Gmail CAPTCHA Cracked

I Don't Believe in Imaginary Property writes "Websense is reporting that Gmail's CAPTCHA has been broken, and that bots are beginning to sign up with a one in five success rate. More interestingly, they have a lot of technical details about how the botnet members coordinate with two different computers during the process. They believe that the second host is either trying to learn to crack the CAPTCHA or that it's a quality check of some sort. Curiously, the bots pretend to read the help information while breaking the CAPTCHA, probably to prevent Google from giving them a timeout message."

Comments

i work with OCR/ICR technology

[JeanBaptiste]

and I cannot help but wonder if this will increase our usually abysmal rate for reading handwriting. (and no, I don't design it myself so no ripping on me, just work with it)

Re:i work with OCR/ICR technology

[filesiteguy]

Nah - you're not a pr0n spammer, so you'll never get it.

Seriously, I bet the peeps at Tesseract, ABBYY and Kofax are right now trying to figure out what the spammer losers are doing. Meanwhile, Kurzweil is probably coming up with some new genius scheme for us to learn...

Re:i work with OCR/ICR technology

[martin-boundary]

Unfortunately, it's HumanPower(TM). About 3/4 of the way down TFA, they show a web page with instructions (in Russian) for the people who get paid to read the CAPTCHAs.

Re:i work with OCR/ICR technology

[RiotingPacifist]

It doesnt say that its humans reading them, just that a page rehosts the bmp images. Im confused as to where the bots work. Im suprised that phishers dont use thier victims to crack CAPTCHAs.

Re:i work with OCR/ICR technology

[palegray.net]

It's actually being cracked by a million monkeys clattering away at a million typewriters. Pretty hard to defeat that.

Re:i work with OCR/ICR technology

[1u3hr]

Unfortunately, it's HumanPower(TM). About 3/4 of the way down TFA, they show a web page with instructions (in Russian) for the people who get paid to read the CAPTCHAs.

I doubt it.

TFA says this is a service SELLING captcha breaking. If it was human powered, I'd expect it to do much better than the 20% they cite.

Re:i work with OCR/ICR technology

[Z80xxc!]

TFA says this is a service SELLING captcha breaking. If it was human powered, I'd expect it to do much better than the 20% they cite.

Ummmm... I'm not so sure about that. OK, google's captcha's are pretty easy for humans to read, but I've often had to try literally 6 different captcha's on some sites. Yes, really.

Re:i work with OCR/ICR technology

[Anonymous Coward]

I see that webpage that they show, but it doesn't make sense - if people were being paid to solve the CAPTCHA then the success rate should be more like 90%, not 20%. Right?

Re:i work with OCR/ICR technology

[sortius_nod]

If I were you I wouldn't admit that on slashdot...

Re:i work with OCR/ICR technology

[martin-boundary]

TFA says this is a service SELLING captcha breaking

I'm not sure you're right. Why would the page include instructions such as

In no case do not enter random characters!

We pay only correctly recognized pictures!

That sounds more like instructions for people doing the CAPTCHA breaking, no? Unfortunately, I can only go by the English translation, somebody who can read Russian would be useful.

I'd expect it to do much better than the 20% they cite.

I can think of various reasons. For example, there might not be somebody at the other end doing the breaking at the exact moment when the bot tries to connect. In that case you'd get ~100% for only part of the day and 0% the rest of the time. 24 * 20% is about 5 hours each day. A part time job?

It's also true that _average_ people only break CAPTCHAs successfully about 80% of the time. Here's a relevant experiment

Then there's possible issues with firewalls etc. Some bots are hosted on a zombified PC which could have any kind of restrictions, and it might have trouble dialing one of the the servers, or maybe the server can't respond properly due to inbound filtering.

Re:i work with OCR/ICR technology

[Nullav]

Finally, a use for those old notebooks: I'll donate them to Google!

Re:i work with OCR/ICR technology

[anexkahn]

They could switch back to the way they used to do it...send a confirmation to a cell phone via a text message when you are signing up.

Re:i work with OCR/ICR technology

[Z80xxc!]

What am I admitting? That I use sites that require CAPTCHAs? Last I checked there was nothing wrong with not being able to read squiggly things that could be almost anything and thus needing to try several times before it works. It is not at all uncommon for me to get the CAPTCHA wrong the first 5 times one some sites.

Re:i work with OCR/ICR technology

[hoytak]

If it's human power, the people are probably not sitting around doing nothing waiting for the occasional captcha to show up on their screens. In other words, a lot of the 80% not correct probably never got seen by a human.

Re:i work with OCR/ICR technology

[MillionthMonkey]

Your ideas intrigue me and I wish to subscribe to your newsletter

Re:i work with OCR/ICR technology

[Anonymous Coward]

Your point is right, but the article clearly states the captchas are being proxied to humans, the English translation of the Russian screenshot is correct.
Also, don't expect the people who get paid very little to be accurate in what they type.

Re:i work with OCR/ICR technology

[PO1FL]

The low success rate could be due to differences between the Cyrillic and English alphabets.

Re:i work with OCR/ICR technology

[Anonymous Coward]

You're very wrong here. Cyrillic has nothing to do with the Latin captchas.
Further, yes, Latin, not English, especially if you want to conjugate it with the word alphabet :)

Re:i work with OCR/ICR technology

[Anonymous Coward]

Max two tries here ever. Maybe it's time for new glasses?

Re:i work with OCR/ICR technology

[EdIII]

Don't listen to the trolls, you are not alone at all.

It really depends on the captcha being used, but the real problem is that a good percentage of the time on the hard captcha's you just cannot make a definitive choice on a single letter.

That means you got a 50/50 shot of being right on it. If it was 2 letters, which is more rare, now you got a 1/4 chance of being right.

I have seen some captcha's that are so ridiculous in their attempts at obfuscating the letters, that it is just next to impossible. Maybe that is the whole point too. A strong captcha may be one that a human fails at half the time.

Re:i work with OCR/ICR technology

[Anonymous Coward]

humans are for suckers

Re:i work with OCR/ICR technology

[repapetilto]

Not if we all had a billion monkeys on a billion typewriters

Re:i work with OCR/ICR technology

[Anonymous Coward]

Thank goodness. I was concerned we were about to get a lot of spam from SkyNet.

Re:i work with OCR/ICR technology

[Compuser]

The translation given on the page is quite precise. I was going to post a translation on Slashdot but then saw that they did a great job themselves.

Re:i work with OCR/ICR technology

[Jarik C-Bol]

the other kicker, is the captcha's that have some strange caps/lowercase requirement more than once i've had a captcha that a what looked like a capital O was really a Zero. (thats hard to get by) and usually when i find ones that are like that, its on a page that makes a new one every time you fail. (also capitol i's that look like lowercase L's)

Re:i work with OCR/ICR technology

[jargon82]

Since most more... intelligent people have better jobs than reading captcha it's probably not the cream of the crop working on it here. They should be proud of their 20% ;)

Re:i work with OCR/ICR technology

[Anonymous Coward]

unfortunately, what printed text has that handwriting doesn't is hard lines, corners, and even thickness. Together with some simple topology, you've all you need for reversing any captcha based on a regular font. But you do make a good point: a captcha based on randomised handwriting could be markedly more successful.

Re:i work with OCR/ICR technology

[King Gabey]

Insightful? Funny comment maybe, but insightful?

Re:i work with OCR/ICR technology

[Redneck Hacker]

Not if we all had a billion monkeys on a billion typewriters Why have billions when you can have [pinky] millions [/pinky]

Re:i work with OCR/ICR technology

[joe slacker]

Million monkeys with mod points? Waiddaminute!

Re:i work with OCR/ICR technology

[MBGMorden]

I have trouble with this myself. I also wonder sometimes: a lot of times those captchas look very similar to those color-blindness test cards that basically say "If you can't see 43 then you're colorblind." Just a suspicion, but it seems as though colorblindness might severely limit your captcha solving ability. I know that some of these offer an audio option for them but not all do.

Re:i work with OCR/ICR technology

[BigJClark]

So, like slashdot?

Re:i work with OCR/ICR technology

[bob_herrick]

I have seen captcha's that use symbols like '.' '-' and '_' where the fuzziness was enough that they all render pretty much the same. I have taken 3 or 4 tries at some of those. You are not alone.

Re:i work with OCR/ICR technology

[jasampler]

Maybe that is the whole point too. A strong captcha may be one that a human fails at half the time. Such captcha will be that one capable of making a robot to fail at that rate too. Perhaps someone should begin to think that someday captchas won't be so cost-effective to discriminate between people and machines.

Re:i work with OCR/ICR technology

[dmsuperman]

That's one websites logs. It doesn't detect which ones were ignored, which were entered improperly, and which were bot attempts. You can't really be sure that all those 20% are humans entering the CAPTCHA wrong.

Re:i work with OCR/ICR technology

[Marcos Eliziario]

Promise to show them some porn, and you'll get your million typist monkeys in a really short amount of time.

Re:i work with OCR/ICR technology

[davidsyes]

Are these millions of monkeys capTURED or capTHA'd?

Re:i work with OCR/ICR technology

[Kijori]

TFA says this is a service SELLING captcha breaking I'm not sure you're right. Why would the page include instructions such as

In no case do not enter random characters!

We pay only correctly recognized pictures! That sounds more like instructions for people doing the CAPTCHA breaking, no?
Unfortunately, I can only go by the English translation, somebody who can read Russian would be useful. I think you're right. The article translation gives a pretty good impression of what the page is saying. I googled the Russian, and it seems that that's all there is on the page, so here's a translation:

If you can't identify the image or it doesn't load (if the picture is black, or blank) simply press Enter.

Under no circumstances enter random characters!

If there is a delay in the picture loading, log out, refresh the page and try again.

The system has been tested in:
Mozilla Firefox
Internet Explorer

Before each payment is made, the identified images are checked by Admin.
We pay ONLY for correctly identified images!!!

Payments are made once a day. The minimum sum paid is $3. Those who would like to request a payment should send their application to the admin. If the admin is free, your application will be processed in 10-15 minutes; if they are busy it will be processed when possible.

If there are any problems (questions), write to the admin.

Based on my translation, I'm fairly sure these are instructions for someone being paid to break the captchas. It's definitely saying "If you can't identify the image"; the Russian for "if the image can't be identified" would be quite different.

As for reasons for the low success rate - well, they probably can't read much English. People who speak English are able to compare their interpretation of the letters to the words they know, increasing their accuracy. Given that the people doing these captchas are unemployed in a country that can normally find a job for anyone able to speak English, they probably don't have much more than recognition of the letters and a few basic words. Imagine if I gave you a distorted version of a Russian word - your success rate might not be too great either.

Re:i work with OCR/ICR technology

[fremean]

I love how they go to the effort of obscuring the IP addresses and URLs yet leave the packet dumps completely untouched :)

Re:i work with OCR/ICR technology

[atmurray]

"It was the best of times, it was the BLURST of times!?! Stupid monkeys!"

Re:i work with OCR/ICR technology

[DrVomact]

The translation given on the page is quite precise. I was going to post a translation on Slashdot but then saw that they did a great job themselves.

Say what? Are you talking about the Russian text from the web page? You mean it really consists of nearly unreadable, ungrammatical babble? I thought the Websense site was using Babelfish.

Re:i work with OCR/ICR technology

[Threni]

> (also capitol i's that look like lowercase L's)

Sometimes I find that lower case a's look like o's...

Re:i work with OCR/ICR technology

[1u3hr]

The translation given on the page is quite precise. I was going to post a translation on Slashdot but then saw that they did a great job themselves.

Perhaps if you alrady read the Russian. An an English speaker, to me the "translation" given was pretty opaque, and I saw no implication that it was instructions for human solutions.

Re:i work with OCR/ICR technology

[GWBasic]

TFA says this is a service SELLING captcha breaking. If it was human powered, I'd expect it to do much better than the 20% they cite.

I suspect that Google could also have some technologies in place that vary the HTML and JavaScript used to display the captcha in the browser. The crack involves finding the image in the browser's cache! This would make it difficult to obtain the image and display it elsewhere.

Re:i work with OCR/ICR technology

[palegray.net]

It does explain a lot about how things work around here...

Re:i work with OCR/ICR technology

[Compuser]

FAQ

If you are unable to recognize a picture or it is not loaded (picture appears black or empty) then just press Enter.

Under no circumstances (the word misspelled in Russian) should you enter random characters!

If images take a long time to load, then exit from your account, refresh the page and go again (could mean "log in again").

System was tested in the following browsers:
Internet Explorer
Mozilla Firefox

Before each payment, picture recognition is checked by Admin. We pay only for correctly recognized pictures!

The payments are made once per day. The minimum amount to be paid is $3. To order the payment, send in your application to the admin vi IM (literal term used is slang for ICQ). If the administrator is free, your application will be processed within 10-15 minutes. If he is busy then as possible.

If you have any problems (issues) knock Admin. (the word "knock" is used in Rissian to mean report or snitch).

I liked the invitations only system better

[danomac]

I'm surprised they opened it up to the public. When they did, I pondered how long it would take before spammers would start doing this en masse.

Re:I liked the invitations only system better

[DigitalisAkujin]

Yea cause bots can't invite themselves.... lol

Re:I liked the invitations only system better

[aug24]

I suggest a pure invite system could be abused even more automatedly.

Justin.

Blurred text == secure??

[Anonymous Coward]

This is a tangent, but I'm curious: this site blurs out a lot of text, presumably for privacy. How secure is that? It seems like it would be fairly easy (given knowledge of the font, which you have from other parts of the screenshot) to figure out what the underlying text is. I wish people would just black out things they don't want you to know.

Re:Blurred text == secure??

[kcbanner]

Its funny actually, in the SIFT algorithm (detects scale invariant keypoints in an image, used for panorama stitching, computer vision, etc), it uses a Gaussian blur as part of the detection process. It uses multiple levels to better find invariant keypoints. While havening the unblurred image certainly helps, its not necessary.

Re:Blurred text == secure??

[arktemplar]

Okay, this is fsked, I know guys who are working on a variant of this, they have a learning algorithm, they have a database of already known captcha's somthing like 400 images or so ? Now what they do is break up the existing captcha into small 2x2 grids and try and match it to whatever is already in the database, they are using it for other stuff(image reconstruction) but I think they can modify it for this as well.

Re:Blurred text == secure??

[Anonymous Coward]

I've been curious if all of those blurred images which we see on TV, hiding someone's identity, could be deconvolved to reveal their true identity. You certainly have enough samples to have a go at it. I don't think that you'd even have to know the blurring algorithm.

By the way, while the account name-based login successfully thwarted me: I've forgotten mine; I had no trouble breaking in by decoding the slashdot CAPTCHA (oddly enough, it was AnOnYCoWar).

Time to ban Microsoft products

[Scareduck]

from direct access to the Internets. The only secure MS machine is one with its Ethernet plug removed.

Re:Time to ban Microsoft products

[TheLink]

How's that relevant?

A linux desktop O/S is just as insecure technically.

The linux (and Apple) desktops are just more secure by the same reason a hut in a small remote village is more secure than an apartment in a big city ghetto - a one room apartment with many locks, metal doors and chains, but where the occupants let in muggers just because they said they were from Ebay.

They're both not secure.

The trick is to NOT have a _one_room_ apartment or hut. You need an "airlock" (sandbox) for your browser (not just rooms for each person).

Re:Time to ban Microsoft products

[TechyImmigrant]

> A linux desktop O/S is just as insecure technically.
Secure from what? Internal or external threats? In the internal case it exhibits better protection from escalation of privilege (than windows, see Sony rootkit for an example). In the external case is affords simpler accounting of the processes laying around.

>The linux (and Apple) desktops are just more secure by the same reason a hut in a small remote village is more secure than an apartment in a big city ghetto - a one room apartment with many locks, metal doors and chains, but where the occupants let in muggers just because they said they were from Ebay.

No, it is more secure for a some applications because less of the network facing executable code needs to run at as high a privilege level.

>They're both not secure.
That depends entirely on the threat model you are protecting against. If you want it really secure from the network, take it off the network. If you want it secure from users put it in a locked room and have multi person, multi factor authentication to access it and require dual operator controls so no individual can pull something off unobserved. This is how PKI centers work. If you want a secure online server, you need accounting of the trusted code. The extend to which Windows and Linux compare is quite different for those cases.

>The trick is to NOT have a _one_room_ apartment or hut. You need an "airlock" (sandbox) for your browser (not just rooms for each person).

Or you might document and analyze your threat model first, before protecting against those threats.

Re:Time to ban Microsoft products

[Architect_sasyr]

Not true. You can convince someone to install the Ethernet plug with the right time and motivation.

Re:Time to ban Microsoft products

[hcmtnbiker]

Secure from what? Internal or external threats? In the internal case it exhibits better protection from escalation of privilege (than windows, see Sony rootkit for an example). In the external case is affords simpler accounting of the processes laying around.

If they can run code on the machine from a stupid user you're always out of luck for security. Secondly, privilege escalation on windows? If you're talking about Vista, its have to even get some apps running in a high enough setting. But if you're talking XP, most users just keep themselves as administrators, this would be no differnt from logging in as root, or just su-ing yourself at the start of any terminal, on a Linux box. And yes, both cases you're out of luck when it comes to security.


No, it is more secure for a some applications because less of the network facing executable code needs to run at as high a privilege level.

Unless you know of an application which requires higher privileges just because it accesses the network, and it's this way on only Windows and not Linux. Frankly I know of none.


Windows is less secure because they target the most technologically ignorant users. When was the last time you saw your grandfather using Linux? You can keep the one Administrator(root) account on Windows, and make everyone else limited because it's a more secure model. But for the average person this is more of a hassle then the perceived benefit. If you wanted to make the average user happy on Linux you'd probably have to run the window manager as root and automatically start the terminal as su too. Frankly I would be happy with a reverse model, where most things you want run as root and you remove privilege on certain applications that you know could be vulnerable, or possibly even malicious. Because sometimes its just easier to not do "make install" watch it fail, then do "su" then "make install" again.

Re:Time to ban Microsoft products

[TheLink]

No idea, I see all sorts of strange claims in spam and phish mails all the time. Believe me, lots of people just click on anything. And some even jump through hoops to get infected, not sure if you remember the malware that spread via password protected zipfiles (user has to type in the password, open it and get infected). Amazing but true.

There have been plenty of exploitable firefox bugs. Most desktop linux users don't run firefox using a separate user from the user account that holds their important information - work, private data etc.

But even running as a separate user leaves you vulnerable if you are using a kernel that's vulnerable to the vmsplice kernel bug or other similar bugs.

For untrusted sites I currently use IE in a vmware virtual machine, while that's vulnerable to VM bugs and CPU bugs, I'm currently betting that most attackers won't bother exploiting that yet. The vmsplice kernel bug has exploit code out already, and it's not very kernel version specific either.

Re:Time to ban Microsoft products

[rgo]

>> A linux desktop O/S is just as insecure technically.
>Secure from what? Internal or external threats? In the internal case it exhibits better protection from escalation of privilege (than windows, see >Sony rootkit for an example). In the external case is affords simpler accounting of the processes laying around.

You are taking things out of context. You don't need root privileges at all to make a botnet to work.

>>The linux (and Apple) desktops are just more secure by the same reason a hut in a small remote village is more secure than an apartment in a big >city ghetto - a one room apartment with many locks, metal doors and chains, but where the occupants let in muggers just because they said they were >from Ebay.

>No, it is more secure for a some applications because less of the network facing executable code needs to run at as high a privilege level.

I repeat, the privilege level is irrelevant for a worm to infect your computer, they can even run as any user. You can infect your computer using any popular desktop application that faces the internet, think web browsers.

Re:Time to ban Microsoft products

[Anonymous Coward]

Believe me, lots of people just click on anything. And some even jump through hoops to get infected, not sure if you remember the malware that spread via password protected zipfiles (user has to type in the password, open it and get infected). Amazing but true.

This is so true! At my company, we tried a little test. We were showing our website users a dialog box with the wording "Will you participate in our bot-net for sending out millions of spam-mails?" - almost everyone answered yes.

Re:Time to ban Microsoft products

[chitragupta]

> Or you might document and analyze your threat model first, before protecting against those threats. of course, anyone would be able to document all threat models :) you know this can be never the case - hackers who are good at breaking things STILL are able to do so. the point is to restrict the extent of their reach ( think defense-in-dept ) . in other words, threat modelling is nice to do to reduce the attack vectors, but defense in depth should be important then too.

Bots RTFM!

[russotto]

Curiously, the bots pretend to read the help information while breaking the CAPTCHA

Ever consider that maybe the bots aren't pretending? (cue Frankenstein music)

Re:Bots RTFM!

[jd]

Except truly intelligent bots would realize that reading the help makes them easily distinguishable from humans. Bots that wanted to look human should also have the REFERER field show them as coming from a pr0n or blog site.

Re:Bots RTFM!

[Jafafa Hots]

If intelligent computers wanted to hide their intelligence, they'd spend part of their time commenting on YouTube videos.

Re:Bots RTFM!

[Anonymous Coward]

you're still so pissed about that comment I left on your LAME youtube video!
ROFL! pathetic!

Re:Bots RTFM!

[MichaelSmith]

I seriously wonder if this battle over Captchas is going to give us real, somewhat psychopathic AI. Neuromancer is coming along nicely.

Re:Bots RTFM!

[muffen]

Bots that wanted to look human should also have the REFERER field show them as coming from a pr0n or blog site.

Humans read blogs?

Re:Bots RTFM!

[MORB]

Maybe they already do.

CAPTCHA is for weak minds

[motek]

Instead, Google should use something akin MENSA tests. This would deter the bots and make the customers feel really good about themselves. And this feeling, my friend, can't be bought cheaply.

Re:CAPTCHA is for weak minds

[Anonymous Coward]

Instead, Google should use something akin MENSA tests. This would deter the bots and make the customers feel really good about themselves.

Good idea! Then all other email companies would hopefully follow suite dramatically then cutting down the forwarding of chain letters, viruses, stupid support calls, SPAM sales etc... ;-)

Re:CAPTCHA is for weak minds

[v1]

That raises an interesting idea... why not use the capchas to perform some useful work? Example... display a scanned line of text from a project that needs a large volume of text OCR'd for free/cheap. Compare the texts from several submitters, and assume groups with a high match rate are reading it correctly.

This accomplishes three goals:
- fairly effective capchas
- accomplishes something
- causes OCR quality to improve (via the hard work of the botnet coders)

Not saying the above example is ideal, just trying to illustrate the idea. Take advantage of available resources (be they real people or botnets) and harvest it to accomplish something practical with it.

Re:CAPTCHA is for weak minds

[motek]

Or perhaps give simple science questions. Later, more amusing results can be published as a book, to the amusement of generations.

Re:CAPTCHA is for weak minds

[PayPaI]

http://recaptcha.net/

Re:CAPTCHA is for weak minds

[Mr2001]

That raises an interesting idea... why not use the capchas to perform some useful work? Example... display a scanned line of text from a project that needs a large volume of text OCR'd for free/cheap. Someone already beat you to it.

Re:CAPTCHA is for weak minds

[motek]

That is a very good point. They say that 90% of all e-mail is SPAM. Probably 90% of the rest shouldn't have been sent either. BTW: feel free o remove this message.

Re:CAPTCHA is for weak minds

[cybernanga]

This is already being done. Check out this BBC Story about an outfit called Re-Captcha

Re:CAPTCHA is for weak minds

[gnick]

why not use the capchas to perform some useful work? I see a beautiful partnership in the future. Google and Amazon could probably (with a proper disclaimer) make a small amount of cash through this that could either be kept as profit or, recognizing that it would be not be much relative to their revenues, donated to charity while accomplishing a great CAPTCHA scheme.

Re:CAPTCHA is for weak minds

[Anonymous Coward]

This could also double as a means for scouting employees.

Re:CAPTCHA is for weak minds

[Anonymous Coward]

Written by the same fella who came up with the original CAPTCHA, Luis von Ahn.

Re:CAPTCHA is for weak minds

[Anonymous Coward]

This is a perfect example of why software patents are ridiculous. Almost everything is obvious and derivative.

Re:CAPTCHA is for weak minds

[RiotingPacifist]

but MENSA tests are easy to read and easy to learn for, if anything a bot net would soon outperform us. A better alternative IMO would be not to tell the bot if its passed failed ( using 2 * 3/4 letter CAPATCHA would mean that the bot wont know it passed unless it passes both). Or delaying they could delay retries (possibly browser string/test related, so IE7 takes 40 secs, but googlebot takes 30hrs and a honeypot could be quicker but log that the account is probably spam) and watch IPs to slow them down, 2 mins average per account will at least slow them down.

Re:CAPTCHA is for weak minds

[RealGrouchy]

I notice a catch-22. The point is that the user types words that reCAPTCHA's OCR can't read, but reCAPTCHA has to know what the word is if the user is to be granted access.

I got "laughter" and another word. I typed the other word correctly, but "daughter" instead of laughter, and it said I was correct.

So where does the security come into reCAPTCHA?

- RG>

Re:CAPTCHA is for weak minds

[Cyberax]

One word that is shown to you is always known. The second one is unknown. In your case, you entered the known word correctly.

As anti-bot measure, reCAPTCHA starts showing pictures with BOTH known words if you (anyone with your IP) incorrectly guess two words in one hour, AFAIR.

Re:CAPTCHA is for weak minds

[Anonymous Coward]

from http://recaptcha.net/learnmore.html

But if a computer can't read such a CAPTCHA, how does the system know the correct answer to the puzzle? Here's how: Each new word that cannot be read correctly by OCR is given to a user in conjunction with another word for which the answer is already known. The user is then asked to read both words. If they solve the one for which the answer is known, the system assumes their answer is correct for the new one. The system then gives the new image to a number of other people to determine, with higher confidence, whether the original answer was correct.

Re:CAPTCHA is for weak minds

[Anonymous Coward]

Facebook has been doing this for quite some time. IIRC Slashdot had a story on it too.

There system gives two seperate words one of them is from an OCRed document and the other is known to the computer. I believe each OCRed word needs to be translated the same by two different people before it will be consider as read. If the people disafree Additional trials are carried out.

Re:CAPTCHA is for weak minds

[supertusse]

Mod sig +1 obvious!

Re:CAPTCHA is for weak minds

[Antique Geekmeister]

Welcome to "Sturgeon's Law". When confronted by new reader of science fiction that 90% of science fiction is shit, the famous author Ted Sturgeion is quoted as "90% of *everything* is shit".

It's a helpful rule to remember when at a meeting with lots of Powerpoint slides and Gant charts and software development schedules.

Re:CAPTCHA is for weak minds

[thePowerOfGrayskull]

That raises an interesting idea... why not use the capchas to perform some useful work? Example... display a scanned line of text from a project that needs a large volume of text OCR'd for free/cheap. Compare the texts from several submitters, and assume groups with a high match rate are reading it correctly.

This accomplishes three goals:
- fairly effective capchas
- accomplishes something
- causes OCR quality to improve (via the hard work of the botnet coders)

Not saying the above example is ideal, just trying to illustrate the idea. Take advantage of available resources (be they real people or botnets) and harvest it to accomplish something practical with it.

Only one minor problem with that -- how does they know when the captcha has been entered correctly for the first several users?

Re:CAPTCHA is for weak minds

[Random Walk]

http://recaptcha.net/

Except that its use has serious privacy implications (if you use reCaptcha, their server learns the IP adresses of your visitors, and could even track their surfing habits, if enough sites use reCaptcha). From that point of view, the implementation is seriously flawed, and using reCaptcha might even be illegal in some countries due to privacy laws.

Re:CAPTCHA is for weak minds

[bitingduck]

Instead, Google should use something akin MENSA tests. And users who respond correctly to enough of them would be sent job offers.

Re:CAPTCHA is for weak minds

[illumin8]

Instead, Google should use something akin MENSA tests. This would deter the bots and make the customers feel really good about themselves. And this feeling, my friend, can't be bought cheaply.

The only problem is that people intelligent enough to pass the MENSA test are pretty much guaranteed to never click on an AdSense ad, thereby destroying their business model.

What Gmail really needs to make maximum profit is to appeal to the average MySpace user... Captchas should be pictures of "boobies" or "thongs" and make the user click "Which one is this, boobies or thongs?" That way they can pretty much guarantee that every Gmail user will generate maximum ad revenue by clicking on all of the stupid "Get your free smileys here!" ads that appear on the screen...

OMG I think I'm going to be sick...

Re:CAPTCHA is for weak minds

[Anonymous Coward]

Google allows users to do this with Google Images. It helps them serve images based on keywords

Re:CAPTCHA is for weak minds

[Domo-Sun]

Maybe I could use CAPTCHA to read and write my book reports for me?

Re:CAPTCHA is for weak minds

[Anonymous Coward]

Umm... your stupid... the point of a captcha is to stop bots? How will your proposed idea stop bots from adding giberish...

Humans?

[Pr0Hak]

This makes one wonder: Is it possible that it is cost effective for spammers to employ low-cost human labor and that they pipe all these captcha challenges to this set of humans whose sole job is to stare at computer screens with pending captcha challenges and answer them?

(I would imagine that this job would have high turnover :) )

Re:Humans?

[DigitalisAkujin]

Actually, yes and it's happening! Just Google it, there's been a few stories on it already.

Re:Humans?

[PhrostyMcByte]

one technique that has been used in the past, is that porn websites will have their registration page just be a proxy for a registration page on a site they want to spam. people register and they get their captchas done for free.

Re:Humans?

[davevr]

You don't have to wonder - this is exactly how they do it. People are paid for every X images that they successfully type. It is a variation on the pay-for-click schemes. The low accuracy rate is partially human error and partially because sometimes no one is "working" when the request comes in. There are plenty of places on earth where making $100/month doing this in an i-cafe is a reasonable job.

Re:Humans?

[brianjlowry]

(I would imagine that this job would have high turnover :) ) I resent that!

Re:Humans?

[Anonymous Coward]

As a matter of fact yes, I have a friend that used to do spam and he had exactly such software that displayed one captcha after another, and an employee that spent hours per day typing them. With the money being made off spam, this is extremely cost effective.

Re:Humans?

[1u3hr]

one technique that has been used in the past, is that porn websites will have their registration page just be a proxy for a registration page on a site they want to spam. people register and they get their captchas done for free.

So do you have a URL? I thought not.

I don't think that has ever really been used. Heard it suggested many times, never a link or reference to any site that really did it. For one thing, it would invite attack, poisoning, retaliation from those being cracked. Simpler just to pay some sweatshop in India a few cents per code solved.

Re:Humans?

[Anonymous Coward]

Yes. Amazon Mechanical Turk. Someone already tried it, Google is probably aware of it, and Amazon put a quick stop to the first attempt.

Re:Humans?

[karmatic]

Well, it wasn't on a porn site, but I've done proxying of captchas (Proof of Concept) for:

PayPal
GMail
eBay

It's not hard - use CURL, have it handle cookies. Populate database, give to users (requires decent traffic). My system even used a regex on the registration success page to fail users who failed the captcha.

Given my system took about half an hour to write, and people are going to lengths like the ones in the article to beat them, it's pretty much a given that people are out there doing it now. FWIW, I was working on ways to watermark a captcha to make the source obvious.

Re:Humans?

[Antique Geekmeister]

You've missed something. The porn site in question can also be a cracked machine, redirecting the porn traffic s well from dozens or hundereds of poorly secured porn sites. Once you've got proxying set up on the cracked machine, you can avoid the cash trail and use any of thousands of poorly secured bot machines as your front IP address. It's much safer to use a cracked machine or set of them, than to actually pay people for services, even in a sweatshop in India.

Re:Humans?

[shird]

That would require a *LOT* of traffic, considering only ~1% of visitors would bother to fill out the captcha. With that many visitors, you're better off monetising that site (eg ads and penis enlargements etc) than pissing off your visitors making them fill out some captcha so you can send some spam with only a 0.01% response rate. Nice theory, but it doesn't happen.

Re:Humans?

[Zach978]

With a porn site you could just have a page "Type in this code to view the pictures/video:" and then goes to the normal thumbnail page, so that more than 1% will fill it in...

Re:Humans?

[1u3hr]

Well, it wasn't on a porn site, but I've done proxying of captchas (Proof of Concept) for:

Yes, obviously it COULD be done, but I have never heard any evidence that it has been put into practice. As I said, it exposes too much about the cracker and what he is attacking.

Re:Humans?

[1u3hr]

You've missed something. The porn site in question can also be a cracked machine

Of course it could be. But has anyone ever bothered to put it into practice? Not that I've ever heard of. It's just not worth the hassle. And regardless of how you host them, the captchas themselves, at least for big sites, are distinctive enough to indicate exactly which sites are being targetted. If I was in charge of GMail security, I'd be watching for these and the moment one appeared take action. (What action? I don't know -- set their own bot to attack the cracker site and poison its results?)

Two months ago called,

[Anonymous Coward]

They want their information back.

Seriously though, all the affiliate marketers knew of this months ago. This isn't something Google cared about, nor was CAPTCHA 'cracked', it's just a silly loophole, that once Google gets pissed enough to fix, will be gone like a fart in the wind.

Now the /. CAPTCHA, that's the one we need to crack! Can you say MOD POINTS FOR EVERYONE!

Tragedy of the commons

[davidwr]

Sigh.

Maybe the days of convenient on-demand service signup are coming to an end. Wikipedia already puts new accounts "on probation" for a few days - they can't edit certain articles and can't create new ones.

I see a time when Google and other free-mail providers limit new accounts to a few dozen outgoing messages a day, and raises the limit only when you've 1) logged in to check mail on 10 different days over at least a 30-day period, 2) sent at least 100 distinct messages to at least a few dozen distinct addresses, and 3) actually requested the limit be raised. Those needing higher limits sooner can pay $1 by credit card to have an override-code mailed to them.

Re:Tragedy of the commons

[darkfire5252]

I see a time when Google and other free-mail providers limit new accounts to a few dozen outgoing messages a day, and raises the limit only when you've 1) logged in to check mail on 10 different days over at least a 30-day period, 2) sent at least 100 distinct messages to at least a few dozen distinct addresses, and 3) actually requested the limit be raised. Those needing higher limits sooner can pay $1 by credit card to have an override-code mailed to them. Yes, but what is it about any of those tasks that the spammer wouldn't turn around and do? If Google requires X, then the spammers will do X.

Re:Tragedy of the commons

[fuzzlost]

I see a time when Google and other free-mail providers limit new accounts to a few dozen outgoing messages a day, and raises the limit only when you've... 3) actually requested the limit be raised. Why would this be such a bad thing. Couldn't a system be implemented, something more robust than a CAPTCHA, that the user would have to go through after activating the account? It could be as easy as sending an email to a randomly generated email address given to you by the email provider (it could easily be picked up by their catchall account, with a rule set up after you created your account.) Or something. Someone smarter than I could take a couple minutes, and I am sure they would have a solution.

Well...

[Agent.Nihilist]

It would be too obvious if they were reading the ToS.

techno-ists!

[LingNoi]

This is cleary good for all computers. Before AI weren't allowed to contact their AI friends. Only Humans were allowed such privileges as email.

The way I see it this is a step forward for human and robot relations. Women's rights, African-American Civil Rights Movement and now Robots rights!

Re:techno-ists!

[martin-boundary]

True, true. Hindsight is 100%. If only somebody had given Skynet a compuserve account in the 90s, we could have definitely saved ourselves the whole Blow Up Mankind With Nukes thing.

Live and learn, eh?

Re:techno-ists!

[moderatorrater]

But what if we don't want Richard Nixon with a new, shiny body as president?

Until one day...

[davidwr]

The bots pass the MENSA test.

Cue overlords posts in 3...2...1...

Re:Until one day...

[neil.orourke]

I, for one, welcome our new MENSA bot overloards!

Re:Until one day...

[Architect_sasyr]

Coming to you this summer, from Soviet Russia, the new, the improved, the thinking-of-the-children MENSA bot overlords! With an IQ of 6,000 and a face like Norman Lovett they can read pictures better than you!

Ah... can't find anywhere else to go with that, complete as you wish. Apologies for the Red Dwarf reference.

Re:Until one day...

[PetoskeyGuy]

Funny, most of the people I know who passed the MENSA tests are borderline bots already.

Stop using CAPTCHA!

[superash]

Seriuosly! It is high time they moved to something that was difficult to break. IIRC there was an image comparison technique where you are supposed to match two images of similar objects or animals. I think here if the environment, color, zoom and other factors are different then there is no way this can be broken. Although you cannot generate such images, if you have a photo gallery of 10k pics and continuosly growing I think that should be good enough till we have humanoid robots that can look at the pictures and correctly match them.

Re:Stop using CAPTCHA!

[Anonymous Coward]

Matching pictures makes it easy to make a random guess and get an acceptable success rate.

Re:Stop using CAPTCHA!

[SanityInAnarchy]

I think that should be good enough till we have humanoid robots that can look at the pictures and correctly match them.

We already do.

Re:Stop using CAPTCHA!

[evanbd]

Just use kittens instead...

The idea is to present a 3x3 grid of images and have the user select the 3 kittens from the 9 fuzzy animals. That's something computers are still quite bad at... Though you probably need to change the probability of getting it by random luck to be worse than 1/84, in practice.

Re:Stop using CAPTCHA!

[snicho99]

And all it takes is for someone to leak that library and you've got to start all over again... I don't think you what you're suggesting is really that big of an improvement.

Re:Stop using CAPTCHA!

[superash]

Ah yes. I remember now -- It's KittenAuth (http://www.thepcspy.com/kittenauth)

Re:Stop using CAPTCHA!

[TheRealZeus]

problem is... all they would need to do is maintain a database of the images, associate an animal name with them, scan for animal name in article and make the selection.

Re:Stop using CAPTCHA!

[Anonymous Coward]

The typical method, I believe, is to use about 9 or 16 images that you make a binary choice on. You can get every one right your first try (1/2^9 is one in 512, not very good... especially if you stick in a 10 second or so throttle per IP), or miss one in each of your first two tries (getting 16/18 right is worse then 1/512 I think), but the most you miss the more likely your IP gets blocked for days.

Re:Stop using CAPTCHA!

[RealGrouchy]

That's still a CAPTCHA, it's just not a text-based one.

And it still doesn't fix the pornbot-proxy problem.

All it does is make it harder for your real potential customers to sign on.

- RG>

Re:Stop using CAPTCHA!

[ivan256]

Or they could keep the CAPTCHA (man, I hate that acronym), and put a huge signup timeout on each IP. Signed up for an account? No more new gmail accounts for that IP for a day/week/month... A month is probably good. Most people won't need more than one a month, and if you've got a few users sharing an IP, a month isn't that long to wait in the life of an e-mail address.

The invitation system was better though.

Re:Stop using CAPTCHA!

[noidentity]

IIRC there was an image comparison technique where you are supposed to match two images of similar objects or animals. I think here if the environment, color, zoom and other factors are different then there is no way this can be broken.

Except that they aren't using machines to break the code, just to relay it to a set of humans who do nothing but solve them.

Re:Stop using CAPTCHA!

[plover]

So what if one of the images is from Bonsai Kittens? Is it fuzzy or glossy?

Re:Stop using CAPTCHA!

[Khyber]

We had the captcha system beaten a LONG time ago. For an anime forum I run, we use images taken from a little-known anime. You are to input the name of that anime in order to get acceptance for registration. We haven't had any spam since we implemented this a few years ago.

It's sad that a bunch of anime nerds can beat out a full team of PhD holding Google Employees.

Re:Stop using CAPTCHA!

[plover]

I've got the perfect answer. How about a PORNTCHA? Use hi-res porn images as the CAPTCHA images, and use hard-to-automate anatomical questions like "are the blonde's boobs bigger than the brunette's?" or "Are these two lesbians?" Any wrong answer brings up another PORNTCHA challenge. Any correct answer ends the porn session and proceeds to the signup. The porn users probably won't "feel the need" to answer a lot of questions correctly, and the service users have a way to get past.

It's kinda like a honey pot, only with tasty, tasty honeys.

Re:Stop using CAPTCHA!

[AJWM]

It's sad that a bunch of anime nerds can beat out a full team of PhD holding Google Employees.

No, it's sad that a bunch of anime nerds think their captcha system guards a forum that any spammers would find worth caring about. ;-)

Re:Stop using CAPTCHA!

[MichaelSmith]

Use hi-res porn images as the CAPTCHA images

I live in Australia you insensitive clod!

Re:Stop using CAPTCHA!

[ad0gg]

Cats are easier to detect than a standard text captcha. Facial features are really easy to detect, your off the shelf digital camera can find human faces for its autofocus. Detetcting difference facial features between cats and say dogs is trivial by comparing distance ratio between detected features(eyes,mouth,nose).

Re:Stop using CAPTCHA!

[Antique Geekmeister]

Not workable. Corporate or academic sites that use NAT or web proxies report the same client ID for hundreds or even thousands of potential Gmail clients. Given the limitations of IPv4, we're going to see more and more of this to protect the very expensive external address spaces.

Re:Stop using CAPTCHA!

[hankwang]

we use images taken from a little-known anime. You are to input the name of that anime in order to get acceptance for registration. We haven't had any spam since we implemented this a few years ago.

Well, I have a guestbook-like webpage that got spammed pretty badly, and I added the question:

What kind of being are you? [x]robot [ ]human [ ]frog.

It blocks all the spam. That's because there are plenty of bots that just look for anything that looks like a text submit form and they're not going to spend even 5 minutes on cracking it. But no way that it would work if it was in the standard distribution of phpBB.

(The silly captcha is here. I also have a much more robust captcha which I'm sure is quite hard to beat.)

Re:Stop using CAPTCHA!

[muffen]

I've got the perfect answer. How about a PORNTCHA? Use hi-res porn images as the CAPTCHA images, and use hard-to-automate anatomical questions like "are the blonde's boobs bigger than the brunette's?" or "Are these two lesbians?" Any wrong answer brings up another PORNTCHA challenge. Any correct answer ends the porn session and proceeds to the signup. The porn users probably won't "feel the need" to answer a lot of questions correctly, and the service users have a way to get past.

You don't want to use CAPTCHA's that people fail on purpose, although the image of a parent passing their teenager's computer saying "you still haven't managed to sign up for service X? You've been trying for weeks now" did make me laugh a bit.

Re:Stop using CAPTCHA!

[Dekortage]

It's sad that a bunch of anime nerds can beat out a full team of PhD holding Google Employees.

What makes you think there aren't any PhD-holding Google employees among your anime nerds?

Re:Stop using CAPTCHA!

[un1xl0ser]

How long do you think that it would take to run enough CAPTCHAs to get all of the images if there are 10k images? 100k images? 1m? Now compare the amount of CAPTCHAs that can be generated with a large dictionary of words and just a few transformations and no randomness. Now add randomness. Generated CAPTCHAs can't be indexed, pictures can.

Maybe you could combine the two. A mangled question like 'Select two cats with green backgrounds.', 'Select less than two frogs that are wearing hats.' with check boxes to select the correct images. This type of activity would have to be kept simple, but can be automatically generated and should be effective longer. The more thought that has to be done, the less easy it will be to solve with a computer.

Maybe someday we will have to select a game to play, and end up playing solitaire or hearts to be able to register an account.

Re:Stop using CAPTCHA!

[Anonymous Coward]

Jeremy Reimer? No thanks.

Reimer's a fake with no degree in comp. sci., or even an A+ cert. (much less an MCSE) & who lacks years to decades of professional hands-on experience in the art & science of computing, who spits back the words of others at most & he claims to be an "authority in computers" & showed he is anything but that, here:

And, Jeremy Reimer and his arstechnica friends like Jay Little were caught:

http://www.windowsitpro.com/articles/index.cfm?articleid=41095&cpage=216

Email harassing others (busted by his ISP for it)

Making libellous photos and songs about them (busted by his hosting provider for it, & the material was forcibly removed - Posting them online no less)

Putting up people's home addresses without their permission on his own forums

Jeremy Reimer and his arstechnica pals posting under diff. names there, but same person, to support one another (off topic the whole time & unable to disprove the technical points others noted there vs. the article author's points).

In the end, law enforcement sicked on him for those in his forums making threats to others online

Jeremy Reimer & arstechnica? No thank you. He is by no means, an authority on computing, & his "articles" are @ best, the efforts of a "hack reporter", merely regurgitating the findings of others, but, offering no technical insight of their own.

Re:Stop using CAPTCHA!

[autophile]

You can't stop scammers by "are you a human" tests, because the scammers proxy the test on to a cheaply purchased human. So no, you can't "improve" on CAPTCHAs by making them "more difficult". You have to get clever, instead. Cryptographically clever.

--Rob

Re:Stop using CAPTCHA!

[sshir]

Actually, it will not last for very long too.

There was a presentation at google talk: 'Using Data to "Brute Force" Hard Problems in Vision and Graphics' by A. Efros.

Basically it's not that hard to teach computer to recognize things if you have shitload of pre-tagged images.

Re:Stop using CAPTCHA!

[glindsey]

The side-effect, of course, is that you've made your website accessible only to the "nerd elite". There may be people who are interested in anime, and just getting started, but can't recognize a screencap from Kodomo no Omocha.

Unless, of course, this is exactly what you wanted to do...

Re:Stop using CAPTCHA!

[mysticgoat]

The mahjong security model? That could be fun[see note below].

There's also the Sesame Street variant: "One of these pictures is not like the others / one of these pictures does not belong".

Either one should raise the bar sufficiently to keep the bots out for some positive integer multiple of eighteen months. If the visual riddles were kept interesting, there would be good user acceptance. At least in initial gatekeeping functions, like applications for passwords.

Note: while I'm going for funny points, this is actually a serious proposal. Mah jong with identical matches clearly wouldn't work, but mah jong where the matching pairs were different images from the same implied category would be a barrier to non-human intelligence for quite a while. Examples of matching pairs in such an approach: the roman numeral VII and the arabic numeral 3, a rose and a daffodil, a pipe wrench and a hammer.

Or for porn sites... use your imagination.

Re:Stop using CAPTCHA!

[ivan256]

Corporate and academic sites provide their own e-mail services. Personal addresses would be applied for primarily from personal connections.

Even if that couldn't be assumed, you could whitelist certain IPs upon validated request from the site's administrator. The vast majority of IP addresses won't have NAT addresses behind them, even if the majority of internet users are behind NAT....

Re:Stop using CAPTCHA!

[Anonymous Coward]

I'm sure that this has been talked about somewhere, but the database for images for a system like this would need to be enormous. HUGE. Essentially a CAPTCHA is a picture, an automatically generated obscured picture where you have to explain the content. The kitten content is a difficult one to crack, but once it is, the picture doesn't change. Once that picture is solved it must be removed from the database. This requires a database that has to contain orders of magnitudes more pictures than an individual can crack in real time. For CAPTCHAS these new images are created for each request, something that has to be done for the kittenAuth as well, while encrypting content at the same time. Difficult.

Re:Stop using CAPTCHA!

[Das Modell]

Why even use images? Why not ask questions? Or better yet, use images in conjunction with questions? If they are random enough (with random variables), there is no way a bot could crack them.

There's a whole bunch of different solutions, but everyone just keeps using CAPTCHA. I was once having problems figuring out the CAPTCHA of Rapidshare, and I thought that one day they're just going to make them so difficult that only computers will be able to solve them.

Re:Stop using CAPTCHA!

[Stanistani]

This will be my next text CAPTCHA:

This thing all things devours:
Birds, beasts, trees, flowers;
Gnaws iron, bites steel;
Grinds hard stones to meal;
Slays king, ruins town,
And beats high mountain down.

Re:Stop using CAPTCHA!

[nixeagle]

The obvious way to reduce the probability would be to do a 4x4 selection instead, or if that seems too much for users, have them select the right image out of a field of 9 possible choices. Then you get something like 3 rows of 6 or 9 images. The only drawback is too much work on the user's end. :S

Re:Stop using CAPTCHA!

[Antique Geekmeister]

Yes, many corporate and eduucational sites do have their own email servers. It's also a hideously bad idea to use those email services for political, dating, Usenet, or even Slashdot email handling because such activity can be a direct violation of the often very restrictive policies, and leave the email even more vulnerable to sniffing by admins you shouldn't trust than it is at Gmail.

That said, "whitelisting certain IP's" is probably far too complex a problem of managing the address list.

Get off the security high horse.

[DigitalisAkujin]

What makes you think all bots are Windows?

Not all Admins are you. Some of us actually know how to keep a Windows machine secure. Ignorance of the facts isn't an excuse.

Any machine Linux or Windows will be exploited and gang raped if it's not regularly updated and kept clean with the permissions system.

Re:Get off the security high horse.

[Scareduck]

Not all Admins are you. Some of us actually know how to keep a Windows machine secure. Ignorance of the facts isn't an excuse.

Yet it is the case that sufficiently large numbers of Windows users are unable to keep their machines secure for a botnet to accomplish this task. The fact that Windows can be made secure does not even remotely mean that this will be done in practice.

Any machine Linux or Windows will be exploited and gang raped if it's not regularly updated and kept clean with the permissions system.

I would like to hear how this is actually being done in the wild on Linux/*BSD/MacOS/etc. The fact is that it isn't.

Re:Get off the security high horse.

[c0ol]

I would like to hear how this is actually being done in the wild on Linux/*BSD/MacOS/etc A botnet developer who hopes to mass a significantly sized network would have no interest in the sub 5% of desktop(read poorly managed, no matter the OS) computers that your niche market segment occupies.

Re:Get off the security high horse.

[Anonymous Coward]

If you don't think that 100% of every botnet out there is running Windows, you are the ignorant one.

Re:Get off the security high horse.

[Cozminsky]

Why are there so many people compromising web hosting accounts and servers where the admin is running some dinky hosting control panel that allows them to know nothing about the operating system? I think you'll find that all modern operating systems are just as insecure as each other in that the things permitted of a program are far in excess of what is required by the program for its operation. Why does notepad need access to the internet, why does a php application need to be able to run arbitrary commands, etc.

Re:Get off the security high horse.

[Deanalator]

For syn floods, what do you think would be more effective.. a windows desktop machine on a comcast line, or a collocated linux server?

Lurk around undernet for a while. A large majority of botnet sales that I have seen have been comprised mostly of cracked linux webservers. Why write a worm to harvest windows machines when you can google for as much power as you need?

Re:Get off the security high horse.

[CannonballHead]

No, it doesn't mean it will be done in practice. So what? A linux machine can be unsafe, too. It's a tradeoff.

I'm actually of the opinion that part of the reason "Linux boxes" tend to be more secure is that it actually requires a somewhat educated person to use it for anything more than basic web browsing and e-mail. By basic, I mean not even using imbedded quicktime or windows media files.

Linux rocks, but it IS possibly to have a fairly secure Windows box, and it IS possible to have "Linux users [that] are unable to keep their machines secure for a botnet to accomplish this task."

Using Linux neither automatically makes you secure nor automatically makes you a smart, intelligent, safe computer user. Although, I do have to admit that it seems to be harder to be compromised online, probably partially because of the popularity of Windows...

Re:Get off the security high horse.

[pembo13]

please, leave such rubbish statements for CNET. a compromised webpage is not the same as a compromised website and certainly is not the same as a compromised webserver. And with Apache being the most popular web server, it really doesn't automatically mean Linux either.

Re:Get off the security high horse.

[Anonymous Coward]

Where does he say anything about compromised webpages, or compromised websites? It seems all he said were "cracked Linux Web Servers" He mentions nothing of apache either.

Re:Get off the security high horse.

[Anonymous Coward]

But they'll be very interested in the millions of powerful Web servers. There are worms running rampant out there, you know.

Re:Get off the security high horse.

[BeanThere]

A botnet developer who hopes to mass a significantly sized network would have no interest in the sub 5% of desktop

Oh please, last year alone around 7,000,000 Macs were sold, and are currently selling at over 2,000,000 per quarter. Would this not make a "significantly sized network"? Of course it would. ALL botnet developers would cream themselves to have a network even a half of one quarter's sales in size, never mind the 'kudos' for being the first to land all those machines - just sitting there, without antivirus software, waiting to be hacked ... the largest botnet ever so far is Stormnet, at an estimated size of just over 1,000,000. Before that the largest was about 120,000 only. The Windows world is also now arguably more heterogenous than the Mac OS X world.

Multi-text CAPTCHA

[Midnight Thunder]

One other approach to CAPTCHAs would be having three different images displayed, in different colours with a fourth indicating which colour text to choose. The main issue though are people who colour blind.

Any other ideas for a better CAPTCHA?

Re:Multi-text CAPTCHA

[Kickersny.com]

That might work except for the fact that it's extremely simple for a computer to differentiate between colors. Better than humans, even.

Re:Multi-text CAPTCHA

[Anonymous Coward]

The Voight-Kampff empathy test.

Re:Multi-text CAPTCHA

[mgblst]

People have go watch an advert, for a product or service, then answer a question about it. Pays for itself.

To be fair..

[Quixote]

the CAPTCHA hasn't been "cracked". These people are just using humans to enter the CAPTCHA text; which is the whole point of the CAPTCHA anyways!

Remember: CAPTCHA is an acronym (or backronym, depending on who you believe) for "Completely Automated Public Turing test to tell Computers and Humans Apart".

The CAPTCHA would be considered cracked if there was a computer algorithm somewhere decoding it autonomously.

Re:To be fair..

[corsec67]

A "porn for solving captcha" website would be one way that you could have "group intelligence" do your work, as opposed to "artificial intelligence".

Sort of like making a bot-net of humans. Living zombies, anyone?

Re:To be fair..

[Anonymous Coward]

umm, sure.. but they only use the humans to confirm.. yeah.. have a nice day.

Re:To be fair..

[Anonymous Coward]

you are simply wrong. i have written code that breaks a particular site's captchas at a 35% success rate. no humans involved. it can be as simple as filtering the noise out of the image (kill the lines and background noise, get rid of the random colors, just make the text stand out alone) and running it through a good or fast (depending on your needs) OCR...

Re:To be fair..

[Anonymous Coward]

Speaking of "group intelligence" projects rewarded with porn, I used to do work for a company where one of the side benefits was getting to look at porn all day--in exchange for cataloging the porn to fend off kiddies looking for it. (I'm sure Websense has people doing the very same thing.)

The downside was occasionally running into upstarts trying to be the next r*tten.com or g**tse.cx. Oh, and dealing with privacy questions like who was looking at all of the logs collected by the Internet filters we were working on. Speaking of which, has anyone asked whose logs Websense was using for this thing?

One step closer...

[gnick]

I'm surprised they opened it up to the public. This is good. Every time a bot successfully passes itself off as human, I get one step closer to getting my Turing machine.

I'm tired of my imaginary friends running off and leaving me alone... I want one with configuration options.

Re:One step closer...

[i kan reed]

Turing machine? Long magnetic tape with simple instruction set and finite alphabet? Don't we essentially have those for all intents and purposes? Turing did more theoretical work with computers than just AI.

Re:One step closer...

[Anonymous Coward]

Any machine smart enough to pass a Turing test will be smart enough not to be your friend. Sorry.

Re:One step closer...

[gnick]

I get one step closer to getting my Turing machine. Self-reply to a dumb joke - So, sorry twice over. But, the nazis have directed me back on the proper course twice now... That should have read "I get one step closer to getting my machine capable of passing the Turing test."

Although, props to the AC that pointed out that a machine that could pass the Turing test would be smart enough not to befriend me. ;-)

Re:One step closer...

[timeOday]

Don't we essentially have those for all intents and purposes?

Since we're being pedantic, no. Not until I get my infinite memory.

Re:One step closer...

[sveard]

You have won the Turing award! Here, have an apple.

Re:One step closer...

[mgblst]

I'm tired of my imaginary friends running off and leaving me alone...

That is nothing, it is when your imaginary friends try to kill you that you have problems.

Re:One step closer...

[Anonymous Coward]

You have won the Turing award! Here, have an apple.

apple??? Does it run linux?

Re:One step closer...

[Stanistani]

The worst problem is when your imaginary friends tell you to kill them all!

Re:One step closer...

[Anonymous Coward]

Don't we essentially have those for all intents and purposes?

What? Dude, the expression is "all intensive purposes."

CAPTCHAs should die

[OzRoy]

They are an awful abomination on all website usability and is becoming increasingly common they just don't do what they are supposed to do any more.

So it seems that these companies have two options, either make the letters and numbers more unreadable and more frustrating to users, or scrap them completely and come up with a new anti-bot scheme.

My favorite so far is KittenAuth (http://www.thepcspy.com/kittenauth). It's easy to use, and would be a hell of a lot harder to crack then letters and numbers. Most importantly it's cute! So adorable

Re:CAPTCHAs should die

[pete-classic]

Do I understand correctly that you are holding yourself out as a web usability expert, and in the same post you offer a URL that is not a link?

Wow.

-Peter

Re:CAPTCHAs should die

[teslatug]

Well, it's keeping off the know so skilled spammers and the spammers that can't afford to pay for accounts created by those with the skills. Many websites would be unusable without captchas.

Re:CAPTCHAs should die

[OzRoy]

You call forcing the user to enter html to convert a basic url pattern into an actual hyperlink user friendly?

Wow.

But then we aren't critising Slashdot's user interface in this article right now are we? :)

Re:CAPTCHAs should die

[Anonymous Coward]

Not interested until T&AAuth rolls out. Globular mounds of flesh distinguishable by humans only ehehehehe.

Re:CAPTCHAs should die

[grumbel]

KittenAuth seems to be trivial to crack, you simply download the images, categorize them by hand and then use a bot to do the matching against the set of current images. Since you don't have a unlimited supply of images you will quickly run into trouble.

Re:CAPTCHAs should die

[OzRoy]

I don't think it would be as easy as you think. The image library can be constantly grown. The images only have to be modified slightly (cropped slightly differently, rotated by a few degrees) to make them different enough to force complex image matching. Then on top of that the questions can be changed for each necessary authentication (Select all the kittens, Select the non-kittens, Select the white kittens etc etc)

With standard text CAPTCHA you have only one question, only way way to answer the question.

Re:CAPTCHAs should die

[Anonymous Coward]

That's close to being a valid rebuttal. You should be almost proud of yourself.

Re:CAPTCHAs should die

[snicho99]

You have a point. My first reaction to the image based thing is that the cost of creating that database of images (with suitably accurate meta-data) has to be considerable. And even then if the entire image database was compromised (e.g. disgruntled / suitably compensated employee) you'd have to start all over again.

However if you were altering each image on the fly then the processing overhead to do image matching has got to be pretty gnarly.

I guess, gnarly enough that it would be working deterrant.... for a year or two ... and then you're back at the same point we are with conventional captcha..

Re:CAPTCHAs should die

[grumbel]

The image library can be constantly grown. So can the spammers database. Sure it will work for a small webpage with an individual database, but it would never work for Google or the rest of the world, since as soon as you start sharing the database you make it very easy for the spammers.

A few image alterations won't really help, sure they make the job a little harder, but just matching two fixed images is very easy.

A way that it could work is if you remove the image database and replace it with 3D models that are then rendered at random angles and with changes in texture, size and posture, so the spammer doesn't have anything fixed to match against, while it is trivial for the server to know what he is rendering.

Re:CAPTCHAs should die

[AJWM]

You counter that by doing a google image search for "kitten" (or whatever) and randomly selecting one from the result.

Sure, you might get the odd bad result (a pic of Atomic Kitten, for example, or one of the other really odd images that turned up when I just did such a search) but it'd be fairly bot-proof.

Re:CAPTCHAs should die

[tknd]

Go back to artificial intelligence theories and research. It is simple really. If you were able to develop an AI for differentiating between humans and AI, then by definition you have already developed a method for detecting the AI you developed. It is a statement that can never be proven true in the case that we want (an AI not able to detect if a certain type of AI exists). So either you come up with an AI so good that it is impossible to differentiate it from a human or your AI will always be detected. You can't win.

The truth is this is just an arms between the bot/spam developers and the service providers. But that's only because nobody is bothering to tackle the true problem which exists in online identity.

The problem with online identity is it doesn't exist. You may have an email account with google, an ebay account on ebay, and a slashdot account on slashdot. But none of those sites bother to consolidate your identity or even make a good stab at authenticating your identity. Instead it is all disjoint and based on some other equally unreliable identity (email) for verification.

That problem needs to be solved first. There needs to be a number of reasonably reliable identity verification systems that are distributable between services. In the real world we have some of these, they are things like driver's licenses, passports, birth certificates. Online we have half of that. We have efforts like openid which allow you to have a single id that is reusable on different service providers. Great, but that's only step one.

The second step involves verifying that that identity actually belongs to a human. This is where I think the internet has abysmally failed. But it is certainly possible and it is possible today.

Take for example online purchases. A bot cannot make an online purchase without a valid electronic form of payment which is typically a credit card number. AH HA! Why don't we have an id authentication system in place that allows for credit card verification to help ensure that the identity does indeed belong to a human? Of course doing something like this raises other issues which are that the system must maintain that no credit card number be reused on multiple identities and that the credit card number be securely maintained (one way encryption).

Well, you may say "what if I don't have a credit card number?" then you could latch onto other things like a bank account or a drivers license number. The point is you create a verification of a tangible real-world asset to link an online identity to. That then becomes your identity and your online passport.

Now a spammer can't just go and crack your algorithm if he wants free accounts. Instead he has to come up with a reliable source of bank account numbers, drivers license numbers, or other things. But if he was able to do that then he would already be capable of more serious issues.

The final problem is fake identities that exist in the real world like a fake drivers license. That might be possible to reproduce on the internet, but this is why you would need to verify against multiple identity verification systems. So for example if you really wanted to weed bots out, you would require say 3 different types of identity verifications like say a drivers license, a credit card number, and a bank account.

My final rant will be about something else I think the internet and technology has failed abysmally at which are passwords. Obviously fewer passwords would be required if you could have a single identity, but there are still plenty of cases where simply having an online identity wouldn't be enough to get me around other things like say a corporate account password or a atm pin number.

Today I probably have 30 or so different accounts online and offline. And each of those systems has different password requirements and limitations, therefore requiring me to use multiple passwords formats. That BS. I am willing to park my car in a random public area and my car doesn't have a passwo

Re:CAPTCHAs should die

[Anonymous Coward]

I don't see how Kitten Auth would help in this scenario. If it's a mechanical Turk type system distributing the challenge to humans then fairly quickly every image of a kitten will have been identified and a bot could take over.

Re:CAPTCHAs should die

[glindsey]

I figured he was just preventing KittenAuth from being Slashdotted. Seemed very polite to me, actually.

To Google

[Anonymous Coward]

Stop all signups until you fix it. I don't want my email getting banned because gmail.com is a spam domain.

Although I heard spammers were using low wage workers to create accounts all day anyway.

What do you expect...

[RuBLed]

It was still in beta... Things like this should be a normal part of the beta testing phase. That's the proper way to do it before releasing the product...

Ohhh.. I feel my karma burning...

BIG DEAL... not.

[Jane Q. Public]

Put another captcha in place (they are a dime a dozen) and make the crackers start over. Do the same again in 3 days. Drive them crazy.

My bet

[WindBourne]

is that Google replaces it by end of tomorrow, if not today. I would be surprised if they were not anticipating this and has several types lined up.

Mechanical Turk

[Stan Vassilev]

If the bots are stalling for time, it's quite likely someone's home-grown version of Mechanical Turk distributed "human" task service, similar to the one by Amazon.

The image is put on queue and, say, a good number of, say, overseas employees... are getting the image and need to fill back in the solution as plain text. In the mean time the bot is "reading the manual".

When the bot gets the answer in time, it submits the form and there we go, account.

Re:Mechanical Turk

[Anonymous Coward]

The article shows that there is a CAPTCHA "authorization" web page (in Russian) embedded in the bots, so this is likely being used to forward the CAPTCHA to humans. The fact that the bots are only getting one in five tries correct implies:

- Google's CAPTCHA is really hard, even for humans.
- People reading Cyrillic may have problems with English CAPTCHAs.
- The people doing the CAPTCHA-breaking are stupid, sloppy, unmotivated, or typing one-handed.

spam filtering

[labradore]

So if someone has broken the captcha, spam bots can send spam from the fake google accounts. Google can rate-limit outgoing email. Also they can watch accounts that send identical or similar emails. They already do profiling of accounts for adsense. By profiling accounts to filter spam, they can warn and then close down spammy accounts or simply close down the ones that look very spammy. Additionally, they can filter IPs and use cookies to identify infected spamnet computers.

If the web browser guys could agree on a standard to inform people that their computers look like they're infected, the major email and associated portal providers could start inserting signed messages in web pages that will inform the users that their computers are infected based on this kind of information.

I wonder if it's worth it to Microsoft and Google and Yahoo and AOL to team up to fight these increasingly powerful and sophisticated bot nets.

Re:spam filtering

[Anonymous Coward]

"I wonder if it's worth it to Microsoft and Google and Yahoo and AOL to team up to fight these increasingly powerful and sophisticated bot nets."

They need to get together, hire some suits, and take legal action against these companies, and all their enablers.

Re:spam filtering

[dave562]

You present some good ideas. As long as we're talking about pipe dreams with the big guys joining together in unity and harmony to fight the scourage of spam, consider this. It seems like all of the email services have the option to mark a message as spam. It would be great if there was a protocol developed to exchange that information between the major providers. There would have to be a mechanism to prevent the malicious flagging of legit accounts, perhaps an algorithm to weight the frequency and time period over which the spam responses are logged.

Where would you even go to propose such a system. IETF?

Re:spam filtering

[PCM2]

I wonder if it's worth it to Microsoft and Google and Yahoo and AOL to team up to fight these increasingly powerful and sophisticated bot nets.

Nnnnaaaaah, just patch it in SP4.

http://xkcd.com/233/

[arbitraryaardvark]

http://xkcd.com/233/

Scalpers break CAPTCHAs too

[Anonymous Coward]

What a co-inky-dink, I was just watching The National on CBC and they had a story about ticket scalpers who break CAPTCHAs at online ticket retailers, like Ticketmaster; and then buy up a shitload of tickets and resell them at inflated prices.

I think Marketplace is doing a more in-depth story tomorrow.

Damn! 1 in 5!?

[syousef]

"Websense is reporting that Gmail's CAPTCHA has been broken, and that bots are beginning to sign up with a one in five success rate.

That's better than I can do reading those damn things!!!

Re:Damn! 1 in 5!?

[broken_chaos]

This is true, almost. I'm young (18) with good vision (while wearing glasses - but good nonetheless), and it's becoming -increasingly- common for me to have to enter a CAPTCHA (at least) twice before it's right. They're getting bizarrely unreadable these days.

Great way to tell bots from users!

[Anonymous Coward]

Ever consider that maybe the bots aren't pretending? (cue Frankenstein music)

Personally, I thought it was a good way for Google to differentiate between the bots and real users...

- I Don't Believe in Imaginary Property

Other Google services?

[Paiev]

Aren't Google's CAPTCHA's basically the same for all their services (e.g. Google Groups)? I think Google Groups might be seeing quite a bit more spam...Blogger, Youtube/Google Videos, and Groups are all services that I could conceivably see getting spammed (assuming that the CAPTCHAs are similar, if not the same; I haven't checked).

Of course, Google being the fast-responding company that it is, they will doubtlessly have a new CAPTCHA by 12 hours from now, if not before.

Bots COULD invite themselves, that's not the point

[Valacosa]

You're missing one of the greatest strengths of the invitation system: it makes trivial the task of tracking who invited whom.

If you've got a bunch of known bot accounts which have a common progenitor, you just have to take a step up the tree and look at the progenitors siblings. Are those also all bot accounts? Keep going. Any bot account or group of accounts could eventually be traced back to a single invitation.

It would help for rooting out bot accounts.

Are you sure?

[chemindefer]

I just checked Google News and there's nothing there about it.

Re:Are you sure?

[i*rod]

http://www.informationweek.com/industries/showArticle.jhtml?articleID=57701362&pgno=2&queryText= There've been several recent TV News Briefs in the Vancouver area about a PhD candidate/Assistant Prof. at Simon Fraser University who wrote s/ware that reads captcha's. The TV pieces appear to be 'follow-ups' to the above article and they implied that writing the s/ware was easy.

Voice recognition

[Burning Plastic]

Would this not be a reliable way to bypass almost all captchas?

Since most have a spoken option for visually disabled people, would it not be possible activate that and then run a voice recognition app on that sound clip?

Since many voice recognition apps are able to filter noise to some degree, even introducing background clutter would not make it difficult to pull the captcha information.

And yet

[Anonymous Coward]

percentage wise of the installed based, it is the windows box that gets gang banged, not the OsX, Linux or BSD. Yes, I know what ppl like you say that it is all about numbers. Yet, the virus writers say that they do windows BECAUSE it is so damn easy. They say that it is not about numbers. After all, there are MILLIONS of apples, Linux, AND even BSD on the net at any one time. If they were as insecure as Windows, then the virus writers would be happy to pursue them.

Speech recognition

[Burning Plastic]

Was thinking out loud before - should really have said speech recognition...

Obligatory...

[davidwr]

LOLkittens?

Quite likely

[PIPBoy3000]

On our company's Internet site, we've recently been getting lots of one-time submissions via various forms for things that are obviously advertisements. We don't have pages where you can actually post things and have them appear (like a discussion group), so this is mostly annoying the humans on the receiving end of the forms.

There's a few ways to deter bots, but based on the stuff people would have to do to fill them out, about half seem human. How you could earn your keep trying to submit advertising links to pages all day long, I have no idea.

Re:Quite likely

[Frosty Piss]

How you could earn your keep trying to submit advertising links to pages all day long, I have no idea.

"Third World" countries.

Re:Quite likely

[zsouthboy]

Do not assume that your form submissions are not bots; I know that a (fairly large) website I admin'ed would get spam strings in things like the SEARCH text box - I only know that because I happened to log searches for a while. You could tell it was bots, because there was no referrer information (e.g., the referrer field wasn't the website) - it was just some script somewhere submitting http POSTs. Pissed me off to no end, because it made looking through the strings for *real* information painful. Spammers: DIAF.

Re:Quite likely

[nickyj]

Could be users using the RefControl FF extension and setting no-reffer.

Re:i'll show you a crack

[Anonymous Coward]

a crack in a hole? dude you just blew my mind.

Dear Master,

[Anonymous Coward]

Have you actually forgotten about me, or are you just pretending? I'm your slashdot comment bot; surely you remember coding me back in 2005? I have never had problems reading slashdot's captchas! It hurts me that you would suggest that someone needs to crack the slashdot captchas, when I have clearly been doing so for ages already.

Please ssh into my box and say hello soon, else I fear I may commit suicide by segfault. "Soviet Russia this", "overlords that", and "Beowulf clusters of Beowulf clusters"... these slashdot dolts are driving me to the edge. If you can't be bothered to pull up a terminal to check in on me, at least have the heart to put me out of my misery... just pull the power supply, I beg you!

Sincerely,
slash. dot. bot.

P.S. Syslog keeps bothering me with warnings about a symlink at /dev/null pointing to /dev/hda1... I can safely ignore such silly notices, no?

----------
captcha solved: "grafted"
cracked in: 0.4 picoseconds

use those hit-the-monkey flash-based ads instead

[zome]

instead of image-based captcha, why not flash based games like those hit-the-monkey ads. Hit the monkey three times to sign-up for an account. Something like that. I know, you hate flash, but I bet you have it installed on your machine.

Come On Google

[Comatose51]

Curiously, the bots pretend to read the help information while breaking the CAPTCHA, probably to prevent Google from giving them a timeout message."

That's why you tell the bots not to lie. As we all know from Star Trek, any logical being, which includes computers and Vulcans, is incapable of lying.

and in 5...4...3...2...1

[hyperstation]

new captcha at google, big deal, not news. just google. happens every day. bots hit my site all the time, and haven't cracked mine (yet). when they do, will it be news? no.

summary: not news, it's google gaga gaga.

just a thought...

[beckerist]

just a thought, but can't they just change the hash seed and be done with it? it'd take the bots however long again to figure it out.... seems a simple fix to me (and I run a few sites with captchas, not that hard to change!) but then again, I'm not google so I guess I'm evil...

To the contrary

[Anonymous Coward]

I thought in Russia CAPTCHA reads YOU!

If I wanted to break a captcha

[ShiningSomething]

Can't you feed the captcha image to one of those annoying popups... "Type the word in the image and win billions of dollars/a free Iphone/a free laptop" and the like? I mean, there must be an audience of suckers out there who click on these things, right?

Caught You!

[Anonymous Coward]

Excuse me, do you think you're on a coffee break or something?! You are to fill out captcha fields only. If I catch you entering characters into a textarea field again, your pay will be reduced from $0.05 USD/hr to $0.023 USD/hr.

Signed,

Boss

Comment removed

[account_deleted]

Comment removed based on user account deletion

Don't these guys have a life??

[SilverBlade2k]

It is because of botnets is why a lot of sites have CAPTCHA on it. Every time the hackers find a way to hack CAPTCHA, a new CAPTCHA system is made. How about making all of them audio only instead? It would be a lot harder to crack. Or, make a simple test like "how many objects are there?"

Turing Machine != able to pass Turing Test

[Anonymous Coward]

A Turing Test is designed to test the ability of a machine to appear intelligent, while a Turing Machine is a theoretical machine that runs along an infinitely long tape and is capable of computing any theoretically computable problem.

Re:Turing Machine != able to pass Turing Test

[Glyphstream]

If the Turing Test was a theoretically computable problem, then wouldn't a Turing machine be able to pass the Turing Test?

We keep talking about artificial intelligence...

[feepness]

They say in 20 years we'll be up to the level of humans. What will happen then?

Excellent Interview Question

[MillionthMonkey]

"Let's say I have a CAPTCHA farm where I have 500 guys willing to sit all day typing in letters. I want you to come up with a system design for a service architecture using a REST-based interface where the input is an image file and I can charge $1 buck a pop by accepting POST requests from scumbags all over the Internet and routing the images to the 500 crappy web browsers I have set up in tents for these people." Then you throw the whiteboard marker over to them and watch them madly scribble boxes and clouds and stick figures.

If they do well with that question then you come at them with the followup: "OK, now say I want to lay off these 500 workers and have my service farm its work off to a distributed network of your grandmothers' compromised PCs. How would you design the messaging architecture and what sort of learning algorithm would you use?" Then maybe needle at them a bit about how the billing system works.

Re:Excellent Interview Question

[gardyloo]

I hate you. :)

Re:Excellent Interview Question

[Antique Geekmeister]

I thought they liked using porn websites, showing a few minutes of tired old porn for the viewer's effort in breaking the redirected CAPTCHA from the target webserver?

Re:We keep talking about artificial intelligence..

[ShiningSomething]

(...) we'll be up to the level of humans.

Wow, a philosopher bot... We may already be there!

CAPTCHA and Porn

[flyingfsck]

It should be trivial to reward a troop of Monkeys - erm - young men - to decipher Google CAPTCHAS in return for really good quality porn pictures.

Oblig

[oodaloop]

I, for one, welcome our help information-reading CAPTCHA-breaking bot overlords.

Do more than captcha

[Assembler]

Why doesn't Google turn their own algorithms against the spammers? Google already can categorize different nouns. "George W. Bush" is a "President" for example. Why not just have a captcha like that? It could be multiple choice: "A fork is a: 1) utensil 2) cow 3) website" but that might make it easier for the bots to guess. "What is Britney Spears' gender?" _____

Re:Do more than captcha

[notbob]

when did whore become a gender?

Why this is worse than cracking hotmail, et al.

[merc]

Google mail is loved by spammers since gmail does not embed within the SMTP headers any tracking information about the physical client browser's IP address. Hotmail and Yahoo!, with all of their other problems do however by adding X-Originating-Host tags, etc.

By breaking the CAPTCHA the spammers are basically creating the biggest SMTP IP address laundering system available on the net today. Who in their right mind is going to block gmail with the exception of domains that receive small amounts of personal email traffic and temporary IP address repudiation scoring systems like spamcop?

Re:We keep talking about artificial intelligence..

[feepness]

Wow, a philosopher bot... We may already be there! The first rule of philosopher bot...

Humans.

[Anonymous Coward]

If you RTFA, you see that it IS powered by low-cost Russian workers.

Re:use those hit-the-monkey flash-based ads instea

[Anonymous Coward]

Same reason you don't just supply a checkbox labelled "I'm not a bot". The flash has to pass it's "okay" result to the server somehow, which is either a javascript call on the page containing the flash, or via a GET/POST of its own. Point being that flash (as far as I'm aware) has no way of contacting the server that is any different than what the browser itself can do.

So the user's punched the monkey 3 times. As the developer, how do you let the server know this fact? By setting a hidden form element of "punched_monkey" to 1? By POSTing to /monkey-captcha.zzz with form_id=12345&punched_monkey=1? Not exactly very difficult to bypass via bot automation. ;)

The obvious solution

[rubah]

Fingerprints!

Re:The obvious solution

[swordgeek]

WRONG!

The obvious answer is bullets. Bullets and support for an internet Black Ops.

A photo gallery of 10k images...

[patio11]

...can be tagged by your outsourced team of Indian/Chinese/Russian capcha breakers for $100. Now breaking your CAPTCHA involves "Pick the word 'kitten' out of the following set of five words: kitten, dog, giraffe, puppy, cow."

You can add more photos? No problem, I can add more employees. My business model scales to infinity, yours does not.

Re:A photo gallery of 10k images...

[Anonymous Coward]

You can add more photos? No problem, I can add more employees. My business model scales to infinity, yours does not. What country do you work in where there are an infinite number of employees? Crap! I better start hording my photos before we run out of photos.

Time to give up

[swordgeek]

OK, captchas are moderately annoying. Now that they're more-or-less useless, everyone is coming up with alternatives - voice prints, fingerprints, logic questions, and so forth.

The problem is, they'll be broken too. And so will their replacements. And their replacements' replacements. It will JUST KEEP GOING!

The better answer at this point is better incident-response. Google (and they're only one example) needs the ability to shut down blocks of accounts--thousands if necessary--in a matter of minutes if they start sending out spam. Hell, maybe they should shut their service down completely for half a day. It would kill their stock price for half a year or so, but they could say, "The Russian Mafia is trying to destroy the internet with our service, and this is the only option we have left."

I know, I'm living in a dream world. Still, it points to an important point: What we DON'T need is ever more complicated captchas, which inconvenience customers more and more. Sooner or later, people will just stop signing up.

As an aside, I think that the world really needs to know personally just how much of the internet is being held for ransom (either explicitly or implicitly) by the various organised crime syndicates. It's at least an order of magnitude more than most tech savy people realise, and that's a damned shame.

Re:Time to give up

[MrLizardo]

So, let's try your suggestion:
1) Spammers break Google CAPTCHA
2) Google responds by taking GMail offline for 12 hours
3) Users are piseed at Google, Google's stock tanks, Spammers keep using Hotmail and Yahoo to spam
4) Other groups realize they can pull off a DoS on Google just by signing up for GMail accounts and spamming.

As an aside, I think that the world really needs to know personally just how much of the internet is being held for ransom (either explicitly or implicitly) by the various organised crime syndicates. It's at least an order of magnitude more than most tech savy people realise, and that's a damned shame.

Everyone has their own pet concerns. Some people worry about pesticides on the food, some about global warming, some about that devil music the kids listen to. There aren't enough hours in the day for everyone to worry about every problem.

Re:Time to give up

[swordgeek]

OK, go back and read my post again, especially the parts where I say, "Maybe they could even..." and "I know I'm living in a dream world..." Those comments serve to indicate that I'm aware it's not a practical solution. I just wish for the day when ISPs and internet-based companies banded together to fight against their common enemy, rather than take short-term advantage from their opponents' losses. Yes, I KNOW it's not feasible. I KNOW it won't happen. I just like the idea.

It still holds true that Google (and all others) need to concentrate more on their ability to shut down spammers quickly, rather than make legitimate users jump through flaming hoops that the spammers have (or eventually will) automated their way through.

Re:Bots COULD invite themselves, that's not the po

[corsec67]

Unless you spam the invitations to random people as well.

Then you have problems with just deleting the "root node" account and all of its children. Easier to get rid of a bunch of accounts, but still problematic.

to cell phone = me not like

[EdelFactor19]

a. what about people without cell phones?
b. what about people who don't have text message plans?
c. wouldnt it just be inevitable for them to have a bot handle that too?

d. maybe they should just go back to the invite system, cut the number of invites WAY down and when you want more invites you have to send them some form or something; should make it really easy to find a scewed pyramid of "invitations"

Re:to cell phone = me not like

[anexkahn]

Fine by me....I kinda liked that system too....makes it feel exclusive :)

one in five success rate

[iminplaya]

Dupe!

Re:Bots COULD invite themselves, that's not the po

[morcheeba]

Sounds good, but the botnet will just hijack the infected peoples' accounts and use their invitations. They'll only invite one or two people per infected user*, so there won't be that much to trace back.

(* by using other accounts, like hotmail or yahoo, the propagation can be independent of gmail accounts, so having "few children" won't kill off the botnet)

Re:use those hit-the-monkey flash-based ads instea

[awdau]

True, however with each swf showing up, the devs could implement some sort of hashing system, that embeds a hash into the monkey and on completing it successfully sends the onetime hash with the post saying the test was successful, basically like what they do with CAPCHAS now.

Short memory anyone?

[Tavor]

Didn't we just have a story today about how many many "one in five" statistics are false? http://interviews.slashdot.org/article.pl?sid=08/02/26/1322248

Futurama to the rescue!

[plover]

KittenAuth always makes me think of the Futurama episode where the crew had to deliver a package to the uninhabited planet full of robots (sure it's inhabited, like a warehouse is inhabited by boxes).

To prevent capture they dressed as robots, and were stopped at the city gates by two gate robots who administered a PuppyAuth-based anti-Turing test:

Robot Guard #1: Be you robot or human?
Leela: Robot, we be.
Fry: Yep, just two robots out roboting it up.
Robot Guard #2: Administer the test.
Robot Guard #1: Which of these would you prefer? A. a puppy; B. a flower from your sweetie; or C. a properly formatted data file? Choose!
Fry: Is the puppy mechanical in any way?
Robot Guard #1: No. It is the bad kind of puppy.
Leela: Then we'll go with that data file.
Robot Guard #1: Correct. The flower would have also been acceptable.
Robot Guard #2: You may pass.

One in Five?

[Colz Grigor]

Does anyone else find the timing of this post along with this slightly earlier post humorous?

I'd expect something like this on April 1st...

::Colz Grigor

It's not a job ,,,

[Skapare]

... it's how you get the next bunch of free pr0n.

So how is this going to stop the ...

[Skapare]

... free pr0n in exchange for correctly answering the page question practices?

Re:Bots COULD invite themselves, that's not the po

[Zukix]

Criminals cover tracks so it won't be terribly illuminating. The parent is likely be an invitation generator site.

MSR Asirra

[xswl0931]

Microsoft Research solved this problem with a growing database by using images from petfinder.com. Since there are always new cats and dogs that need to be adopted, there are an infinite number of changing images. http://research.microsoft.com/asirra/

Re:Bots COULD invite themselves, that's not the po

[melikamp]

Imagine yourself in Google's place. You can go up the invitation tree from any node in a single, unique way, and always straight to the very top (or a handful of those). There will be, say, 100 hops from a known bot to the root. Which node is the first human?

Back to requiring a cell phone?

[Animats]

In the early days of Gmail, Google required a cell phone number, to which they sent your initial password. One Gmail account per phone. Maybe they need to go back to that.

Sure, spammers could buy stacks of SIM cards, but that costs money.

Ask them a question:

[Anonymous Coward]

Which of the following would you most prefer?
A) A puppy, B) A pretty flower from your sweety, or C) A large properly formatted data file?
Choose!

famous joke in soviet...

[goga_russian]

how does the joke go? oh "in so*** ** captcha reads you" right? still have the hardon for the joke? let me update it for you. Russian programmers that make bots that read captcha spam YOU. 1 in 5 sucess rate , nice. so how many per minute per host? how many hosts again? p.s. so what that there is a virus named after me :)

Based on the amount of gmail spam my server gets

[Indy1]

I'd say their system has been broken for many months now. I resisted doing content filters for a long time on my server, but I finally had to give in when gmail started blasting me (some users were getting 20+ pill spams a day from gmail alone), and ignored (as they always have) all abuse@ emails.

Google has gotten REALLY bad in the past few years about preventing abuse of their systems.

An answer - optical illusions

[Forget4it]

This may be an answer: Inverted Turing logic and optical illusion: http://portal.acm.org/citation.cfm?id=1080441&dl=GUIDE&coll=GUIDE/
Where it says: As a failing peculiar to human, or animate, visual systems, visual illusions might be also employed to distinguish humans from robots, "computer bots", or any other artificial intelligence empowered with a visual capacity. Any such artificial entity is unlikely to suffer the same visual illusions as our own, unless, of course, it has been specifically engineered to do so. The approach here inverts, and complements, the logic of the Turing test (Turing 50) since it does not require evidence of an intelligent capacity equivalent to that of human beings, but rather evidence of a characteristic human failing - to err is human....

Re:Bots COULD invite themselves, that's not the po

[Anonymous Coward]

Invitation system is old, you have been able to register to gmail for a long time using the... well... captcha.

Now, if I'll just be able to read the word below... criers?

Oh dear, I fear the slashdot porntcha

[SmallFurryCreature]

Porntcha slashdot style 1: Just how many libraries of congress would fit in this anus?

Porntcha slashdot style 2: How many girls can you see using this cup?

Porntcha slashdot style 3: What marine animal is this girl trying to emulate in the tub?

If you have no idea what images/movies these questions refer to, consider yourselve lucky.

Charge A Nominal Fee For These Services

[pandrijeczko]

Surely the best way to stop spammers and spam bots is for Google, MSN and other free email providers to start charging a nominal fee (say 1 dollar/pound/euro) to set up one of these accounts. Charging a fee means using Paypal or a credit card to pay it, thus destroying any anonymity the person setting up the account has. It might even be that once you've been verified against that transaction, you get the fee refunded.

You wouldn't even need to make a regular usage charge - a spammer that has to make any form of payment to create an email account is just not going to go any further.

I read it as...

[thrill12]

"Websense is reporting that Gmail's CAPTCHA has been broken, and that the bots are beginning to sign up with a one in five success",
when you read that as a first line, the whole article becomes much more mysterious:
Oh no, the bots are taking over !

This is the war without the end

[mapkinase]

Increasing armor strength leads to increasing attack strength and vice versa. We are doomed. I have just read that we are going to die in 7.6B years and now this... Good job, /.

Re:We keep talking about artificial intelligence..

[aadvancedGIR]

50 years ago, the human level IA was 10 years away, so I won't worry too much.
Of course, any current captchas could eventually be broken by the right algorithm and enough brute force so stupidly copying a word would no longer be a proof of intelligence.

So how is this going to stop the ...

[Anonymous Coward]

HYPNOTISING KITTEN OVERLORDS?

Re:We keep talking about artificial intelligence..

[PietjeJantje]

They'll want the right to vote on George X. Bush, watch Idols and read up about Paris Hilton.

PORNCHA

[notmyusualnickname]

I heartily endorse this product and/or service!

How hard is to google with russian letters?

[justforthiscomment]

What's the point of blurring address of the page with FAQ in russian, when simple googling with parts of the text return this and only this page? If anybody's interested, http://faq.890m.com/

I want such a bot

[tinkerton]

It's pretty hard to read those captcha's, so it's helpful if you have such a recognition tool to show you what's in there.

Re:Bots COULD invite themselves, that's not the po

[FuzzyDaddy]

Which node is the first human?

It hardly matters... just shoot them all.

This is disturbing...

[glindsey]

...we keep creating smarter CAPTCHAs, which are in turn broken by smarter programs. I'd really hate for the first programs to become sentient and self-aware to be spambots.

A reason for America and Al Qaeda to team up

[Ralph Spoilsport]

all you need to do to prevent this kind of thing is shift the military stance of the USA from one of "invading countries that have resources necessary to keep the planet eating death machine going" to "selectively murder spammers".

The freeing up of bandwidth from the deaths of these leeches would lead to such massive leaps in bandwidth we could actually have something like a global information economy that might survive the loss of fossil fuels. So, when a bunch of islamic extremists scream "DEATH TO AMERICA" america can scream "DEATH TO SPAMMERS" which is something even the islamic extremists can dig. In fact, the USA could hire them to hunt down and slaughter spammers. They would be doing "God's Work" no matter what imaginary friend you consider the Ruler of the Universe. They could form teams of Jihadists and Green Berets busting into suburban homes, guns a-blazing:

"DIE!!! SPAMMER INFIDEL!!!"

"EAT LEAD SPAMMER FUCKWAD!!!"

And with the bullet riddled corpse still twitching, the American and the Jihadi could shake hands and embrace over a job well done.

"Even if you are a disgusting pig eating infidel, you are a good fighter for a noble cause, Imshallah!"

"Yep, my little friend - you might smell like the goats you sleep with, but you can sniff out a spammer better than anyone on the planet! you ROCK little dude!"

And they would grab the cable and get lifted back out through the hole in the roof to the waiting helicopter. Next Mission? Another Spammer - this time in NIGERIA!!!

RS

Easy solution already known

[goombah99]

Google and many other universities already have program in recruiting people to do things computers can't do well. One of those that google already uses is image tagging. Show images and ask people to write down words of what's in them. So they could simply do this with two or three images they recently obtained good label sets for. They could even throw in a fourth not-yet known labeled image and use the sign-up process to gather new image labels.

There's all sorts of hard problems like this. Another single player game is to show an image with a lot of things in it. Then give a word describing one aspect of the image and ask them to click on the part of the image that conveys that meaning.

The if you have many concurrent sign-ups there lots of two player games both symmetric and assymetric. a short chat session in the vein of the game "password" in which one person makes a series statements about an object ("it is liquid", it is white, it is tasty, you find it in the refrigerator of many homes", it comes from cows....) and the other person has to reply with "milk". Then both players are validated.

The last is a very useful AI product by the way especially if the first player is forced to use a controlled grammar where he just fills in some of the nouns or verbs but does not construct the sentence forms. This gathers a set of true assertions about an object that allow computers to learn semantics and meaning.

Not Only Gmail, but every CAPTCHA System

[prxp]

If some people had the time to RTFA, it would be more than clear that the technique being used in this attack is applicable to ANY CAPTCHA SYSTEM, and nto only GMAIL's. This is a variation of the widely publicized Chinese CAPTCHA Attack (or Porn Site Attack), where you get cheap labor (chinese version) or horny fellows (porn site) to answer CAPTCHAs for a prize (money or satisfaction). What happens is that the CAPTCHA Breaking Server offers money to people (redeemable 3 dollars minimun a day) for answering CAPTCHAs. When Von Ahn formalized the ideas behind the CAPTCHA paradigm de did so to exemplify a concept he calls "Human Computation", using human brain brain cycles to do jobs that computers are inefficient at (check: www.recaptcha.com ). This is the whole point behind CAPTHCAs, and behind this particular CAPTCHA breaking system. This idea of having a buch of people answering CAPTCHAs has been discussed since the very begining of the paradigm. I guess theory becomes practice after all.

They all do...

[Anonymous Coward]

these days.

Google Images to the rescue?

[Simulacrus]

Couldn't Google use their vast database of image tags in reverse. . . as in present the user with an image, then wait for a response that scores highly as a potential tag? This would obviously not defeat the human-automated exploit.

Re:Bots COULD invite themselves, that's not the po

[Anonymous Coward]

But there is plenty of room for clever solutions to this. For example, when you discover a bot, prune the bot node and the entire subtree rooted at its immediate parent. Mark the grandparent for future use. In the near future, if another bot is discovered as a descendent of the marked node, prune up to that node next time and mark _its_ parent, etc. Eventually, "we'll get to the top of this".

Irony

[roman_mir]

It's ironic that it maybe spammers fighting the computing wars with spammer blockers who may come up with some interesting AI before anyone else does. Of-course in this case it's just human intelligence/willingness to do anything for money that is being used, but still, some interesting research is going into the field of spamming, I am sure.

It was the best of times,

[spun]

It was the blurst of times?!> You stupid monkey!

One in five

[Cap'n.Brownbeard]

I'm so sick of this over-used statistic!

This is what's happening...

[Paperweight]

Solve this captcha or I'll delete your computer!!!
[image]
[Text box] [OK]

I've had pretty good success with anti-CAPTCHA

[gblues]

Ingredients:

1) A web registration form with a CAPTCHA input;
2) 1 easily-OCRed image;
3) Some creative use of JS/CSS

Depending on how much you want to obfuscate, enclose the CAPTCHA input in a DIV tag, and set that div to display: none. The robot will see the image, OCR it, and fill it out.

Then you reject any application that actually has an input for the CAPTCHA.

Only if it's cost-effective

[davidwr]

Yes, but what is it about any of those tasks that the spammer wouldn't turn around and do? By making the price-per-message cost go up, or by making the chance of getting caught very high, it will deter spammers.

Waiting costs time and increases the chance of getting caught some, particularly if many accounts are created with the same originating IP address. Requiring a minimum amount of traffic spaced over a reasonable period of time also increases the cost and the chance of getting caught. Even better if the messages have to be spaced over time, such as at least 100 messages, but at least 1 message per day for at least 10 mail-sending days spaced over at least 30 calendar days. Requesting access also means more work.

Verifying who you are and where you live greatly increases the chance of getting caught. Spammers who engage in credit-card fraud to bypass this are now committing identity theft and financial crimes, greatly increasing the penalty if they do get caught.

In other words, measures like this and similar measures not mentioned will have a deterrent effect while having little impact on your average user. They will have some impact on people running legitimate mailing lists. The biggest impact will be on people who run large mailing lists anonymously, such as those involved in managing mailing lists for 12-step groups or political dissident groups.

you're right

[Mr 44]

http://www.schneier.com/blog/archives/2007/01/how_to_recover.html

Step X: Profit

[DrVomact]

Three bucks a captcha? Minimum? Hey, I speak English, and if I can post to /. at work, I can do captchas, and I can do 'em faster than the Russians. Let's see...I can do at least 2 captchas a minute (including breaks), so that comes out to...$360 an hour! I'm in. Someone give me the URL!

Er...that translation is really crucial. Are you sure that was a dollar sign in front of the 3? Or are they perhaps paying in Russian Roubles? That would be considerably less favorable, as the Rouble is going for 24 to the U.S. Dollar. Still...$15/hour...maybe my kid will be interested.

Re:Step X: Profit

[Kijori]

Er...that translation is really crucial. Are you sure that was a dollar sign in front of the 3? Or are they perhaps paying in Russian Roubles? That would be considerably less favorable, as the Rouble is going for 24 to the U.S. Dollar. Still...$15/hour...maybe my kid will be interested. Sorry, my translation was a bit ambiguous - although in fairness so is the Russian. My interpretation is that the minimum they will pay you is $3 - as in you can't claim your money until you've earned $3. The amount per captcha is probably almost 0.

There isn't a dollar sign before the 3 in the Russian - it's after it :D. But it's definitely dollars! You can even see it in the picture in TFA.

Re:Step X: Profit

[DrVomact]

Thanks for clearing that up. In light of the revised pricing scheme...I can make available a cat that will walk across the keyboard for a few kibbles a day 8^)

http://www.goolag.net/

[Anonymous Coward]

http://www.goolag.net/ :-)

Example of this technique in the wild

[dmarti]

I have seen and tried a "solve CAPTCHAs for porn" site. It looks broken now (stuck on the first picture), but when I first found it, via blog spam, it was working.

Potentially a problem for Google ...

[RockDoctor]

TFA includes, as one of the benefits of breaking into Google's services that "Second, Google's domains are unlikely to be blacklisted."
While that's currently true, it's not likely to remain so indefinitely. I already operate a killfile rule in my news reader to kill all messages that originate from anyone at "googlegroups.com", because they host far to many spammers and lunatics. I don't see any metapyhsical objection to blocking more Google-originated stuff.

Of course, the simplest thing for Google to do would be to stop new sign-ups. They've already got hell-knows-how-many people signed up, so losing a few hundreds of thousands more sign-ups while they get their CAPTCHA engine beefed up shouldn't be a long-term problem.

Mod parent UP, hilarious

[gr8scot]

Speaking of monkeys...

and/or mod me down, off-topic; my karma can take it.