5 ms·

Could you please go into more detail? I'm curious because if you're saying a bot would be stopped at this solution, but not a human, then wouldn't that also ap

Could you please go into more detail? I'm curious because if you're saying a bot would be stopped at this solution, but not a human, then wouldn't that also apply to recaptcha as well? Or are you saying one could automate a solution around this over that being impossible with recaptcha? Would like to hear you thoughts.

walexander 14y ago
This is fairly trivial to break. The number of puzzles are low and they repeat. I could refresh til I get a desired puzzle (shoe matching). Then write a simple cursor controller program (say using Java Robot API). It would scan across the static shoe area on the right looking at shoe colors. Then scan across the shoes on the left. When it matches a color shoe, drag across to match.
- ElbertF 14y ago
  There's no need to control the cursor, you can just replay the request. Open up Firebug, solve a puzzle and capture the POST data being transmitted to the server: observation_data: {"observationNumber":3,"mouse":[{"x":1,"y":68,"down":false},{"{"observationNumber":3,"mouse":[{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":2,"y":55,"down":false},{"x":34,"y":50,"down":false},{"x":40,"y":51,"down":false},{"x":40,"y":52,"down":false},{"x":40,"y":52,"down":false},{"x":40,"y":52,"down":false},{"x":40,"y":52,"down":false},{"x":40,"y":52,"down":true},{"x":40,"y":52,"down":true},{"x":108,"y":52,"down":true},{"x":242,"y":50,"down":true},{"x":327,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true}],"clock":[16555,16597,16636,16677,16723,16755,16797,16837,16877,16917,16957,16996,17036,17075,17116,17157,17198,17236,17277,17319,17357,17396,17438,17476,17517,17557,17598,17638,17677],"bins":[[{"id":2,"time":14037}],[{"id":3,"time":16156},{"id":4,"time":17677}],[{"id":4,"time":17677}]],"items":[]}
yathern 14y ago
What he is saying is that captchas work solely on the fact that computers aren't fantastic at character recognition yet, so there isn't much way to have bots force their way in. This method will work temporarily, because it's new, and obscure. But if someone specifically targeted a website that used this, they would just have to figure out how many puzzles there are, and design a more simple application to solve it each one, rather than create a groundbreaking solution to better OCR (optical character recognition). This system only works if there are unlimited, non repeating puzzles.
loopdoend 14y ago
A bot would only be stopped by this because of novelty. Recaptcha can easily be bypassed by using human solvers, which are available for $1.50/1000 captchas last time I checked. In my opinion, it would be easier to automate this than recaptcha because this uses common elements that don't have nearly enough difference between them to make it a challenge. A solve rate of <5% is effective for spammers. How is this going to stop anything when a spammer can simply cycle through to a game they know how to beat, and fake the mouse movements and timing? Recaptcha is difficult to beat with OCR because it is designed to withstand attacks by OCR considered 'state of the art'. It is impossible to beat with off the shelf solutions. On the other hand, this would be rather simple to automate using pixel matching. The shapes and colors don't change (Take the pancake example, for instance).
- tokenizer 14y ago
  Thanks. I'm definitely rethinking implementing this in anything important.
jack-r-abbit 14y ago
Watching the browser requests as I try different games it appears that a determined person could reverse engineer that big json object that gets posted every time you interact with it. Just by looking at a couple it seems to keep track of the objects movements and whether the mouse button is down or not. I'm not saying it would be easy, but it seems a lot easier than trying to analyze audio or do some OCR. I wouldn't even know where to start with those tasks. This I could probably do if my desire was enough to spend the time on it.
- taytus 14y ago
  I think that's what this guy did to crack the code: http://www.youtube.com/watch?v=q_EYl83vlIw http://www.youtube.com/watch?v=q_EYl83vlIw

walexander 14y ago

This is fairly trivial to break. The number of puzzles are low and they repeat. I could refresh til I get a desired puzzle (shoe matching). Then write a simple cursor controller program (say using Java Robot API). It would scan across the static shoe area on the right looking at shoe colors. Then scan across the shoes on the left. When it matches a color shoe, drag across to match.

ElbertF 14y ago
There's no need to control the cursor, you can just replay the request. Open up Firebug, solve a puzzle and capture the POST data being transmitted to the server: observation_data: {"observationNumber":3,"mouse":[{"x":1,"y":68,"down":false},{"{"observationNumber":3,"mouse":[{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":1,"y":68,"down":false},{"x":2,"y":55,"down":false},{"x":34,"y":50,"down":false},{"x":40,"y":51,"down":false},{"x":40,"y":52,"down":false},{"x":40,"y":52,"down":false},{"x":40,"y":52,"down":false},{"x":40,"y":52,"down":false},{"x":40,"y":52,"down":true},{"x":40,"y":52,"down":true},{"x":108,"y":52,"down":true},{"x":242,"y":50,"down":true},{"x":327,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true},{"x":336,"y":52,"down":true}],"clock":[16555,16597,16636,16677,16723,16755,16797,16837,16877,16917,16957,16996,17036,17075,17116,17157,17198,17236,17277,17319,17357,17396,17438,17476,17517,17557,17598,17638,17677],"bins":[[{"id":2,"time":14037}],[{"id":3,"time":16156},{"id":4,"time":17677}],[{"id":4,"time":17677}]],"items":[]}

yathern 14y ago

What he is saying is that captchas work solely on the fact that computers aren't fantastic at character recognition yet, so there isn't much way to have bots force their way in. This method will work temporarily, because it's new, and obscure. But if someone specifically targeted a website that used this, they would just have to figure out how many puzzles there are, and design a more simple application to solve it each one, rather than create a groundbreaking solution to better OCR (optical character recognition). This system only works if there are unlimited, non repeating puzzles.

loopdoend 14y ago

A bot would only be stopped by this because of novelty. Recaptcha can easily be bypassed by using human solvers, which are available for $1.50/1000 captchas last time I checked. In my opinion, it would be easier to automate this than recaptcha because this uses common elements that don't have nearly enough difference between them to make it a challenge. A solve rate of <5% is effective for spammers. How is this going to stop anything when a spammer can simply cycle through to a game they know how to beat, and fake the mouse movements and timing? Recaptcha is difficult to beat with OCR because it is designed to withstand attacks by OCR considered 'state of the art'. It is impossible to beat with off the shelf solutions. On the other hand, this would be rather simple to automate using pixel matching. The shapes and colors don't change (Take the pancake example, for instance).

tokenizer 14y ago
Thanks. I'm definitely rethinking implementing this in anything important.

jack-r-abbit 14y ago

Watching the browser requests as I try different games it appears that a determined person could reverse engineer that big json object that gets posted every time you interact with it. Just by looking at a couple it seems to keep track of the objects movements and whether the mouse button is down or not. I'm not saying it would be easy, but it seems a lot easier than trying to analyze audio or do some OCR. I wouldn't even know where to start with those tasks. This I could probably do if my desire was enough to spend the time on it.

taytus 14y ago
I think that's what this guy did to crack the code: http://www.youtube.com/watch?v=q_EYl83vlIw http://www.youtube.com/watch?v=q_EYl83vlIw