8 ms·
Apple using moving letters as captcha
- nwh 13y agoDoesn't this just make the CAPTCHA easier to solve for a bot? There's 20 frames in each challenge image, 20 different sets of data to process and compare for a correct result. It's also three letters long. ED: The form itself is included in an iframe, with the following tag: <meta http-equiv="Expires" content="Sat, 1 Apr 2006 23:59:59 GMT"> ED2: The audio CAPTCHA sounds even weaker. You could probably just pipe that to Googles dictation API and you'd be set.
- acqq 13y agoAnd the GIF I've got seem to has all the letters in the first frame anyway? What do they get by using animated GIF then?
- bornhuetter 13y agoAt the risk of sounding snarky, it's form over function.
- coob 13y agoIt is pretty snarky, considering this is a one-off use of a 3rd party captcha solution on a form only required for legal reasons for a time limited promotion.
- m00njuice 13y agoI doubt the unique capture implementation was done for a one off limited time form, I would have thought that this is something Apple has cooked up for re-use across multiple projects and this just so happens to be one of the first. The comment wasn't snarky, it was accurate.
- Shivetya 13y agoI have far too many repeats when I ask for a new one, NTN, RNC, and SAZ, are three that stood out
- gibybo 13y agoIt probably does, but it also makes it easier for a human. I would guess that humans gain from it far more than bots do (since humans are really good at distinguishing moving objects), which should be the primary goal of a captcha.
- tuxracer 13y agoCouldn't a bot just look at the first frame?
- hkmurakami 13y agoIf this becomes a trend, then surely the first frame won't always be the most obvious frame to choose.
- workbench 13y agoIf you were coding this I'm sure you'd jumble the start point anyway.
- adisbladis 13y agoOr even better: Iterate over the frames until you find one which is very easily solved.
- mbq 13y agoIt can look at all frames and average predictions; this should boost the accuracy as errors will likely cancel out.
- Achshar 13y agoAccuracy is not always the only factor in play. The computational power required to process 20 frames is 20x the normal image. And the overhead of actually comparing the frames 20^2 if each frame is compared to every other frame. Since this is done automatically by bots, speed most certainly does affect the final performance of a bot.
- 6ren 13y agoI was thinking they'd use motion blur - humans are good at seeing through that. But they don't blur. Each frame is crystal clear. Giving the bot 20 data instead of one, as you say.
- joelthelion 13y agoIt actually makes it a lot easier for humans, while not making it immediately easier for bots which will need to be tuned to use motion. Pretty smart.
- codeka 13y agoSure, but it wouldn't take a lot of tuning to update a bot to read the animated frames and then you're back to square one. In fact, with 20-odd frames and only three (entirely upper-case!) letters to select it looks very easy to develop a bot that would get a very high success rate.
- joelthelion 13y agoActually benefiting from the motion requires a new algorithm. Probably not that hard to design, but not trivial either. As always CAPTCHA is a game of cat and mouse. When something is completely broken, you need to think up something new.
- deleted 13y ago[deleted]
- calinet6 13y agoAre the people using the captcha-breaking algorithms the ones developing them? Probably not. These things take time... the best way to combat them is probably to change what your captcha looks like and works like every week or so.
- leddt 13y agoYou don't actually need to use the motion to improve the success rate. Just run the normal algorithm on each frame and elect a winning solution.
- lachenmayer 13y agoThey don't really have to be tuned for motion, you can just consider each frame individually.
- dan1234 13y agoMaybe they're hoping the overlapping letters make it more difficult to solve through a bot? I have to admit I'd expected something better, although it's certainly not a form designed to be seen (I'm assuming it's required for legal reasons)
- nanofortnight 13y agoNot to mention the motion makes separating out the letters easy[1]; optical flow can be used to segment the individual letters. [1]: Have not actually attempted this.
- OGinparadise 13y agoI hope not, these are refreshingly easy for humans, compared to the rest. Maybe an Apple engineer can chime in
- shawnphoffman 13y agoI'm surprised they don't include letters in different colors and only have you distinguish ones of a particular color. Or make certain colors blink having the user select only the ones that are blinking.
- Y0L0 13y agoAn animated gif you mean?
- mef 13y agoLooks like it's using http://nucaptcha.com http://nucaptcha.com
- nwh 13y ago<td colspan=2 align="right"><!-- NuCaptcha Start - Java 1.7.15908 --><script type="text/javascript" charset="UTF-8" src="https://s.mzstatic.com/captcha/staticd.nucaptcha.com/16606/v7/skins/itunes-alt/nc.min.js"></script> Yup.
- codeka 13y agoAccording to their website[1], it's supposed to be H.264 video, but it's clearly an animated GIF. [1]: http://nucaptcha.com/features/security-features http://nucaptcha.com/features/security-features
- jvzr 13y agoAlso, this bit: "It's important to note that NuCaptcha is a video stream and not a Flash program. This is because it is not secure to create a Captcha in Flash." Yet, the Click-to-Plugin feature from Chrome says it's Flash. Worst captcha company ever?
- gbog 13y agoDid you check if the flash content was vector animation or video?
- smackfu 13y agoI think the point is that it's not a Flash program that is taking the Captcha value as input and then animating it, where it would be easy to sniff the input value. It's a Flash player for a video stream that is generated externally to the Flash.
- mjs 13y agoInterestingly they claim that the moving images are "an H.264 MPEG-4 Video Stream that is rendered in your browser in a variety of ways" http://nucaptcha.com/features/security-features http://nucaptcha.com/features/security-features but they're not--it's just an animated GIF! The one on their demo page is http://bit.ly/10vBCDf http://bit.ly/10vBCDf And Apple's production version is also an animated GIF, at least on Chrome/Linux.
- neya 13y agoThe signup form looks horrible because they've mixed serif-fonts with a page with sans-serif fonts. Probably some intern is going to get fired for this...
- tiziano88 13y agoI don't see any serif fonts on that page.
- lucb1e 13y agoI do. The text above is sans serif, but the form fields are serif. (Chrome @ Windows 7)
- codeka 13y agoThe form is actually in an <iframe>, and the iframe content is completely unstyled, so presumably if your browser's default font is sans-serif then you won't see it. Quite sloppy, IMO.
- tommorris 13y agoNot seeing that on Firefox for OS X: http://cl.ly/image/3m3j3E061z1F http://cl.ly/image/3m3j3E061z1F
- stickydink 13y agoChrome on OS X doesn't like it, at all :( http://i.imgur.com/PMcxkDt.png http://i.imgur.com/PMcxkDt.png
- flixic 13y agoI do as well, Chrome on Mac: http://cl.ly/OveN http://cl.ly/OveN
- SpiritualBeggar 13y agoLooks like you are using HTTPS Everywhere? Try disabling it or click the icon to load the insecure script.
- vacri 13y agoIronically it's only shown if you allow javascript from "mzstatic".
- dpcx 13y agomzstatic.com is one of Apple's "CDN" domains.
- woof 13y agoBrilliant! The real captcha must be to type "the RED Moving Letters"
- cmircea 13y agoNow if it only had some letters in another color...
- amitdugar 13y agoIf this gif CAPTCHA system becomes popular, there will be some smart hacker who will figure out a way to crack this (read first frame, match different frames etc.) I wish there was some better CAPTCHA alternative. CAPTCHA can be really horrible sometimes. I know some people who close a webpage when they see a CAPTCHA, unless they have no other option and are forced to fill the form.
- smcl 13y agoYou don't even need to be a particularly smart hacker. Even just dumping a screenshot of the page [1] using phantomjs gives you a relatively legible image. [1] http://blog.mclemon.cz/apple-nucaptcha-easy-to-break http://blog.mclemon.cz/apple-nucaptcha-easy-to-break
- amitdugar 13y agoso apparently reCaptcha is more secure than this one. From Nucaptcha's website : "...most secure and usable Captcha solution in the market." :D
- jamescun 13y agoIts very possible that the contest is being run by an outside agency and Apple have been know to proxy in content from the outside agency and display it inside an IFrame, similar to here.
- fla 13y agoIt's also available as an mp4 video if you remove the type=GIF param
- palmr 13y agoI tried making an animated gif CAPTCHA a few years back, relying on persistence of vision (to try and get round the whole screenshot and process botting issue): http://sandbox.palmnet.me.uk/gifcaptcha/index.php http://sandbox.palmnet.me.uk/gifcaptcha/index.php Ended up with roughly 75% correct human responses and 40% correct using a bot. Which are pretty poor stats for both sides of the equation.
- cmircea 13y agoEeew.
- professorTuring 13y agoThis looks like a much better idea. I would continue working in this. I have some feedback to make it harder for robots and easier for humans. Consider this as some quick ideas that should be elaborated (and they may be wrong): - Move the letters in opposite direction to the windows and maybe rotate them or make them move inside the canvas. - Make the windows appear in randomize locations but move them faster. - Make the blacked part change colors. I think this is a very, very good way to make a turing test. Congratulations.
- palmr 13y agoCheers for the feedback. I gave up on it quite a while ago but I could revisit it some time and try out some of your ideas. The main issue was that some browsers render the frames so slowly it was almost impossible. Also, while making it slightly harder to crack with a bot it can be done by merging the frames together and tracking the lightest parts to find the letters which can then be put through OCR. Also, while making it harder for bots to crack it also makes it significantly harder for people to read, especially people without 20/20 vision which is a major problem.
- damoncali 13y agoKeep working on this. It's a little irritating to look at, but I bet with some more effort, you can make it pretty nice.
- andyhmltn 13y agoThey can just take a screenshot and analyse it that way.
- DonnyV 13y agoI wonder if creating an animation using canvas would've been better. Then the only way to crack it would be to bring the whole page in memory, take a screenshot and then OCR only the spot the canvas is in. If you made the animation move around also then I don't think anyone would bother trying to crack it.
- Achshar 13y agoManipulating canvas requires javascript. It's probably not a good idea to give out value to captcha via js. Although modern browsers are very strict with who can access what js scope.
- ds9 13y agoI know I'm not the only one who turns off gif animation in browser options. Lots of people can't read text if something is moving on the page. It's going to be a big hassle to turn it on for certain sites, then off again after the CAPTCHA, if this catches on.
- edemay 13y agoDon't forget that if you're using animation and video to design a captcha, there are a lot of other design options possible: letters appearing one after the other, going in and out of blur, playing with colors, etc... A lot more graphical gimmicks can be added while maintaining comprehension for humans, and hopefully, improving blocking bots.
- canthonytucci 13y agoI read that checkbox at the bottom as "I have agreed to all 50 billion of the rules for this contest"
- mmalone 13y agoThis is the alternative means of entry page for a contest. This isn't even a page that Apple _wanted_ to build. It's a legal requirement. The CAPTCHA is provided by a third party. Who knows why it was chosen. I doubt they put a ton of thought into this page, or the choice of CAPTCHA, if they even built it themselves at all.
- jpalomaki 13y agoMaybe it is enough to just try something different? Certainly somebody can break this, but if its something new, it requires some effort. Compare that to some well-known captcha system which you can break for something $2 per thousand captchas.
- jetru 13y agoThis still doesn't solve one of the big CAPTCHA issues. Do look at this USENIX paper in [1]. It's still possible to offshore manual CAPTCHA solving to places with cheap labour at extremely low costs. I don't know how common software solvers are, but my impression is that the technology there is only so-so. [1] Re: CAPTCHAs – Understanding CAPTCHA-Solving Services in an Economic Context http://static.usenix.org/events/sec10/tech/full_papers/Motoyama.pdf http://static.usenix.org/events/sec10/tech/full_papers/Motoy...