Slashdot Mirror
Audio CAPTCHAs Cracked; ReCAPTCHA Remains Strong
Falkkin writes "Ars Technica reports that audio CAPTCHAs consisting of only distorted digits or letters can be easy to crack using machine learning techniques. This includes most of the audio CAPTCHAs currently in use on the Web. The reCAPTCHA team has discussed their new audio CAPTCHA, which is resistant to this attack."
It was okay at first, but now it's reached the point where it takes me 3 or 4 tries to finally guess the letters.
It's become more hassle than it's worth. Isn't there a better way to stop bots from getting accounts?
FOX NEWS.com should be BANNED from television and internet. Have the Congress take it over and give us Truespeak.
I'm half afraid to admit this publicly, but did anyone else try clicking the "play" button on screenshot of the audio CAPTCHA player in the first article? I took me a few tries before I realized it was only an image.
Better known as 318230.
A CAPTCHA is only worth $.0025 to break down on the Chinese Turing farms. Thus since a CAPTCHA can only protect something worth $.0025 anyway, making it more crack resistant doesn't buy all that much.
Test your net with Netalyzr
I'm a human being and I can't break audio captcha. Sounds like gibberish to me.
Why does anyone bother using captcha, or asking silly questions, or any of that anymore? Computers are better at it than people. Give it up, and just start banning hosts until something better comes up.
Whale
i thought RECAPATCHA was susceptible, as if enough bots guess the same answer on an image they will make that a valid answer. Does this not work or has nobody bothered?
IranAir Flight 655 never forget!
In my crystal ball I see some fool who does not turn off the sound on the PC in an office. Unfortunately, history has shown that many people also still have digital camera's that make the *click* noise, so I have no hope that this will not disturb the peace.
They should just make a CAPTCHA that requires strong AI to crack; we could make a great leap ahead in AI by letting the spammers solve all the problems for us!
Why don't they use DHTML and JavaScript to simulate the 3 cups and 1 ball game? You'd start off with the ball in the middle cup and then it could mix the cups up and you have to pick the right cup. Audio would be supported too:
"Keep your eye on the ball! Follow it! Don't watch the other cups, just the one with the ball in it!"
Summation 2
Isn't this just an advertisement for ReCAPTCHA disguised as a news item?
People crack CAPTCHAs for profit. They either sell the algorithms to spammers or spam themselves.
The thing is, if you managed to reliably crack RECAPTCHA, then you've succeeded where all the best OCR software on the market has failed (All Recaptcha's are words that couldn't be deciphered by existing software). At which point there's big bucks to be made legally selling the software.
You feel sleepy. Close your eyes. The opinions stated above are yours. You cannot imagine why you ever felt otherwise.
I just tried on the recaptcha site and got about a dozen WRONG. I didn't get any right! What gives?
I tried 5 times in a row and I can't figure out any of the audio CAPTCHA's from the ReCAPTCHA site either.
So, "machine learning" can now translate any speech in any language to text. Where's my universal translator then?
In my crystal ball I see some fool who does not turn off the sound on the PC in an office.
By law, offices of companies over a certain size must accommodate people whose disability requires sound to do their jobs.
Unfortunately, history has shown that many people also still have digital camera's that make the *click* noise
By law, camera phones must make the click noise when operated within some countries to help fight voyeurism.
Why not have them ask questions like "what is three plus 4 times twelve - 7?" or what have you, if the ai can crack those we'll have made a lot of progress.
Captchas are user unfriendly and relatively ineffective.
A more effective route is to require a new user to submit their postal address and a phone number. Then the service mails a post card containing a verification code to the postal address and/or calls the phone number. Google does this for AdSense publishers.
Ron
Instead of having to repeat what is on your screen or speakers, you could ask the user a simple question to verify if the user is indeed human. You could for example ask the color of something, or ask for the user to do a simple calculation and post the results. You could also give four objects and ask which one doesn't belong with the other three.
This would mean that a bot would have to understand the question in order to give the right answer, which is a lot harder to achieve than simply repeating what is displayed.
And as an extra added bonus, if these type of CAPTCHAs are also cracked, then at least we'll have some major breakthrough in AI development.
Pretty good is actually pretty bad.
I know it is a lot but you would need a valid e-mail to post, and administrator would need to follow up with you to OK your account, your registration e-mail would actually have to contain the actual reason of why you want to post, all posts would have to be moderated/verified before they became visible, ex...
I can hear you all protesting already: But what about anonymity, what about ease-of-use?
Yes, yes... But it IS the only way.
It's a price I'd be willing to pay to end the spam because as we have seen, most users are unable to keep their machines disinfected.
I don't know the meaning of the word 'don't' - J
They should just make a CAPTCHA that requires strong AI to crack
The impression I got from this Technology Review article is that your CAPTCHA will eventually happen. But a business using one of these might eventually run into a disability discrimination problem if the system confuses real people of below-average intelligence with bots.
Keeping people of below-average intelligence off of my website? That doesn't sound like discrimination, that sounds like reduced costs and maintenance in tech support.
It's also reduced costs and maintenance not to repair your wheelchair ramp. As I wrote in my other post, one can be a genius at one subject but (to put it mildly) less than a genius at another; your CAPTCHA has to measure competence in the subject at hand. For example, how many people not immersed in African-American culture could pass BITCH-100?
If this keeps up, then spammers will be the first 'people' to develop a Turing-test capable AI :/
If spammers are so good at subverting systems meant to prove humaneness(i.e. problems that are easy for the human mind but hard for computers), why not use this for some societal advantage... build complex problems from programing and cognitive-science into puzzle problems, wait for the spammers to work it out, and then buy (or better yet, just take) their methods from them. Visual recognition of objects, faces, labeling of sounds, identifying objects, etc. etc. etc.
They never required that for me when I signed up for AdSense. Maybe it only applies to certain countries...
Captcha is really security by obscurity. Readily identifiable information is obscured in such a way as the computers (supposedly) can't find it.
Real security requires a secret. It's as simple as that. So long as the secret can be identified without knowing the secret, your security system is a joke.
Computers are getting better, faster, smarter, cheaper. Moore's wall gets higher every single year, and soon, it will be routine for computers to match or exceed human intelligence. (It can be argued that they already do, particularly in the case of a certain US President)
Therefore, anything that relies on human intelligence to "weed out" machine intelligence will eventually fail. Captcha is the testing ground for the passing of the Turing Test!
I have no problem with your religion until you decide it's reason to deprive others of the truth.
Sometimes I am pretty sure I gave the right answer to a Captcha but it is wrong. I wonder if sometimes the Captcha sender deliberately does this to make it harder for a computer program learning how to crack them. Say two out three times it rejects the right answer.
So does this mean a CAPTCHAs is the opposite of a Turing Test?
This is very secure. If you don't want anyone (...anyone at all...) to come to your site, I recommend it highly.
Seriously - thanks for trying, but move on to the next idea please.
I actually have a customer who wants captcha on their website but is moaning it is too hard to read the words. They want something that is just as hard for a bot to break but easy for a person.
I don't know what website you're developing, but if it's custom-built without common packages, it'll be safe from bots. The bot programmers code for the most widespread web packages because there's more for their code to exploit. It's not so lucrative to invest coding a one-off bot for a single website.
So, if you're not running a common forum package, photo gallery, etc. It's highly unlikely a bot writer will hit your client's site. Even so, simply altering the paths for login pages can derail a bot to the point that it's not worth the time of the coder to customize the bot on a daily basis to hit the site.
You might then offer a money-back guarantee to your client should spam show up on the site.
Seth
$5 / month hosted VPS on linux = awesome!
The Computer Scientist within me loves the idea as it improvement in Artificial Intelligence and OCR.
The Consumer Side of me hates the fact that spammers use this technology to make our lives hell.
My solution would be an electrical implant for every 10 byes of data sent per second you get 1 volt electric shock. If the spammers write these scripts to send all this data immediate punishment for their action. Just a few details need to be worked out, like uploading pictures to your friends or worse a linux iso via bitturrent could be hazardous.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
What if the applicant for access submits a facial photograph along with his/her application information?
(1) Use facial recognition software to decide whether a human picture has been submitted. Deny access to those not submitting a picture of a human. Store the picture. Keep refining the algorithm.
(2) Determine whether the pictured person has been used in a previous attempt to obtain access. If access has been obtained, don't let them create another account unless their present account is terminated. If access has been rejected, then you have a presumptively bad applicant.
(3) Websites could share database information about the rejected pictured-people. This would bring in more data (like time and volume of a single facial picture's use, for example). That additional information could be used to help refine the algorithm.
How about reputation? Akismet is pretty good, so how about extending that a little bit?
If blogs or other sites want to cut down on automated submissions, they demand OpenID accounts. Then, hook those logins into an RBL like Akismet. If the account submits spam on one site, the account is marked as as spammer and all other sites get the opportunity to block it. Most would probably work on a threshold and points system a bit like SpamAssassin incorporating self-training Bayesian filters or heuristics: normal humans don't submit more than about 20 blog comments a day, etc.
How to make sure spammers don't simply sign up for lots of OpenID accounts to send spam? Make getting an OpenID account hard for them: use one of the many other systems suggested in this thread, like offline confirmation, etc. Legitimate users are not going to mind having to wait for an SMS message with a confirmation ID, or a postcard though the post, etc. Sites like Facebook becoming OpenID providers would help with this too: existing users would have existing reputations they could use on other sites when posting or signing up for services.
Sure - another step in the arms race, but it wouldn't do any harm for netizens to take on some reputation (for which read "responsibility") for their actions.
"And the meaning of words; when they cease to function; when will it start worrying you?"
So far CAPTCHAs are being defeated by bot's Artificial Intelligence. Why not change target to the other direction, and go in the search of human's Natural Stupidity? We humans have a talent in that area that still wasnt surpassed by dumb machines
They only managed 70% on the Digg CAPTCHA? C'mon guys, that ones really easy! I know you can do better than that.
Just to get you started, here's a small Cython extension that breaks Digg with way over 90% accuracy:
Break Digg Captchas quickly.
Actually CAPTCHA can be a little bit intelligent than basically being cryptic. For example: CAPTCHA says 2+3 Answer is 5 It is harder for bots and easier on humans.
Did it ever occur to anyone that maybe bots like to participate on forums? I'm pretty sure I was in a flame war with one once. Seriously though, it's an arms race as previously mentioned. Someone builds a better CAPTCHA, someone else cracks it. The alternatives are a little 'Big Brother' in their implementation... maybe when IPv6 really kicks in and we can all be assigned an individual IP?
Another effort at getting humans to transcribe snippets of audio (via a game) is Audio Puzzler. It's somewhat similar in spirit to the audio reCAPTCHAs, but actually forms a puzzle game where you have to connect the snippets of transcribed audio to complete the puzzle. This also makes it somewhat easier since you have some context for understanding the spoken words. The problem with the audio reCAPTCHA system now is that words may be truncated and with a lack of context it's difficult to understand partial words or proper nouns. They are HARD to solve (even for humans).
Something is needed to make it more difficult for bots/scripts/etc to register/submit/etc at various sites online but CAPTCHAs have gotten to the point where they are more trouble than they're worth.
It's gotten to the point where it usually takes multiple attempts to get it right and I'm personally sick of it. I'm tired of having to waste my time and it's now at the point where I would rather take my business elsewhere than deal with having to guess a random string of indecipherable letters and numbers.
Will audio solutions help? Not in my case - I refuse to play that gibberish. Not for people with a hearing disability - they can't hear it! Not for people without working PC audio - there are a lot more of them out there than you would think.
There's a better solution. Find it and stop driving people away from your sites with this crap.