3 ms·

I assume you're saying a targeted campaign/attack would be effective because a human could train the bot to recognize the "right" items in the game. I believe

by sounds 14y ago

I assume you're saying a targeted campaign/attack would be effective because a human could train the bot to recognize the "right" items in the game. I believe you're underestimating the concept. The current implementation is a simple game that asks a human about domain-specific knowledge. Here are the areas a generalized bot would need to succeed at: 1. Broad domain-specific knowledge base (at least as hard as IBM Watson on Jeopardy) 2. Image-to-text transformations of low-res images, with a very short time limit 3. The ability to adapt to the "rules of the game" at random The current setup is limited, true, because the degrees of freedom haven't been fleshed out. I do think that's a fair criticism of this approach: the system needs a _much_ larger database covering different game engines, different knowledge domains, different assets (audio, images, videos), etc. The other weakness I see (do you agree?) is that the game runs in client-side javascript. It should be fairly easy right now to attack the client-server interactions. I assume it's not just a "yes/no" response sent from the client to the server, but anything that reduces the complexity of the problem (i.e. simulating a thousand virtual games to learn the game mechanics) is probably not worth the effort to code up.

loopdoend 14y ago
It appears to send all mouse movements and timing to the server for verification. Regardless, their database of games will never be large enough to disuade spammers if this becomes popular. It will work in the short term, but I don't see how they can make this work long term, especially with no clear route to monetization.
- duckduckgouser 14y ago
  Does ReCaptcha make money on ocr?
jerf 14y ago
"The current setup is limited, true, because the degrees of freedom haven't been fleshed out. I do think that's a fair criticism of this approach: the system needs a _much_ larger database covering different game engines, different knowledge domains, different assets (audio, images, videos), etc." That's why this doesn't work. Sure, the CAPTCHA author gets to write code to generate their games, but you must not forget, the CAPTCHA attacker gets to write code too. If the author writes code to make the shoes any of 256 colors, the attacker gets to write whatever code they like to detect any of 256 colors and match them in code. If the author writes a trivia game with fixed answers, the attacker gets to hit the game until they get all the answers. If the author writes "What is $randint + $randint?", the attacker gets to write if ($question =~ /What is (\d?) \+ (\d?)/) { return $1 + $2 }, and so on. If you look at it from an information theory perspective, the ability of the author to put information into their test is generally dwarfed by the ability of the attacker to put information into their cracker. When this is not the case, CAPTCHAs are uninteresting anyhow. That's why the only ones that have worked up to this point are ones that involve something genuinely hard for the attacker to express, because we know of no way to even express the distorted letter solver in code... or rather, we didn't, and now we do.
- madarco 14y ago
  Also, the attacker code need only to achieve a limited success rate (eg: ~10%). Think of a gmail account creator: 1000 requests * success_rate = 10 accounts per minute. Not bat at all.

by sounds 14y ago

loopdoend 14y ago

It appears to send all mouse movements and timing to the server for verification. Regardless, their database of games will never be large enough to disuade spammers if this becomes popular. It will work in the short term, but I don't see how they can make this work long term, especially with no clear route to monetization.

duckduckgouser 14y ago
Does ReCaptcha make money on ocr?

jerf 14y ago

"The current setup is limited, true, because the degrees of freedom haven't been fleshed out. I do think that's a fair criticism of this approach: the system needs a _much_ larger database covering different game engines, different knowledge domains, different assets (audio, images, videos), etc." That's why this doesn't work. Sure, the CAPTCHA author gets to write code to generate their games, but you must not forget, the CAPTCHA attacker gets to write code too. If the author writes code to make the shoes any of 256 colors, the attacker gets to write whatever code they like to detect any of 256 colors and match them in code. If the author writes a trivia game with fixed answers, the attacker gets to hit the game until they get all the answers. If the author writes "What is $randint + $randint?", the attacker gets to write if ($question =~ /What is (\d?) \+ (\d?)/) { return $1 + $2 }, and so on. If you look at it from an information theory perspective, the ability of the author to put information into their test is generally dwarfed by the ability of the attacker to put information into their cracker. When this is not the case, CAPTCHAs are uninteresting anyhow. That's why the only ones that have worked up to this point are ones that involve something genuinely hard for the attacker to express, because we know of no way to even express the distorted letter solver in code... or rather, we didn't, and now we do.

madarco 14y ago
Also, the attacker code need only to achieve a limited success rate (eg: ~10%). Think of a gmail account creator: 1000 requests * success_rate = 10 accounts per minute. Not bat at all.