3 ms·

This won't work. The puzzle possibilities are limited. This is about as effective as asking a random question, it stops bots because they don't know how to dea

This won't work. The puzzle possibilities are limited. This is about as effective as asking a random question, it stops bots because they don't know how to deal with it. It wouldn't have a chance against a targeted spam campaign/attack. It's cute though.

tokenizer 14y ago
Could you please go into more detail? I'm curious because if you're saying a bot would be stopped at this solution, but not a human, then wouldn't that also apply to recaptcha as well? Or are you saying one could automate a solution around this over that being impossible with recaptcha? Would like to hear you thoughts.
- walexander 14y ago
  This is fairly trivial to break. The number of puzzles are low and they repeat. I could refresh til I get a desired puzzle (shoe matching). Then write a simple cursor controller program (say using Java Robot API). It would scan across the static shoe area on the right looking at shoe colors. Then scan across the shoes on the left. When it matches a color shoe, drag across to match.
  - ElbertF 14y ago
    There's no need to control the cursor, you can just replay the request. Open up Firebug, solve a puzzle and capture the POST data being transmitted to the server: observation_data: {"observationNumber":3,"mouse":[{"x":1,"y":68,"down":false},{"{"observationNumber":3,"mouse":[{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":2,"y":55,"down":false},{"x":34,"y":50,"down":false},{"x":40,"y":51,"down":false},{"x":40,"y":52,"down":false},{"x":40,"y":52,"down":false},{"x":40,"y":52,"down":false},{"x":40,"y":52,"down":false},{"x":40,"y":52,"down":true},{"x":40,"y":52,"down":true},{"x":108,"y":52,"down":true},{"x":242,"y":50,"down":true},{"x":327,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true}],"clock":[16555,16597,16636,16677,16723,16755,16797,16837,16877,16917,16957,16996,17036,17075,17116,17157,17198,17236,17277,17319,17357,17396,17438,17476,17517,17557,17598,17638,17677],"bins":[[{"id":2,"time":14037}],[{"id":3,"time":16156},{"id":4,"time":17677}],[{"id":4,"time":17677}]],"items":[]}
- yathern 14y ago
  What he is saying is that captchas work solely on the fact that computers aren't fantastic at character recognition yet, so there isn't much way to have bots force their way in. This method will work temporarily, because it's new, and obscure. But if someone specifically targeted a website that used this, they would just have to figure out how many puzzles there are, and design a more simple application to solve it each one, rather than create a groundbreaking solution to better OCR (optical character recognition). This system only works if there are unlimited, non repeating puzzles.
- loopdoend 14y ago
  A bot would only be stopped by this because of novelty. Recaptcha can easily be bypassed by using human solvers, which are available for $1.50/1000 captchas last time I checked. In my opinion, it would be easier to automate this than recaptcha because this uses common elements that don't have nearly enough difference between them to make it a challenge. A solve rate of <5% is effective for spammers. How is this going to stop anything when a spammer can simply cycle through to a game they know how to beat, and fake the mouse movements and timing? Recaptcha is difficult to beat with OCR because it is designed to withstand attacks by OCR considered 'state of the art'. It is impossible to beat with off the shelf solutions. On the other hand, this would be rather simple to automate using pixel matching. The shapes and colors don't change (Take the pancake example, for instance).
  - tokenizer 14y ago
    Thanks. I'm definitely rethinking implementing this in anything important.
- jack-r-abbit 14y ago
  Watching the browser requests as I try different games it appears that a determined person could reverse engineer that big json object that gets posted every time you interact with it. Just by looking at a couple it seems to keep track of the objects movements and whether the mouse button is down or not. I'm not saying it would be easy, but it seems a lot easier than trying to analyze audio or do some OCR. I wouldn't even know where to start with those tasks. This I could probably do if my desire was enough to spend the time on it.
  - taytus 14y ago
    I think that's what this guy did to crack the code: http://www.youtube.com/watch?v=q_EYl83vlIw http://www.youtube.com/watch?v=q_EYl83vlIw
sounds 14y ago
I assume you're saying a targeted campaign/attack would be effective because a human could train the bot to recognize the "right" items in the game. I believe you're underestimating the concept. The current implementation is a simple game that asks a human about domain-specific knowledge. Here are the areas a generalized bot would need to succeed at: 1. Broad domain-specific knowledge base (at least as hard as IBM Watson on Jeopardy) 2. Image-to-text transformations of low-res images, with a very short time limit 3. The ability to adapt to the "rules of the game" at random The current setup is limited, true, because the degrees of freedom haven't been fleshed out. I do think that's a fair criticism of this approach: the system needs a _much_ larger database covering different game engines, different knowledge domains, different assets (audio, images, videos), etc. The other weakness I see (do you agree?) is that the game runs in client-side javascript. It should be fairly easy right now to attack the client-server interactions. I assume it's not just a "yes/no" response sent from the client to the server, but anything that reduces the complexity of the problem (i.e. simulating a thousand virtual games to learn the game mechanics) is probably not worth the effort to code up.
- loopdoend 14y ago
  It appears to send all mouse movements and timing to the server for verification. Regardless, their database of games will never be large enough to disuade spammers if this becomes popular. It will work in the short term, but I don't see how they can make this work long term, especially with no clear route to monetization.
  - duckduckgouser 14y ago
    Does ReCaptcha make money on ocr?
- jerf 14y ago
  "The current setup is limited, true, because the degrees of freedom haven't been fleshed out. I do think that's a fair criticism of this approach: the system needs a _much_ larger database covering different game engines, different knowledge domains, different assets (audio, images, videos), etc." That's why this doesn't work. Sure, the CAPTCHA author gets to write code to generate their games, but you must not forget, the CAPTCHA attacker gets to write code too. If the author writes code to make the shoes any of 256 colors, the attacker gets to write whatever code they like to detect any of 256 colors and match them in code. If the author writes a trivia game with fixed answers, the attacker gets to hit the game until they get all the answers. If the author writes "What is $randint + $randint?", the attacker gets to write if ($question =~ /What is (\d?) \+ (\d?)/) { return $1 + $2 }, and so on. If you look at it from an information theory perspective, the ability of the author to put information into their test is generally dwarfed by the ability of the attacker to put information into their cracker. When this is not the case, CAPTCHAs are uninteresting anyhow. That's why the only ones that have worked up to this point are ones that involve something genuinely hard for the attacker to express, because we know of no way to even express the distorted letter solver in code... or rather, we didn't, and now we do.
rst 14y ago
Vulnerable to the same attack as Captchas: paying humans to solve them for a few cents a pop. Cultural factors would probably require training for some of the puzzles --- but I don't think that helps much. Someone from the Chinese countryside would probably have about as much luck with the pizza toppings on the first go as I'd have with Chinese ideography, but they'd have it nailed by the tenth.

tokenizer 14y ago

Could you please go into more detail? I'm curious because if you're saying a bot would be stopped at this solution, but not a human, then wouldn't that also apply to recaptcha as well? Or are you saying one could automate a solution around this over that being impossible with recaptcha? Would like to hear you thoughts.

walexander 14y ago
This is fairly trivial to break. The number of puzzles are low and they repeat. I could refresh til I get a desired puzzle (shoe matching). Then write a simple cursor controller program (say using Java Robot API). It would scan across the static shoe area on the right looking at shoe colors. Then scan across the shoes on the left. When it matches a color shoe, drag across to match.
- ElbertF 14y ago
  There's no need to control the cursor, you can just replay the request. Open up Firebug, solve a puzzle and capture the POST data being transmitted to the server: observation_data: {"observationNumber":3,"mouse":[{"x":1,"y":68,"down":false},{"{"observationNumber":3,"mouse":[{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":2,"y":55,"down":false},{"x":34,"y":50,"down":false},{"x":40,"y":51,"down":false},{"x":40,"y":52,"down":false},{"x":40,"y":52,"down":false},{"x":40,"y":52,"down":false},{"x":40,"y":52,"down":false},{"x":40,"y":52,"down":true},{"x":40,"y":52,"down":true},{"x":108,"y":52,"down":true},{"x":242,"y":50,"down":true},{"x":327,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true}],"clock":[16555,16597,16636,16677,16723,16755,16797,16837,16877,16917,16957,16996,17036,17075,17116,17157,17198,17236,17277,17319,17357,17396,17438,17476,17517,17557,17598,17638,17677],"bins":[[{"id":2,"time":14037}],[{"id":3,"time":16156},{"id":4,"time":17677}],[{"id":4,"time":17677}]],"items":[]}
yathern 14y ago
What he is saying is that captchas work solely on the fact that computers aren't fantastic at character recognition yet, so there isn't much way to have bots force their way in. This method will work temporarily, because it's new, and obscure. But if someone specifically targeted a website that used this, they would just have to figure out how many puzzles there are, and design a more simple application to solve it each one, rather than create a groundbreaking solution to better OCR (optical character recognition). This system only works if there are unlimited, non repeating puzzles.
loopdoend 14y ago
A bot would only be stopped by this because of novelty. Recaptcha can easily be bypassed by using human solvers, which are available for $1.50/1000 captchas last time I checked. In my opinion, it would be easier to automate this than recaptcha because this uses common elements that don't have nearly enough difference between them to make it a challenge. A solve rate of <5% is effective for spammers. How is this going to stop anything when a spammer can simply cycle through to a game they know how to beat, and fake the mouse movements and timing? Recaptcha is difficult to beat with OCR because it is designed to withstand attacks by OCR considered 'state of the art'. It is impossible to beat with off the shelf solutions. On the other hand, this would be rather simple to automate using pixel matching. The shapes and colors don't change (Take the pancake example, for instance).
- tokenizer 14y ago
  Thanks. I'm definitely rethinking implementing this in anything important.
jack-r-abbit 14y ago
Watching the browser requests as I try different games it appears that a determined person could reverse engineer that big json object that gets posted every time you interact with it. Just by looking at a couple it seems to keep track of the objects movements and whether the mouse button is down or not. I'm not saying it would be easy, but it seems a lot easier than trying to analyze audio or do some OCR. I wouldn't even know where to start with those tasks. This I could probably do if my desire was enough to spend the time on it.
- taytus 14y ago
  I think that's what this guy did to crack the code: http://www.youtube.com/watch?v=q_EYl83vlIw http://www.youtube.com/watch?v=q_EYl83vlIw

sounds 14y ago

I assume you're saying a targeted campaign/attack would be effective because a human could train the bot to recognize the "right" items in the game. I believe you're underestimating the concept. The current implementation is a simple game that asks a human about domain-specific knowledge. Here are the areas a generalized bot would need to succeed at: 1. Broad domain-specific knowledge base (at least as hard as IBM Watson on Jeopardy) 2. Image-to-text transformations of low-res images, with a very short time limit 3. The ability to adapt to the "rules of the game" at random The current setup is limited, true, because the degrees of freedom haven't been fleshed out. I do think that's a fair criticism of this approach: the system needs a _much_ larger database covering different game engines, different knowledge domains, different assets (audio, images, videos), etc. The other weakness I see (do you agree?) is that the game runs in client-side javascript. It should be fairly easy right now to attack the client-server interactions. I assume it's not just a "yes/no" response sent from the client to the server, but anything that reduces the complexity of the problem (i.e. simulating a thousand virtual games to learn the game mechanics) is probably not worth the effort to code up.

loopdoend 14y ago
It appears to send all mouse movements and timing to the server for verification. Regardless, their database of games will never be large enough to disuade spammers if this becomes popular. It will work in the short term, but I don't see how they can make this work long term, especially with no clear route to monetization.
- duckduckgouser 14y ago
  Does ReCaptcha make money on ocr?
jerf 14y ago
"The current setup is limited, true, because the degrees of freedom haven't been fleshed out. I do think that's a fair criticism of this approach: the system needs a _much_ larger database covering different game engines, different knowledge domains, different assets (audio, images, videos), etc." That's why this doesn't work. Sure, the CAPTCHA author gets to write code to generate their games, but you must not forget, the CAPTCHA attacker gets to write code too. If the author writes code to make the shoes any of 256 colors, the attacker gets to write whatever code they like to detect any of 256 colors and match them in code. If the author writes a trivia game with fixed answers, the attacker gets to hit the game until they get all the answers. If the author writes "What is $randint + $randint?", the attacker gets to write if ($question =~ /What is (\d?) \+ (\d?)/) { return $1 + $2 }, and so on. If you look at it from an information theory perspective, the ability of the author to put information into their test is generally dwarfed by the ability of the attacker to put information into their cracker. When this is not the case, CAPTCHAs are uninteresting anyhow. That's why the only ones that have worked up to this point are ones that involve something genuinely hard for the attacker to express, because we know of no way to even express the distorted letter solver in code... or rather, we didn't, and now we do.

rst 14y ago

Vulnerable to the same attack as Captchas: paying humans to solve them for a few cents a pop. Cultural factors would probably require training for some of the puzzles --- but I don't think that helps much. Someone from the Chinese countryside would probably have about as much luck with the pizza toppings on the first go as I'd have with Chinese ideography, but they'd have it nailed by the tenth.