Slashdot Log In
Audio CAPTCHAs Cracked; ReCAPTCHA Remains Strong
Posted by
CmdrTaco
on Mon Dec 08, 2008 10:19 AM
from the captcha-captcha-chameleon dept.
from the captcha-captcha-chameleon dept.
Falkkin writes "Ars Technica reports that audio CAPTCHAs consisting of only distorted digits or letters can be easy to crack using machine learning techniques. This includes most of the audio CAPTCHAs currently in use on the Web. The reCAPTCHA team has discussed their new audio CAPTCHA, which is resistant to this attack."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
I'm sick fo CATCHA (Score:5, Interesting)
It was okay at first, but now it's reached the point where it takes me 3 or 4 tries to finally guess the letters.
It's become more hassle than it's worth. Isn't there a better way to stop bots from getting accounts?
Re:I'm sick fo CATCHA (Score:5, Interesting)
It's almost gotten to the point where it's easier for the bots to guess the letters than for an actual human.
Reverse captcha?
Parent
Re:I'm sick fo CATCHA (Score:5, Interesting)
A method I use is to put an input field with a name like "subject" in a contact form and then hide it via CSS. Then if that field is populated in the form submission, the server side drops the request.
It isn't the most accessible-friendly method in the world, but once I started doing this, all spam submissions dropped out. It's not foolproof and it's just another step in an arms race, but I agree that CAPTCHAs have gotten out of hand. They are especially confusing to people who are not tech savvy and don't know why they are trying to decipher a spirograph drawing in order to do something simple on your website.
Parent
Re:I'm sick fo CATCHA (Score:5, Insightful)
Well, kudos for using CSS instead of javascript to hide it.
Parent
Re:I'm sick fo CATCHA (Score:4, Insightful)
Parent
Re: (Score:2)
Well, the Yahoos and the Googles of the world can afford better solutions than this. I deal with spam messages on my site that is pretty low traffic, and this seems like a great solution.
Re: (Score:3, Interesting)
meh... i haven't haven't had that hard of a time with CAPTCHAs. occasionally i might get one wrong and have to spend an extra 2-3 seconds to fill out another one, but i think properly implemented CAPTCHAs are still the most effective means of reducing spam submissions/sign-ups.
i don't think any kind of CAPTCHA will be completely fool-proof, and their effectiveness will inevitably drop over time. but even still they stop 99% of all attacks by blocking all but the smartest AI algorithms and spammers. and the
Re:I'm sick fo CATCHA (Score:4, Funny)
And for your blind users...?
I'm not the poster you're replying to, but I have a guess at how this works.
First off, the blind person can't see, right? So the chances of them viewing source for a random page (or every form page they encounter) is probably pretty miniscule. At least I'll say it's comparable to the rate that sighted people view source as a matter of course in their browsing sessions.
So OK, they aren't just reading the source, finding a hidden form field and wondering why this hasn't been presented to them by their screen reader. They've just been checking news, blogs, posting a comment or two here and there, but nowhere in their Internet Travels have they had to contend with this curious case of a hidden "Subject:" field. What to do?
It turns out the answer is quite simple. That the blind person, much like their sighted counterpart, does not submit a given form with hidden fields filled in pegs them as a curious person indeed. Since the only submissions without the Subject field filled in will be from people who read the source and (for some reason) decided not to fill in the subject line, or people who just don't know about it. Quite the conundrum! Thankfully from the grandparent post, we know that posts with this hidden Subject: field are disposed of, deleted. Wacky, eh? So it seems, and I'm just speculating here, that filling in hidden fields is actually a way...hold on now...to determine that the submitter is not a person. Beyond that, and really
I have no idea how he does this, blind people are not treated any differently in this regard.
I know, right? It took me awhile to figure it out, but I think I at least have the gist of it.
Parent
Re: (Score:3, Informative)
CSS can do everything man.
CAPTCHA doomed to fail anyway (Score:3, Interesting)
Captcha is really security by obscurity. Readily identifiable information is obscured in such a way as the computers (supposedly) can't find it.
Real security requires a secret. It's as simple as that. So long as the secret can be identified without knowing the secret, your security system is a joke.
Computers are getting better, faster, smarter, cheaper. Moore's wall gets higher [blogspot.com] every single year, and soon, it will be routine for computers to match or exceed human intelligence. (It can be argued that they al
Re:I'm sick fo CATCHA (Score:5, Funny)
Parent
Re:I'm sick fo CATCHA (Score:4, Funny)
I'm trying to figure out what that translates to, but it's making my head hurt. So hyperthreading means she is "emulating" multiple "interfaces" with just one... Ow.
BTW, CAPTHCA for this post? "Receptor".
Parent
Re: (Score:3)
Screen capture (Score:5, Funny)
I'm half afraid to admit this publicly, but did anyone else try clicking the "play" button on screenshot of the audio CAPTCHA player in the first article? I took me a few tries before I realized it was only an image.
It doesn't matter too much anyway... (Score:2, Interesting)
A CAPTCHA is only worth $.0025 to break down on the Chinese Turing farms. Thus since a CAPTCHA can only protect something worth $.0025 anyway, making it more crack resistant doesn't buy all that much.
Re:It doesn't matter too much anyway... (Score:4, Interesting)
If you can make it to a longer time for a human to crack it, it would increase the costs. Double the time, double the cost.
But, say, if it now takes 10 seconds to crack a captcha, it would need to take more than an hour to cost $1 per captcha :-).
I wonder how a web-of-trust system combined with more difficult captchas (more trust -> easier captchas) would work; if a branch of the web is a spammer, it's easier to cut off.. But, this must've been suggested even in this context already, so hit me with the "your spam protection idea doesn't work, because.." form ;-).
Parent
Re: (Score:3, Interesting)
Only until someone finds a way to make cracking the captcha more efficient and suddenly it is back to the original cost to crack the same captcha again. This is what that machine learning is all about.
Meanwhile, the problem is that this back and forth with captchas is essentially causing programmers who wish to break it, to come up with very complex AI.
At some point, if the AI is smarter than the person, as mentioned above people won't be able to crack the captcha.
On this very article the only reason this "
hell (Score:3, Funny)
Re:hell (Score:5, Funny)
Don't know what your problem is- I'm a perl script and I understood it just fine.
Parent
Re:hell (Score:5, Insightful)
You're probably a bot.
Parent
REPATCHA strong? (Score:4, Interesting)
i thought RECAPATCHA was susceptible, as if enough bots guess the same answer on an image they will make that a valid answer. Does this not work or has nobody bothered?
Re: (Score:2, Informative)
Re:REPATCHA strong? (Score:5, Interesting)
If you get it wrong, they'll temporarily start sending you captchas in which both words are known. The chances of a bot guessing both words correctly are minuscule.
Parent
Solution to AI research? (Score:5, Funny)
They should just make a CAPTCHA that requires strong AI to crack; we could make a great leap ahead in AI by letting the spammers solve all the problems for us!
Re: (Score:2)
It will happen, says MIT Technology Review (Score:2)
They should just make a CAPTCHA that requires strong AI to crack
The impression I got from this Technology Review article [technologyreview.com] is that your CAPTCHA will eventually happen. But a business using one of these might eventually run into a disability discrimination problem if the system confuses real people of below-average intelligence with bots.
Ad disguised as news (Score:2, Insightful)
RECAPTCHA (Score:5, Insightful)
People crack CAPTCHAs for profit. They either sell the algorithms to spammers or spam themselves.
The thing is, if you managed to reliably crack RECAPTCHA, then you've succeeded where all the best OCR software on the market has failed (All Recaptcha's are words that couldn't be deciphered by existing software). At which point there's big bucks to be made legally selling the software.
where's my universal translator then? (Score:2)
So, "machine learning" can now translate any speech in any language to text. Where's my universal translator then?
Re: (Score:3, Informative)
I don't really understand how translating from speech into text is equal to translating from speech to text in a different language.
I could listen to every word you say and write it down no problem, but ask me to translate it into Japanese or something and I wouldn't have a clue.
You only have to look at games like Endwar to see how good speech recognition has gotten, it requires no calibration (well, maybe a word or two at the start) and has yet to fail me once and it seems to work for people with many diff
Back to Old School Methods of Verification (Score:5, Insightful)
Captchas are user unfriendly and relatively ineffective.
A more effective route is to require a new user to submit their postal address and a phone number. Then the service mails a post card containing a verification code to the postal address and/or calls the phone number. Google does this for AdSense publishers.
Ron
Re: (Score:2)
The day a forum does this I stop posting on them. It's irritating enough having to register without having to wait 2 days for the post to arrive before I can reply.
Re: (Score:2)
Captchas are user unfriendly and relatively ineffective.
For smaller operations they are very effective provided you have the sense to roll your own. For larger operations traditional captchas don't work so well but recaptcha which uses challanges sourced from real old books and seems to be on to a winner.
A more effective route is to require a new user to submit their postal address and a phone number. Then the service mails a post card containing a verification code to the postal address and/or calls the ph
Re:Back to Old School Methods of Verification (Score:4, Interesting)
This would work relatively poorly for high value things like bank accounts (though high value stuff can be handled by more expensive means, like phone confirmation) but it could be quite useful for low value things like webmail accounts. The task of sorting humans from bots on a single computer generated task is getting ever harder, particularly if you need to make a binary yes/no decision on the spot; but giving an account greater or lesser resources according to how human its activity looks is much more tractable. It won't be perfect; but it should reduce the value to spammers of the accounts they do get.
Parent
Submit a facial photograph? (Score:3, Funny)
What if the applicant for access submits a facial photograph along with his/her application information?
(1) Use facial recognition software to decide whether a human picture has been submitted. Deny access to those not submitting a picture of a human. Store the picture. Keep refining the algorithm.
(2) Determine whether the pictured person has been used in a previous attempt to obtain access. If access has been obtained, don't let them create another account unless their present account is terminated. If access has been rejected, then you have a presumptively bad applicant.
(3) Websites could share database information about the rejected pictured-people. This would bring in more data (like time and volume of a single facial picture's use, for example). That additional information could be used to help refine the algorithm.
Re:Give it up already (Score:5, Insightful)
Banning that way doesn't work real well when you consider dynamic IPs, distributed attacks (bot nets), proxies, etc.
Unless you're willing to ban at least a third of the world, you're not going to get much out of that.
Parent
Re: (Score:2, Insightful)
Just let the spam flow and crap up everything. When everything is useless, perhaps they will give up.
Right now, they push tons of shit with the hope that the peak of it might show through. If all of it is seen, the volume might backfire.
It sure will suck for everyone though.
Lets go back to human moderation (Score:2)
I know it is a lot but you would need a valid e-mail to post, and administrator would need to follow up with you to OK your account, your registration e-mail would actually have to contain the actual reason of why you want to post, all posts would have to be moderated/verified before they became visible, ex...
I can hear you all protesting already: But what about anonymity, what about ease-of-use?
Yes, yes... But it IS the only way.
It's a price I'd be willing to pay to end the spam because as we have seen, mo
Re: (Score:3, Interesting)
And if the posts were held before becoming visible, there wouldn't even have been one.
The community your are a member of seems to be near this level of completeness.
Having a few trusted reviewers who read all posts before letting them pass would be the last step.
People often complain about schemes like this that their messages need to be seen immediately so people can respond immediately but I say having two or three moderators would make the whole process pretty quickly anyway.
Remember when you used to mai
Audio requred by law (Score:5, Funny)
In my crystal ball I see some fool who does not turn off the sound on the PC in an office.
By law, offices of companies over a certain size must accommodate people whose disability requires sound to do their jobs.
Unfortunately, history has shown that many people also still have digital camera's that make the *click* noise
By law, camera phones must make the click noise when operated within some countries to help fight voyeurism.
Parent
Re: (Score:2)
By law, camera phones must make the click noise when operated within some countries to help fight voyeurism.
Yet more law with little real thought put into it.
How does that stop someone from wiring in a switch to bypass the speaker? Heck, if you use the right inductor instead of a straight bypass, the device couldn't even tell.
Re:Audio requred by law (Score:5, Insightful)
By law, camera phones must make the click noise when operated within some countries to help fight voyeurism.
That's a great idea. However, we need a law for video cameras, too.
I propose that by law, each video camera must be equipped with a prominent hand crank, and shall only record while the crank is being turned. Furthermore, as added protection, people with video cameras must wear a beret and carry a conical megaphone at all times while operating said device.
Parent
Re:Audio requred by law (Score:4, Funny)
I think forcing everyone who uses a video camera to dress up like a French cheerleader would fall under cruel and unusual punishment.
Parent
Re: (Score:2)
Because then any spam bot would have a 1 in 3 chance of getting it correct. And then if you try to scale if up to 100 cups and 1 ball, then it would not be feasible for even a human to follow.
Re: (Score:2)
Yeah, that's a good point too. A lot of these "self thought up" Captcha schemes might work well on one or two sites, but when you talk about deploying to sites like Google and Yahoo (huge spam bot targets), a lot of them become infeasible.
Re: (Score:2)
That's going to go down well with colour blind users.
It's probably along the right lines though... use something that you need an english language parser to make sense of.
Re: (Score:3, Informative)
Re:Why are CAPTCHAs so stupid? (Score:5, Insightful)
If you have to manually populate your CAPTCHA, you have a problem. It costs just about as much(in money and time) to manually document a set of CAPTCHA questions as it would to build the set. If you can't generate questions automatically, your CAPTCHA will be expensive, or useless, or both. RECAPTCHA is interesting in that is a something of a hybrid. It makes use of real world complexity, from scanned documents; but largely automates the conversion of real world complexity into CAPTCHAs, which makes it fairly practical to use at a large scale.
Parent
Re: (Score:3, Funny)
Is this why handwriting won't work? Fancy elderly handwriting is especially hard to read. OCR software is rather helpless against it. (I propose hiring retired people to write words sloppily and scan them!)
Re: (Score:3, Insightful)
Obviously there can't be fewer than 0 of something in a picture, and you can assume that(for the sake of not pissing people off) you won't make your customers count more than 20 of something. Thus, if I am trying to crack your CAPTCHA, If my script sees "how many...?" it will just pick a number between 0 and 20, in