha wouldn't require computer vision and stuff, simply sniffing the traffic on a successful run of the game and then replicating it appropriately later. Also, how will this captcha system scale? They'll have to keep coming up with new sets of objects where some of them belong on a target and some don't.

tocomment 14y ago

How does the script move the mouse?

fluffyllemon 14y ago
There are many python libraries available for controlling the mouse/keyboard. Here are a few I've used or heard of: Autopy: https://github.com/msanders/autopy https://github.com/msanders/autopy PyMouse: http://code.google.com/p/pymouse/wiki/Documentation http://code.google.com/p/pymouse/wiki/Documentation Dogtail: https://fedorahosted.org/dogtail/ https://fedorahosted.org/dogtail/ If you're on Windows, I believe win32api / win32con also can work.
- tocomment 14y ago
  Cool. I don't suppose there is anything cross platform?
  - fluffyllemon 14y ago
    I know Autopy is cross platform, and I'm pretty sure PyMouse is too. Not sure about Dogtail.
neil_s 14y ago
It isn't used in this case, but Autohotkey is quite a popular scripting/macro language that allows you to simulate mouse and keyboard use programmatically. It's cross platform, and can be run straight through the interpreter or compiled into native executables on many platforms by bundling the interpreter.

haberman 14y ago

Image-based CAPTCHAs are already getting to the point where I can barely make out the letters. I'm guessing half the time and get annoyed when my guess was incorrect. The computers will only get better at solving them; what happens when there's no easy way for a computer to verify that it's talking to a person?

ZenPsycho 14y ago
Disable comments! Batten the hatches, skew the mizzenmast, Turing to starboard! Knuth to port! There's a mean storm ahead and I'm not losing any more men. NOT ON MY WATCH.

h84ru3a 14y ago

The whole CAPTHCA concept (while it is certainly clever) just seems backwards. Why are we trying to stop automation? It seems like we should be designing systems that accomodate automation, not try to stop it. If "automation is the problem", then something is wrong with the larger system. It would mean, e.g., that Googlebot is a problem because it is an automaton and not human. We cannot just assume that everything that is automated is something we need to stop simply because it is automated. Maybe the design of email is the problem? Maybe the design of blog comment systems are the problem? CAPTCHA's are aimed at stopping automation. That appears to be the only criteria they filter on. It just seems strange. Of course CAPTCHA's will eventually be useless. Because most of us are working our tails off trying to push automation forward, not find ways to block it simply because it is automation.

eurleif 14y ago
>Maybe the design of blog comment systems are the problem? How would you design a blog comment system that doesn't get spam without using a CAPTCHA?
- meric 14y ago
  If technology was advanced enough: An automaton that sweeps comments, keeps only ones that are relevant and deletes the rest. Both automatons and humans can comment, as long as their comment is relevant.
  - chc 14y ago
    So you just have your bot Google the article's keywords and repost content it finds along with spam links. Or heck, just repost part of the article or another comment. Practically guaranteed relevance. Some bots already do this. Even this fictional ridiculously smart AI is not up tithe task.
    - ZenPsycho 14y ago
      in my greatly hubristic and obscenely self absorbed and self important opinion, the best way to have comments on a blog is moderation only, with a fake out instapost that confuses spammers, along with whatever pixie dust gmail uses to filter spam email.

desaiguddu 14y ago

I have created Image Based CAPTCHA. which is combination of Normal CAPTCHA and advanced CAPTCHA. You can find the research details here. If any CAPTCHA scientist want to further research on my CAPTCHA, I can OpenSource it completely. http://dndcaptcha.blogspot.in/2010/04/textareaid.html http://dndcaptcha.blogspot.in/2010/04/textareaid.html