3 ms·

Isn't object recognition in a not-distorted environment relatively easy? Click-and-drag is something UI automation does all the time, so that's not the hard par

Isn't object recognition in a not-distorted environment relatively easy? Click-and-drag is something UI automation does all the time, so that's not the hard part, either. A couple more thoughts: This requires a huge, human-written database (or it requires an algorithm ... and, oh wait, we already decided that if an algorithm can do it, then it's not really worth of being a captcha) Also, a few of the images, especially the coffee mug ones, look like they could be solved by selecting the whole image.

red3king 13y ago
That's a good point, but we are a long way away from an automated general object recognition system. This discounts occasional outliers such as obvious objects which take up the whole page, or ones that are clearly visible against a gradient-less background (both of which can be pruned). Currently, we are validating inputs from a human written database, which is continuously being expanded with new user inputs and new images. One image is used for validation, and the other is used for expanding the pool.
- krapp 13y ago
  An attacker might not even need to use object recognition. The 'noun' (beerbottle, golfcart) is always in the same place in the DOM (so, easily targetable as text) The urls for each image appear to be constant as well. I also discovered the element with the token and the structure of the POST requests to get the pair of images as well as to send data. It might be possible to just bruteforce it with a little scripting, to send random boxes based on the size of the images and when I get "success" back, I know to associate those boxes with those image urls. I assume I can't simply replace the images with ones I want (that would be insane) but I might be able to just bruteforce it with calls to the api until I get images I know. I would suggest that rather than exposing the actual image urls, you serve them up with obfuscated urls (though I personally wouldn't even want them to be publically accessible anyway.) Also, maybe add a bit of good old fashioned cruft to the images themselves, to throw off attempts at storing their hashes. Maybe rotate or flip them now and then, change the colors, add random lines, filters, etc (basically what happens with text captchas.) Just some random ideas.

red3king 13y ago

That's a good point, but we are a long way away from an automated general object recognition system. This discounts occasional outliers such as obvious objects which take up the whole page, or ones that are clearly visible against a gradient-less background (both of which can be pruned). Currently, we are validating inputs from a human written database, which is continuously being expanded with new user inputs and new images. One image is used for validation, and the other is used for expanding the pool.

krapp 13y ago
An attacker might not even need to use object recognition. The 'noun' (beerbottle, golfcart) is always in the same place in the DOM (so, easily targetable as text) The urls for each image appear to be constant as well. I also discovered the element with the token and the structure of the POST requests to get the pair of images as well as to send data. It might be possible to just bruteforce it with a little scripting, to send random boxes based on the size of the images and when I get "success" back, I know to associate those boxes with those image urls. I assume I can't simply replace the images with ones I want (that would be insane) but I might be able to just bruteforce it with calls to the api until I get images I know. I would suggest that rather than exposing the actual image urls, you serve them up with obfuscated urls (though I personally wouldn't even want them to be publically accessible anyway.) Also, maybe add a bit of good old fashioned cruft to the images themselves, to throw off attempts at storing their hashes. Maybe rotate or flip them now and then, change the colors, add random lines, filters, etc (basically what happens with text captchas.) Just some random ideas.