19 ms·
Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”
- peeyushagarwal 12y agoHere is a video introducing the no CAPTCHA reCAPTCHA https://www.youtube.com/watch?v=jwslDn3ImM0 https://www.youtube.com/watch?v=jwslDn3ImM0
- TallGuyShort 12y agoIf I had only seen that video, I would think this was an April Fool's joke. I then read the article and was relieved to hear there is a little more than this. Perhaps I'm just being pessimistic, but I feel like this only raises the bar a little. I would expect checks it does of mouse movements or headers to be spoofable quite quickly after introduction. I think the best measure mentioned is tracking which IPs are bots, but that's still going to have serious shortcomings.
- Luyt 12y agoVery cute video. I like the way the mouse pointers scares away the 'nasties'.
- Someone1234 12y agoI recently added recaptcha to a site and got this version. From an implementation standpoint it is utterly painless. The client side is copy/paste from Google's site and the PHP/server side was this: $recapchaURL = 'https://www.google.com/recaptcha/api/siteverify?secret=600SZZ0ZZZZZIZi-ZZ0ZEHZW1000Z_0ZZZ00QZZ&response=' . request_var('g-recaptcha-response','') .'&remoteip=' . $request->server('REMOTE_ADDR'); $recapchaRespone = file_get_contents($recapchaURL); if(is_null($recapchaRespone)) { print("Recaptcha failed. <more error msg>"); return; } $recapchaResponeJSON = json_decode($recapchaRespone); if(!( !is_null($recapchaResponeJSON->{'success'}) && $recapchaResponeJSON->{'success'} == 'true')) { print("Recaptcha failed. <more error msg>"); return; } Most of the time it just gives you that one checkbox, but if you use the form multiple times (e.g. testing) it starts to give you the classical text entry box. I have no idea how it works fully and this article only sheds little light on it.
- timtadh 12y agoIs that your actual secret? you might not want to reveal that/you should get a new one.
- Someone1234 12y agoIt is not. I kept the length and style the same to give a better example, but replaced most of the characters with 0s and Zs.
- deleted 12y ago[deleted]
- johnward 12y agoThe old recaptcha takes good sites and gives them terrible user experience. I tried to order tickets one time on ticketmaster and actually gave up because I couldn't get past the captcha. I hate current captchas with a passion and I hope they finally die. I understand fighting spam but when it completely ruins a user experience it's not worth it. edit: Bury me with no explanation why? Please don't tell me you think the UX of using recaptcha is great. I'm a 28 year old dev with near perfect eyesight and It takes me several tries to get these right. They are horrible. I welcome this new change and hope it isn't easily cracked.
- whydoyouthink 12y ago"Bury me with no explanation why?" -- because your comment has only the most tangential relation to the linked article. Downvotes are supposed to penalize uninteresting posts, not just wrong posts. No one likes captchas, and everyone has had shitty experiences with them. Your comment adds nothing to the discussion, doubly so since you're complaining about a type of captcha that has just been replaced!
- jackalope 12y agoI'm guessing your third sentence triggered a penalty. Replace "current captchas" with a blank and you'll see why. I agree that the reCAPTCHA experience is terrible and assume many others agree with you, in part spurring the development of this new approach. I don't believe that every reCAPTCHA has a solution, or at least a consistent one, so I always feel like a percentage of time wasting is built-in. To work around it, I usually regenerate it until I get one that looks easy, but it's still frustrating. Improving the odds of getting it right the first time will help improve the experience a bit. But my biggest gripe is that they can make direct downloads impossible for resources that don't require extra protection.
- henpa 12y agoChallenge Accepted!
- moron4hire 12y agoThe tiniest mouse movements I make while tabbing to the checkbox and hitting my spacebar to check it? Or tap it on my touch screen? And why wouldn't this be vulnerable to replaying a real user's input--collected on, say, a "free" pornographic website? Their answer seems to be "security through obscurity".
- dsjoerg 12y ago"Security through obscurity" is a weak concept, however the goal here is not security but fraud detection. Obscurity is a legitimate component of a fraud detection system, for the same reason that hiding your cards is an important part (but only a part!) of being a good poker player.
- drcomputer 12y agoIt's always security through obscurity. f(obscurity, time, analysis) = clarity The details of implementation are left to the reader as an exercise
- cheshire137 12y agoI wish they would explain more about how the user interacts with the whole reCAPTCHA leads them to know it's a person and not a robot, but maybe they're worried about people writing bots to get around their protections.
- chrisan 12y ago> However, CAPTCHAs aren't going away just yet. In cases when the risk analysis engine can't confidently predict whether a user is a human or an abusive agent, it will prompt a CAPTCHA to elicit more cues, increasing the number of security checkpoints to confirm the user is valid. Probably using a combination of G+ and GA to check your 'history' to see the activity is like a normal human. Visits a couple news sites each day, checks their gmail, searches for random crap randomly, GA registered a 'conversion' for some company = probably a human
- emcrazyone 12y agoI was thinking they may be looking at how long it takes for a user to click the "I'm not a robot" link. A robot would probably load the page and quickly, without delay, send the HTTP POST but I have to imagine they thought of this already and bots writers would quickly add a sleep() call in there at some point... Yea, I wonder about their internal logic too.
- giarc 12y agoGiving that away will give the bots a head start to figure out how to overcome this new roadblock.
- ryandvm 12y agoOr more likely they realize that explaining that your robot quotient is based on a statistical analysis of the last 6 hours of your browser traffic would probably freak everybody the fuck out. They're almost certainly using the adwords cookies that get hit from 90% of the sites out there to figure out if you're a bot or not.
- 12y ago
- uokyas 12y agowill GUI automation tools be able to surpass this?
- Khao 12y agoIt probably uses a LOT more info than only the mouse move/mouse click. Remember, google tracking is embedded in probably 99% of websites you visit so from your ip, cookies, tracking, logged in Google profile, etc... they're able to know if you're a human or not.
- towelguy 12y agoSo if I don't have a Google account or allow their cookies in other sites then I'm not a human anymore?
- seren 12y agoNothing as dramatic : if you don't have a strong Google footprint, it is less likely that the system will recognize you automatically as human, and you'll have to answer the picture question.
- chopin 12y agoNot from Googles point of view, probably...
- random28345 12y agoThink of it as "remember my login on this computer". If you check the box, you sacrifice security and privacy for convenience. If you don't want to be tracked, you need to perform extra steps.
- wspeirs 12y agoCorrect, no Google account or cookies = not human :-)
- moconnor 12y agoIf you don't have advertising cookies set then you're either a robot or a potentially unprofitable human user from Google's point of view. Both would be best avoided. As others have noted here, that's not the goal here and the captcha will degrade to the current ones in this case, but it highlights an interesting way for internet properties to maximize their revenue per user by only allowing users whose existing advertising footprint suggests they will contribute meaningful value to use the service in the first place. Detecting bots is the first step to this, but detecting potentially unprofitable humans would be a natural extension.
- amelius 12y agoI just hope it also works for pen-tablets, where the "pointer" can suddenly jump from one location to the next when the pen comes near the surface of the tablet.
- ldng 12y agoThat and what about those who fill their form with tab navigation ? No mouse involved here. It is just showing off ...
- fredley 12y agoI just tried the one ins0 linked above, and tabbing through, using space to select the checkbox, worked fine.
- fredley 12y agoOr the much more common case of touch screens. I'm assuming it's fine - the fine pointer movements are just one aspect of it, and tapping/clicking with a pen are likely to produce small movements anyway (whether or not those movements are suppressed by the driver of whatever device you're using is another matter).
- impostervt 12y agoUsing my iPhone, it thought I was a bot.
- oaktowner 12y agoMore appropriately stated: couldn't determine a priori that you were a human.
- hokkos 12y ago> Google also will use other variables that it is keeping secret—revealing them, he says, would help botmasters improve their software and undermine Google’s filters I'm pretty sure that looking at the javascript calls will tell what "variables" they use, with browser agent, ip, cookies.
- whyNotBoth 12y agoOh, so just program bots to provide a mouse movement toward a form element along a distorted path, and always trigger them through the UI rather than as events. Got it!
- ggambetta 12y agoYeah, good luck with that.
- nodejsisbest 12y agohttp://phantomjs.org/ http://phantomjs.org/ makes this easy enough to do.
- ggambetta 12y agoYou seem to be assuming Google doesn't know of PhantomJS and many other automation frameworks. In fact, I personally wrote some of the code to detect them - not in ReCaptcha, but in a closely related project (which ReCaptcha may be using, even...)
- epochwolf 12y agoI'm pretty sure you can just harvest mouse movement information and train a computer to mimic that.
- talles 12y agoYa, a little good luck to he, but not so much... I have seen video-games bots that does that unbelievably well. Some powerbot.org scripts are sincerely more human than myself.
- asd 12y agoExactly what I was thinking. Even if Google got smart enough to detect that the distorted path speed was too mechanical, you could record 100's of macros of yourself moving the mouse towards a target. When it's time to submit a captcha, select one of the macros at random and play it back with some slight randomness added. Voilà!
- deleted 12y ago[deleted]
- swalsh 12y agoSorry if the article mentioned it (i only read the first few paragraphs) but looking at the cat click, that looks like a great way to generate training data for AI.
- andreigheorghe 12y agoThis is exactly what the previous implementation was as well. The "words" you had to recognize were either scanned from Google Books, or house numbers from StreetView, effectively enhancing their OCR training set.
- dj-wonk 12y agoIt seems plausible that as more sites adopt this kind of technology, automated web access (e.g. scraping) the web will become harder -- for whatever purpose, good or ill. This has long been an "arms race" between hiding and detection. I can hope that reasonable uses of automation still remain feasible.
- deleted 12y ago[deleted]
- towelguy 12y agoIt was good enough for 4chan, a site that used to recieve countless spam from probably dozens of botters before they got recaptcha. And the botters probably kept trying to spam afterwards without much success.
- deleted 12y ago[deleted]
- aruggirello 12y agoYou're welcome as long as you're respectful. Just use a bot with a clear User Agent, not "Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) CriOS/36.0.1985.57 Mobile/11D257 Safari/9537.53". And, don't forget to start by reading my /robots.txt. If you behave yourself and abide by the rules, why should I ban your bot? If for whatever reason I don't want to allow your bot in, you might still try and contact me to ask, and perhaps I could arrange for your bot to scrape my site. Automated web access to my site must obey my rules because you're using my bandwidth and resources.
- tomjen3 12y agoThat strongly depends on the data you have. I have written boots to scrape sites with government data so that I could do searches that wasn't possible using their online forms. I did not look at, nor attempt to obey, their robots text, nor would I have given a rats ass about breaking whatever they would put up to stop me. There is also the argument that when you make something available on the web you make it available to everybody.
- jfmercer 12y agoI wonder how long it will take for black-hat hackers to crack this. I imagine that it will be very difficult to crack, but it seems inevitable to me.
- _wmd 12y agoWho wants to place bets on the "potential robots" more likely to be those without Google cookies or a Google Account?
- Jgrubb 12y agoI can't think of many better uses for the menagerie of different tracking methods that they have planted on me, to be honest.
- debacle 12y agoWell if you ever run for political office it's going to save them a boatload on campaign contributions.
- Jgrubb 12y agoEh, you never know. Attitudes toward certain improprieties have moderated in recent years...
- forgottenpass 12y agoSo what? Other once acceptable behavior is no longer tolerated. There is always a center, just because it moves doesn't mean that people can't be a socially unacceptable distance from it.
- Jgrubb 12y agoI suspect you have mistakenly stumbled into a lighthearted thread with an overly serious mindset.
- eps 12y agoCertainly seems to be true in my case.
- rspeer 12y agoI've learned that I'm probably a robot, and it's probably because someone on my subnet hits the rate limits on Google APIs sometimes. There was one day when it was so convinced, it was giving me impossible captchas just to use Google Search.
- towelguy 12y agoIs it keyboard friendly?
- merlincorey 12y agoI want to know how well it works with accessibility concerns of various and sundry natures.
- chrisdroukas 12y agoI'd assume that where cursor tracking is unavailable, this experiences just degrades to a standard CAPTCHA as depicted in the post.
- rbdn 12y agoYou can try it out here: https://www.google.com/recaptcha/api2/demo https://www.google.com/recaptcha/api2/demo If you are a recognized as human you could perhaps try it via Tor.
- xioxox 12y agoI wish these google pages wouldn't automatically assume you speak some language based on your IP address - I get mine in German without any option to switch. Aren't there standards for setting language in web browsers?
- towelguy 12y agoYour browser sends an "Accept-Language" header with the list of languages and order of preference you have configured.
- pluma 12y agoSure, but many sites including Google like to ignore these (or at least have done so in the past). The rationalisation is that users don't change settings like these, so their location is a better indicator than what their browser thinks.
- 12y ago
- mdhgriffiths 12y ago> in the last week, more than 60% of WordPress’ traffic and more than 80% of Humble Bundle’s traffic on reCAPTCHA encountered the No CAPTCHA experience—users got to these sites faster. Does this mean WordPress saw an 60% decrease in traffic from bots?
- deleted 12y ago[deleted]
- sp332 12y agoIt still shows a CAPTCHA if it's not sure that you're a human or a bot.
- rbdn 12y agoI could imagine that this system could still be tricked with a Markov chain and some dedication.
- ins0 12y agodon't know if this works only for me but here is a live example - https://www.google.com/cbk?cb_client=maps_sv.tactile&output=report&photosource=panoramio&photoid=&cid=RoMfLbw-sME https://www.google.com/cbk?cb_client=maps_sv.tactile&output=...
- cm2012 12y agoIt worked for me, though Google thought I was a robot at first.
- jcfrei 12y agoProbably because lots of users are currently visiting the link.
- jastanton 12y agoI attempted tabbing to the checkbox and pressing spacebar (not moving the mouse at all) and it worked just fine. Impressive. But I guess the tell-all is how secure it is against bots. not how easy it is for humans to get through. For all we know it could just be letting everyone through :P
- tokenizerrr 12y agoIt gives me the new version as well, but it seems google is convinced that I am a bot. Getting a regular captcha after clicking the button and I have to say that this is a lot worse of an experience than regular old captchas. Now I have to wait for a few seconds after clicking a button, then still solve a captcha. Hopefully it gets better with time.
- slig 12y agoDo you happen to browse incognito or with 3rd-party cookies blocked? Looks like the new version needs an active and valid google cookie in order to tell if you're a robot or not.
- nobodysfool 12y agoTry this one: http://nomorecaptchas.com/ http://nomorecaptchas.com/ It's very similar. I might go as far as saying that Google copied them.
- zoidb 12y agoHow long before you will have to answer a series of annoying and difficult questions if you don't allow tracking cookies and google to collect personal information (which I assume the far majority of users allow on a regular basis)? Not sure how I feel about this.
- LLWM 12y agoIf they create services that you want to use so badly, they can charge you whatever they want for them. If you don't want to pay, I'm sure Bing will be happy to have you.
- spain 12y agoSo how does it work?
- rbdn 12y agoGoogle collects all your data and applies machine learning to predict a probability value that you are human. If it is below a certain threshold you have to enter a CAPTCHA.
- spacefight 12y agoThe question was more about on how the new captcha works, I guess.
- bpicolo 12y agoThat's the question he answered. It's machine learning based on browser variables and mouse movements.
- rbdn 12y agoThe old system presented you a challenge-response test no matter what.
- spacefight 12y agoSorry, I just thought "all your data" was a bit unspecific. I have no idea what Google collects in order to derive that. I have a lot of guesses, but "all your data" doesn't tell me in fact, how it works. And I thinks that was what the parent poster asked for.
- grimtrigger 12y agoIt seems like they're using cursor tracking to validate human-ness. Assuming thats the case: Since the cursor is outside of javascript's control, it would force the attacker one level higher (to the browser/os, instead of the dom). Not impossible, but still a significant barrier.
- fatratchet 12y agoNot really, you would just need to reverse the js code, look at what data they actually send to google and randomly generate appropriate data like mouse movements.
- grimtrigger 12y agoAh, good point
- alpeb 12y agoThink of Captcha as the first battle in humanity's fight against AI. Over the long term this problem has no solution.
- mkal_tsr 12y agoExcept by answering captchas, you're helping the machines (first words for books, then numbers for street view, now pictures for classification).
- hashmymustache 12y agoThat's an interesting thought that every time we introduce novel classification schemes to resolve humans from computers we feed a large training set for them. I never understood how that works, though. If I get a captcha street address wrong then that means they already had the answer, so how am I contributing?
- dagw 12y agoFor the street address ones you generally have to answer two questions, one that they know and one that they don't know. You're only 'tested' on one of them, but you don't know which. Once enough people have gotten the known one right and given the same answer to the unknown image they move the unknown image to the known pile.
- darkstar999 12y agoThey already know the correct answer if they are only showing you one image to solve. When there are two images to solve, they know the correct answer to one. The other is shown to thousands of people, and eventually it is solved with high confidence.
- dragonwriter 12y agoCaptcha isn't the first battle in humanity's fight against AI, its a recent battle in humanity's fight against abusive humans.
- cinquemb 12y agoTangential: From a philosophical perspective, I wonder if notion of asking human beings if they are robots, will soon escape the space we consider virtual? In sci-fi (which more or less informs the masses not involved in such fields and have more sway over public opinion than say HN or LW), the premise focused on is that people seemed more concerned with asking robots/automata if they are human. I'm starting to wonder if such questions will become moot. Though, I wonder if you can start to defeat such systems by slurping up headers sent on public networks (like coffee shops, public wi-fi in large cities, airports, etc) and with techniques like ssl striping, to obtain local-storage info being sent in the body.
- yc1010 12y agoAnyone know where the documentation for the "old" recaptcha has gone? How long can we continue to use the "old" way? Seems like google want everyone to use this "new" method, which i am not so sure about yet
- blalab 12y agoHere you are: https://developers.google.com/recaptcha/old/intro https://developers.google.com/recaptcha/old/intro
- echeese 12y agoIt's definitely not mouse based. I tried it in an incognito tab and it showed me the old form when I clicked the checkbox.
- BogdanCalin 12y agoOn what page did you tested the new system?
- echeese 12y agoHere you go: https://www.google.com/recaptcha/api2/demo https://www.google.com/recaptcha/api2/demo
- Nib 12y agoWow, that's odd. I checked it out on mobile and they confirmed me human without giving me the images set similarity question. I don't think they can predict this from the way I touch the screen >.<
- underlines 12y ago1. Tested on my normal chrome where I didn't delete any cookies and logged in to my google accounts, and no adblocker running. So plenty of evidence I'm human, with all those cookies from big G. 2. Tested in incognito mode: BAAM: I'm a bot, had to fill out the old captcha!
- kuschku 12y agoSo, I tried it. With a Google Account that had ZERO activity for two years. Using a Java program to activate that site. Passed the CAPTCHA. Without any further verification. I mean, spammers are going to love it xD
- iak8god 12y agoI tried the demo in two different browsers that I use regularly. On the one that stays logged into my google account, I was not challenged with a captcha. On the other browser, which I use quite a lot but not with my google account, the captcha appears. I'd think that having a long-standing google account with a normal history of activity would be a good indication that one might be a human. If google is weighting that heavily for this test, that may create a new incentive for spammers and scammers to hijack people's google accounts.
- pbaehr 12y agoI suddenly became extremely conscious of how I was moving my mouse for the duration of that article.
- slig 12y agoI've been blocking third-party cookies for a while, and I noticed that I only get the old, hard to read, captchas, instead of the easier version with numbers. Too bad this new version won't work for me either.
- jackalope 12y agoI always assumed Google's use of reCAPTCHA was to augment the OCR used to digitize Google Books, particularly in results the software couldn't confidently match to a word. Is this true? It's interesting that it's still the fallback for the new method.
- Argorak 12y agoThat was the original goal of the project. http://en.wikipedia.org/wiki/ReCAPTCHA http://en.wikipedia.org/wiki/ReCAPTCHA "By presenting two words it both protects websites from bots attempting to access restricted areas[2] and helps digitize the text of books." For some time, you could pass a reCAPTCHA test by just entering the more distorted word correctly.
- willlma 12y agoThis should be the top thread. I find the whole topic of crowdsourcing to compensate for the inadequacies of computer vision (and other inadequacies) fascinating. OCR was the first problem. We've been helping Google Maps identify house addresses for a while now with reCaptcha, and with this announcement it looks like Google is finally tackling the problem of image association. Computers suck at determining which pictures contain birds. By making users tag all of the images on the web, they're making image search much more powerful and will hopefully improve the entire field of computer vision. When I tell my future robot to go get my coffee mug, I don't want it coming back with the PS5 controller.
- verroq 12y agoI only ever enter the distorted one, works every time.
- jrochkind1 12y agoThat was the original idea behind reCAPTCHA (which originated outside of Google, acquired in 2009), but my understanding is that they long ago ran out of actual text that needed human OCR'ing, and/or found other reasons that approach no longer was helpful. The "help OCR while also spam protecting" thing isn't currently mentioned on Google's recaptcha product page.
- towelguy 12y agoDo they even need the checkbox anymore? They could track mouse movement, keypresses, history or whatever else they are tracking without showing any kind of GUI at all.
- Aissen 12y agoSo now spammers will use botnets… Oh wait, they already do. They already have the botnets. Now they need to use those end-user machines as proxies, using the credentials already on the machine. They just need to figure out the other parameters: maybe it's running js code ? Then you can use a browser engine/selenium). Maybe it's the click pattern ? Just generate the json data and send it. They can even apply the same machine learning techniques to figure out the best way to circumvent the captchas. And the escalation continues.
- rudolf0 12y agoYeah, I feel like it won't be too long before spammers start finding ways to emulate users without having to solve any CAPTCHAs. Google is likely going to need to switch their 98%/2% to something more like 80%/20% (that is, 20% of users will still need to enter CAPTCHAs).
- kuschku 12y agoI am using a small tool that I wrote to integrate Google Keep and other Google stuff with KRunner and so on, and this tool (essentially being a dumb bot) also passes all the Captchas. I’d say malicious authors would have it really easy now.
- rakmm 12y agofuck
- oxfordbiochron 12y agoThat is what people say when they see http://NoMoreCaptchas.com http://NoMoreCaptchas.com and then say it a few more 1,000 times when they see e-DNA in action from http://Oxford-Biochron.com http://Oxford-Biochron.com
- provemewrong 12y agoThey've been doing this for a while. With recaptcha, you got easier captchas (a single street number instead of two words) if the system thought you were human. There was an official post about this a year ago. [1] Now they have probably improved the system enough to be confident in not showing captcha at all. It's nothing revolutionary. If it thinks you're a robot, you still get the old captcha. [2] [1] http://googleonlinesecurity.blogspot.com/2013/10/recaptcha-just-got-easier-but-only-if.html http://googleonlinesecurity.blogspot.com/2013/10/recaptcha-j... [2] http://i.imgur.com/pCKS8p5.png http://i.imgur.com/pCKS8p5.png
- mcovey 12y agoI've noticed that I get the house numbers when I leave 3rd party cookies enabled, and a much harder, often impossible captcha when they're disabled. Since leaving them off doesn't break much else, I do, and just fill out the harder captchas when I come across one. By the way, you only have to fill out the "known" word, the one that's all twisted and usually impossible to read until you refresh the image 10 times. Even completely omitting the 2nd word, which is the unknown word that OCR couldn't figure out, it will still validate.
- chuckcode 12y agoAm I being paranoid when I think that offering this "free" service is a great way to track people over even more sites and usually the most important conversion pages that don't have the usual google display ads. I don't see a big technological innovation here as it appears that mostly they are checking your cookies to see if they recognize you.
- cLeEOGPw 12y agoSo they can track you better and provided better targeting ads. That's where they get the money from. That's how you pay for visiting websites.
- throwaway234 12y agoEvery "free" service from Google has the end goal of serving you personalized ads. That's their business.
- ThomPete 12y agoMaybe I am getting ahead of myself but this seems to have huge potentials and is actually quite interesting from a whole other perspective. If a machine can determine you are human what if it learns your unique patterns? Couldn't it then be used to determine you are you? And couldn't this solve the problem of identity? In the bitcoin world, what if you could use this to log into your bitcoin wallet?
- Nib 12y agoHmmmm. Nice move Google. But I also remember that a machine passed the Turing test. And I don't like the sound of these two news together. Not because I'm worried about you, but because I'm worried about the websites I run as a dev. Moreover, I'm not sure if most people know this, but reCaptcha was supposed to be converting ancient text to digital text[I read that once on quora, I'm not really sure if it's entirely true, but I guess it is]. So now, I can be less proud of not contributing to conversion of ancient texts to digital books. And, I'd love you if you make the thing open-source, Google...
- ChrisArchitect 12y agoha yeah that was definitely the original purpose/project of reCAPTCHA.... but I think shortly after the google purchase, the AI got so good at reading garbled ancient texts that G allowed it to move on to other things..like house numbers.
- _lce0 12y ago.. or human tracking?
- mynameisvlad 12y agoHouse numbers are actually the easier version, you got them if reCAPTCHA already knew you're probably human. After screwing it up a few times, it punts you back into the general category and you get two words again.
- cJ0th 12y agoIt says that they do take mouse movement into account but the cookie part makes me feel a little uneasy: > IP addresses and cookies provide evidence that the user is the same friendly human Google remembers from elsewhere on the Web. If this becomes a trend then major commercial websites will become unusable for people who are not accepting (third-party) cookies. "Because those damn bots" is a straw man argument to make people trackable by assuming that there are no other useability improving methods that don't track the user (which I think is highly unlikely).
- Pwntastic 12y agoIt's only used to generate a confidence level. "In cases when the risk analysis engine can't confidently predict whether a user is a human or an abusive agent, it will prompt a CAPTCHA to elicit more cues" So if you have cookies disabled, you'll probably just get a regular captcha
- cJ0th 12y agookay, that's reasonable.
- ep103 12y agoThat's not reasonable, its yet another way google is monitoring everything I do online.
- cJ0th 12y agowell yes and no. In a way it is a win-win situation: It is reasonable in that it doesn't aggravate the situation for those who block cookies. (yet) And those that allow cookies get at least some convenience in return for that. However, looking from a different perspective you can say that they're taking advantage of people blind with greed who want maximum convenience when using the web.
- icebraining 12y agoWhat makes you think they weren't already monitoring?
- ricg 12y agoIt's definitely not only relying on cursor movements. A simple $('iframe').contents().find('.recaptcha-checkbox-checkmark').click() proved that I'm not a robot, without me touching the mouse.
- 1Hz 12y agoThe cursor movement story seems to be a smokescreen to dilute the fact they're actually running an internet wide monitoring network, tracking users from site to site and building profiles on them.
- ifdefdebug 12y agoI tested it a few times in their demo trying hard to to funny things with the mouse pointer. Still I was asked to type in some text all the time. Then I logged into my gmail account and yes it worked. So you're probably right about that smoke screen and it has nothing to do at all with mouse movement. My fx browser deletes cookies at exit and my IP changes frequently and I think that's the true explanation for the outcome of my little test.
- gravity13 12y agoI was confused about all of this until I read your comment. Makes perfect sense now! Also makes me think that they can dump the whole charade and provide no security check at all, but that'd probably make the service-providers uncomfortable and they lose the user as a source of human-intelligence for classifying things on google image searches.
- echeese 12y agoI'm not sure where cursor movement was mentioned, other than the comments.
- ifdefdebug 12y agoI read it in the wired.com article about this also submitted to HN: "And [Vinay] Shet says even the tiny movements a user’s mouse makes as it hovers and approaches a checkbox can help reveal an automated bot."
- Shivetya 12y agoI always liked the captcha's that asked simple questions or told you what to type. Sites that used what is 1+3 or type the number four into the box below. Is there really a system once employed that coders won't overcome in days? Do we need a trusted user system, where the machine registered at a central site and that can be queried by the commerce site? Recognition of the consumer machine through combination of mac/ip range/provider
- agumonkey 12y agoNow bots will have to up their game and really become human level agents. #evolution
- geographomics 12y agoI wonder if they've taken into account people with movement disabilities such as multiple sclerosis or parkinsonism. Then again, the previous recaptcha techniques would be somewhat discriminatory against those with visual or auditory difficulties as well so they've had to think of this already
- trolltroll5 12y agoI can not find any documentation about how to put in the new reCAPTCHA if you already using their older version...
- darkstar999 12y agoI'm fairly certain that it doesn't require you to change anything, it will just start working. You must be a bot.
- ohash 12y agoAnd what about people with motor-neural conditions?
- aruggirello 12y agodid you mean cyborgs :)
- oaktowner 12y agoI think worst case scenario is that they get what they have today (solve a captcha style problem). Con: They will have an additional click. Pro: They might get a more solvable puzzle than some of the "read this distorted text" images they would see today.
- netvisao 12y agoThis will greatly help them with bettering their CV classification algorithms. The kitty picture matching question is a great example.
- gizzlon 12y agoThis is great news! I really really really hate the normal Captcha's. It has a nice property: To combat spam, Google can tweak this as often as they like without bothering the users of a website or the devs running it.
- garrettgrimsley 12y agoThis not even close to a Turing test. I thought Wired was supposed to be a tech site.
- umeshunni 12y agoWired has been slowly moving from being a tech site to a clickbait/sensationalism site.
- username223 12y agoMy guess is it's based on the tracking data they already collect on most people. I try to avoid it, so I get stuff like this: http://i.imgur.com/6mGYsav.png http://i.imgur.com/6mGYsav.png I have no idea what that second word is supposed to be, so if you use this, I probably won't use your site.
- lnanek2 12y agoIt isn't user friendly, but often with that type it doesn't care what you enter for the tough to read world. The easy to read word is your test. The other is a way to harness people to do difficult OCR tasks. Some web sites have had fun organizing entering dirty words for the tough to read ones regularly to mess with the results :)
- TimJRobinson 12y agoIt's actually the other way round for the Captcha posted and most recaptchas I've seen. The easy to read word is the OCR and the hard one is the real captcha.
- blisterpeanuts 12y agoThis is fascinating. So they're harnessing the collective OCR powers of the internet surfing public? Diabolically clever.
- wingerlang 12y ago"unklist", although I have not idea what it means.
- test_pls_ignore 12y agoWhen a Captcha contains two words, usually there is one "real" word, and one "fake" word.
- sjs382 12y agoThose computer-vision challenges mentioned in the blog post aren't 100% clear. For the first one, my eyes went directly to the cranberry sauce, and I thought to myself "Wait... is that one supposed to be clicked, too?"
- mcintyre1994 12y agoI thought it was unclear too for a different reason - the text says "that match this one" which I read as being actual identical matches. Sure it's obvious when you see the images but that wording feels really awkward.
- pimlottc 12y agoSame, my first thought was to look for the identical cat photo, or maybe the same cat from a different angle, not just other cats.
- Sir_Cmpwn 12y agoI noticed this a while ago when the Humble Bundle switched. I was able to break it with PhantomJS.
- divegeek 12y agoWhat do you mean by "break"?
- Sir_Cmpwn 12y agoPassing the captcha through an entirely automated procedure.
- Dylan16807 12y agoIn bulk? It's not supposed to stop real users from using a bit of scripting.
- rudolf0 12y agoIt kind of is, actually. Cloudflare, for example, uses a single CAPTCHA to prevent ongoing DDoS attacks. If they switched to this new reCAPTCHA and if a DDoSer can use Selenium to get past the challenge, then the CAPTCHA process has failed. There are always tradeoffs with this. I strongly suspect Google is going to have to restrict it within a year or so, resulting in the number of users who still have to solve CAPTCHAs closer to 10-20%.
- Dylan16807 12y ago'a bit' being key. It's not like a DDoSer can't already solve captchas for three minutes if that's the only protection.
- rudolf0 12y agoThe work still has to be done manually in those cases, though, whether they type it themselves or rent use of a captcha farm.
- hardwaresofton 12y agoI'm still more impressed by sites like http://www.funcaptcha.co/try-it/ http://www.funcaptcha.co/try-it/ Why have they not caught on?
- divegeek 12y agoI would hate that one. Too time-consuming.
- doodpants 12y agoThis CAPTCHA is "fun" the way that fun-size candy bars are fun.
- hardwaresofton 12y agoI guess I know why they haven't caught on now... Just curious - is it the game? or just the whole concept that you guys don't like?
- FunCaptcha_Jim 12y agoHey! Thanks for the shout-out, glad you're digging us.
- xkiwi 12y agoIt rise privacy concern for me. If real name and email validation is mandatory, I will wonder what Google will use that data for. Is that some kind of monitor tool which want to know REAL NAME, EMAIL ADDR whenever you want to use a website? Don't forget Google always beg for your telephone number for "security reasons", Google+ wants your real name for "Policy reason", I upgraded one of my Nexus to Android L, and everything I do has to sign in: some game(Botanicula for instant) work fine without internet in Android 4.4.4 but requires internet signin in Android L.
- m_myers 12y agoWhere are you seeing mandatory real name and email validation?
- CUViper 12y agoThe video demonstrates filling in name and email, although it doesn't say anything about it.
- grecy 12y agoIn the video the user has to type in their first and last name, and an email address. I have to assume there is a confirmation email, otherwise what's the point in asking for an email address?
- dmak 12y agoIts an example form illustrating where CAPTCHAs or where the new captcha will be used
- arikrak 12y agoI had my own simple 'captcha' on my site (since recaptcha could be annoying), but now I added recaptcha since it looks like it will be easier on users. You just need to query recaptcha's service and check if the json string they return contains "success\": true".
- xxs 12y agoGiven that I use keyboard to navigate, I'd qualify as bot easily.
- Dirlewanger 12y agoI feel like if anything this would just add some time to bots plowing through these so their web scrapers can move in gentle curves and whatnot to simulate a human. These don't appear to be that far off from being broken.
- LLWM 12y agoForcing bots to slow down their interaction with online services to human speeds would still reduce spam by a lot.
- nateabele 12y agoThis looks like a very clever way to train machine learning algorithms on image recognition.
- why-el 12y agoIs there any published research on this? I am interested to learn about these risk analysis techniques they are talking about.
- Geee 12y agoIt's based on Google account. There might be other vectors too. I tried browsing lots of pages in incognito, making Google searches, clicking ads etc. but that didn't help (might work in long term). Signing into my Google account (with history) was enough to pass the test.
- dyeje 12y agoIn regards to the video, I feel like it has become a cliche to have upbeat, light ukelele music in the background for product demonstration videos. I instantly felt myself become annoyed when the music started.
- msallin 12y agoGod, I never put my finger on it until you mentioned it. So true.
- walkon 12y agoAnd some unison whistling at the end to complete the cliche. Weird they would even have a video for something like this, leading me to be more suspicious of the mechanisms and data they are using behind the scenes to make this work.
- jonathanmarvens 12y agoBecause ... Google.
- userbinator 12y ago"If we can collect behavioural data from you, and it matches closely the behaviour of other humans, you are a human. Otherwise you're not a human." Does anyone else get that feeling from the description of what Google is doing? I've tripped their "we think you are a bot" detection filter and been presented with a captcha countless times while using complex search queries and searching for relatively obscure things, and it's frankly very insulting and rather disturbing that they think someone who inputs "unusual" search queries, according to their measure, is not human. I have JS and cookies disabled so they definitely cannot track my mouse movements and I can't use this way of verifying "humanness", but what if they get rid of the regular captchas completely (based on the argument that eventually the only ones who will make use of and solve them are bots)? Then they'll basically be saying "you are a human only if you have a browser that supports these features, behave in this way, and act like every other human who does." The fact that Google is attempting to define and thus strongly normalise what is human behaviour is definitely a big red flag to me. (Or maybe I'm really a bot, just an extremely intelligent one. :-)
- nathas 12y ago"I have JS and cookies disabled" So imagine what bots often don't have. Adding JS interaction and cookies takes more effort on the part of the programmer writing a bot. So yeah, you'd look a lot more like a robot. How else would you quickly differentiate between human vs non-human based on a single request, or even a collection of requests over time? It's a game of stats at scale.
- fragmede 12y agoHere's a snippet of Python using the splinter library, to visit Google, type in a search query, and click 'search' (which is very Javascript heavy these days with their annoying 'instant' search). from splinter import Browser b = Browser() b.visit('http://google.com' http://google.com') b.fill('q', 'browser automation') btn = b.find_by_name('btnG') btn.click() Not exactly 'more effort'...
- xanderstrike 12y ago
- chuckcode 12y agoWhat a misleading headline. Google will now look at your mouse movement but really be scanning to see if they've been tracking you across the web. Anybody who is is concerned enough about privacy to block/clean cookies will be assumed to be a non-human.
- azinman2 12y agoAnd then you'll do a captcha like they would have you done previously. So either you're status quo, or you get an improved experience if you're in the vast majority that don't do anything other than non-default. What's wrong with that?
- luckystarr 12y agoHow does this work?
- _lce0 12y ago[Irony] Isn't "bot detection" a small problem related to "human tracking"??
- codeshaman 12y agoRobot testing if user is not a robot. Now that it knows how to detect humans, one day we'll all laugh when we read the news that Google can't log in to their own administration systems, because an AI security algorithm evolved the decision to lock out human beings.
- Houshalter 12y agoI'm concerned this will just ban people using obscure browsers, blocking javascript and cookies, and just behaving in non-typical ways. Fortunately I rarely encounter CAPTCHAs outside of creating an account, and I can just do that through a different browser.
- robbles 12y agoIs there a page where we can test out these new captchas? I'm curious about how they work in the wild, and this post only shows gifs.
- natch 12y agoJust give us your full name. How is this better? They might already have my name but not in an incognito window. But they want it, obviously.
- mostafaberg 12y agoSo if the risk analysis fails I'll get to see a captcha PLUS the new cool check box !, nice.
- natch 12y agoWe can run robots to act on our behalf, but you can't. We can build and leverage AI, but you can't. Seems like that is where this is going.
- arh68 12y agoDoes this remind anyone of SweetCaptcha? [1] The image match games aren't new. Is one better than the other? [1] http://sweetcaptcha.com/ http://sweetcaptcha.com/
- amenghra 12y agoLet's make Captcha mobile friendly by having the client download MBs of useless pictures...
- mikey_p 12y agoThe image captcha looks nearly identical to Confident Captcha: http://confidenttechnologies.com/products/confident-captcha/ http://confidenttechnologies.com/products/confident-captcha/ (formerly Vidoop).
- widowlark 12y agoI feel like there is a lot of discussion on whether its okay for Google to have this information or not, but truthfully if you don't want them having this info then don't use their services. Its that simple.
- davecyen 12y agoPerhaps Google will be using this to train a more broader purposed image recognition AI
- mdb333 12y agoYes exactly... the whole concept of their original captcha came from fixing OCR where the text was distorted. ie put armies of unsuspecting individuals across the globe to work to help their ability to digitize text content into something more searchable. So, no surprise, same thing is going on here. It's much less about security than it is about deriving value from the solved image matches.
- jules 12y agoWhy would you care whether a user is a robot? Surely whether the actions of that user are desirable or not is determined solely by those actions and not whether the thing performing the actions is a human or a robot. It seems like a better idea to disallow bad actions than to disallow robots. There are also people farms who solve captchas (e.g. via porn sites who ask you to solve a captcha which they then input to another site, or by paying people $1 to solve X thousand capchas).
- willlma 12y agoRobots don't buy stuff. Their actions by definition are undesirable from the service provider's standpoint.
- JoeAltmaier 12y agoUnless its a arbitrage robot!
- jules 12y agoThen limit the access of everyone who does not buy stuff to X requests per minute?
- newuser88273 12y agoBecause your dual business model is (1) showing ads to humans and (2) gathering intel on humans. Bots can be used to bypass both.
- oxfordbiochron 12y agohttp://NoMoreCaptchas.com http://NoMoreCaptchas.com eliminates CAPTCHAS. Test it out. It lets humans in!
- rocks 12y agoIsn't that like a reversed touring test? The machine has to guess if I am human and not if I talk to a machine.
- rocks 12y agoIsn't that like a reverse touring test? The machine has to guess if I am human and not I have to guess if I am talking to a machine.
- delinka 12y agoI don't understand how this can't be spoofed. I can only see how it'll slow a bot down, and maybe reduce the number of accounts it can create/commandeer.
- towelguy 12y agoAs long as it behaves like a human, what difference does it make if it's actually a really sophisticated bot?
- delinka 12y agoThat brings me back to "why are we trying to prevent bots?" And I'm under the impression that we want to prevent automated spamming of $web_community_resourse. So to answer your question, it makes a difference because once the really sophisticated bot is in, it starts spamming up the place.
- dlss 12y agoWhat am I missing? Breaking this looks much easier than a regular captcha... This is the sort of problem that genetic algorithms are well suited for (a small, well defined input domain with a binary oracle). You'd simply generate a random path, run a smoothing function over it, see if that works, then iterate. edit: does anyone know a site that is actually using this new widget? I only seem to be finding the older version... :/
- joelthelion 12y agoYou're missing the fact that they're relying on many cues, not just mouse movement. I don't think they're even discolosing everything they use.
- dlss 12y agoYou're missing the fact that they went from something that is quite difficult to get a program to do (essentially an AI complete task) to one that's not AI complete. It doesn't really matter how many non-AI complete components they are measuring... without at least one AI complete task, they removed the thing that makes CAPTCHAs work.
- joelthelion 12y agoExcept distorted text reading is not hard for AI anymore, and all "AI-complete" tasks, whatever that means, are pretty much broken nowadays. So where left with a very hard problem, and their best solution so far seems to be security through obscurity with a bunch of non-disclosed "cues". Not great, but I guess it's hard to come up with anything better.
- chrisweekly 12y agoObligatory XKCD: http://xkcd.com/810/ http://xkcd.com/810/
- mattaus 12y agoHi all, if you want to give it a try, I've just added it to the MaterialUp submission form. http://www.materialup.com/submit http://www.materialup.com/submit
- mr-no 12y agoWhere are you supposed to click if you're a robot?
- mbondr 12y agoThere's practically no documentation for this. They have "examples" for many languages, but they're so sparse as to be useless. I don't have time to crawl through their code. I'm going to wait a few months before implementing this to see what questions pop up on the blogs.
- siavosh 12y agoIt's interesting that the adversarial nature of internet security is "breeding" an adversarial AI. Inevitably, people will start working on AI to beat this new captcha. I think in terms of parallels to biological evolution, security/fraud AI has the greatest evolutionary force behind it. Fun and scary to think where this particular breed of AI will lead.
- nojvek 12y agoComputer Vision guy here. Okay so you've made some improvements for normal users. The captchas are still the old same, just not shown everytime. Still can be cracked with latest neural net techniques. The visual matching stuff can be guessed 6/10 times. You still have audio captchas, that can be cracked. If all fails you still have cheap labour from third world country. I don't see why this is revolutionary? Google will now have their captchas present on every site and start logging user behavior in the name of identifying bots. Who says they won't use the data to drive their ad empire?
- TheCraiggers 12y agoEven if the success rate of detecting robots stays the same, I would say this is still a win because the majority of humans won't have to mess with it any longer. Even better: those with various disabilities won't have to mess with it. My parents' only disability that I know of is near-complete computer illiteracy and I can tell you from experience that every time they're presented with a normal CAPTCHA it's like somebody just handed them a Rubik's Cube and told them to solve it before they can create a profile. In every case I know of, they just turn the computer off and walk away. Now, these are what I would call normal humans (don't tell them I ever said that) so I can only imagine how aggravated those with visual and/or auditory problems get when presented with a crazy CAPTCHA. And when your revenue comes from getting people to submit these, I can see it still being a boon to the website, even if all they did was lower the barrier of entry for humans.
- rdl 12y agoIn the long run, I think it's unavoidable that AI-type systems continue to improve, while humans don't, so this will become a harder and harder problem. One helpful approach would be to separate out "why CAPTCHA" into preventing abuse (through high volumes) and "guaranteed one (or small number) per person" from "am I interacting directly with a live human", and using different things for each. The naive solution to a lot of this is identity -- if FB profiles are "expensive" to create, especially old ones with lots of social proof, you can use something like FB connect. However, there are a lot of downsides to this (chief being centralization/commercial control by one entity, which might be a direct competitor; secondarily, loss of anonymity overall.) One interesting approach might be some kind of bond -- ideally with a ZK proof of ownership/control, and where the bond amount is at risk in the case of abuse, but it's not linked to identity.
- Malstrond 12y agoSo we're actually training users to behave like what Google's behaviour model assumes to be the behaviour of humas. Because then they won't get annoying captchas.
- pizzashark 12y agoIf a bot just makes more random mouse movements of varied speeds, and takes a bit longer, won't it appear human?
- iso8859-1 12y agoThe bot probably has too much or too little mail in it's Gmail inbox, or maybe its is not many Google+ circles of confirmed authentic humans. Maybe the bot has not been using Google Chrome for a very long time, so its browsing patterns may still seem incoherent. This socially disconnected bot is abnormal; it doesn't fit into society. It deserves punishment; we'll make it click pictures of cats. Once it gets enough friends on Google+, we'll cut it some slack.
- kuschku 12y agoI posted this multiple times in this thread already, but I tried it with a Google Account that has a fake name, hasn’t been used for over 2 years, has received nor sent any emails since then, is in only one Google+ circle, and was only ever used from Firefox. And it passed the test. While trying it from within a Java client toolkit. Like, I took the worst setup any spammer would have, and it passed. How is this going to protect my sites from spammers? And on the other hand, am I even allowed to embed this into my site, if I am in the EU (Data protection, etc)?
- seamoss 12y agoEqually as annoying.
- deleted 12y ago[deleted]
- Eric_WVGG 12y agoI really wish they hadn’t botched this through use of the first-person pronoun. “I’m not a robot” no, computer, you sort of are
- ck2 12y agoOne day we are going to have thinking, feeling robots and all this prejudice against them is going to haunt us. Seriously though, this is a great improvement.
- datakid 12y agoAm I Robot by Goodnight Electric is awesome http://m.youtube.com/watch?v=78nGkD3-0kU http://m.youtube.com/watch?v=78nGkD3-0kU
- joshfraser 12y agoHere's the JavaScript behind it: https://www.gstatic.com/recaptcha/api2/r20141202135649/recaptcha__en.js https://www.gstatic.com/recaptcha/api2/r20141202135649/recap... It's hard to see what's sent over the wire (it's obfuscated), but the source gives you a good idea of what they're collecting. The biggie is the GA cookie which is running on over 10 million sites. Like any CAPTCHA, this is still breakable -- just load your actual cookies into Selenium or PhantomJS and replay your mouse movements. Of course, once you do that more than a couple times, you'll likely have to write a crawlers to generate fresh cookies. At that point, you may as well just break the visual CAPTCHA which is trivial anyway. Ie. You should still never use a CAPTCHA (http://www.onlineaspect.com/2010/07/02/why-you-should-never-use-a-captcha/ http://www.onlineaspect.com/2010/07/02/why-you-should-never-...).
- rtpg 12y agoCaptchas can also be useful as a differentiator between free/paid plans, or to slow down users (see 4chan)
- alebaffa 12y agoThe death of Lord Inglip.
- homakov 12y agoI wrote my thoughts on this protection http://homakov.blogspot.com/2014/12/the-no-captcha-problem.html http://homakov.blogspot.com/2014/12/the-no-captcha-problem.h...
- CraigKelly9 12y agoGoogle New reCaptcha using PHP - Are you a Robot? http://www.9lessons.info/2014/12/google-new-recaptcha-using-php-are-you.html http://www.9lessons.info/2014/12/google-new-recaptcha-using-...
- kolev 12y agoDid anybody notice that they killed the email obfuscation service? It made possible to share publicly your email, which was getting revealed with reCAPTCHA.
- sytelus 12y agoI suspect there is no theoretically perfect solution to CAPTCHA. Bot must get good at emulating user and software must get better at identified users. None of our interaction with computer are non-emulatable so the war would be indefinitely ongoing. But what we can do is to make it expensive for bot to emulate user. One way to do this is creating ID system which requires some form of payment and thus creating an ID and expensive proposition. For example, Amazon can make their user account as open ID for logins and provide the target system a flag IsVerifiedPurchaser. Payments don't have be strickly in direct monetary forms also. For example, Facebook can estimate ad revenue generated by an user so far and provide some flag as to whether user is active and trustable as not being a bot.
- bilalashraf 12y agokjhkj hkj
- bilalashraf 12y agokjh kh khk hkjhkj