Slashdot Mirror
Audio CAPTCHAs Cracked; ReCAPTCHA Remains Strong
Falkkin writes "Ars Technica reports that audio CAPTCHAs consisting of only distorted digits or letters can be easy to crack using machine learning techniques. This includes most of the audio CAPTCHAs currently in use on the Web. The reCAPTCHA team has discussed their new audio CAPTCHA, which is resistant to this attack."
It was okay at first, but now it's reached the point where it takes me 3 or 4 tries to finally guess the letters.
It's become more hassle than it's worth. Isn't there a better way to stop bots from getting accounts?
FOX NEWS.com should be BANNED from television and internet. Have the Congress take it over and give us Truespeak.
If you can make it to a longer time for a human to crack it, it would increase the costs. Double the time, double the cost.
But, say, if it now takes 10 seconds to crack a captcha, it would need to take more than an hour to cost $1 per captcha :-).
I wonder how a web-of-trust system combined with more difficult captchas (more trust -> easier captchas) would work; if a branch of the web is a spammer, it's easier to cut off.. But, this must've been suggested even in this context already, so hit me with the "your spam protection idea doesn't work, because.." form ;-).
i thought RECAPATCHA was susceptible, as if enough bots guess the same answer on an image they will make that a valid answer. Does this not work or has nobody bothered?
IranAir Flight 655 never forget!
Only until someone finds a way to make cracking the captcha more efficient and suddenly it is back to the original cost to crack the same captcha again. This is what that machine learning is all about.
Meanwhile, the problem is that this back and forth with captchas is essentially causing programmers who wish to break it, to come up with very complex AI.
At some point, if the AI is smarter than the person, as mentioned above people won't be able to crack the captcha.
On this very article the only reason this "captcha has yet to be cracked" is because they just brought it out. Once it gets attention, it'll be cracked like all the rest.
One thing we could do more of(though it is not without risks of its own) would be looking at getting the account as only the first step, rather than the last. For instance, some free webmail service could rate limit new accounts to only X emails/hour, or change an account's rate limit according to how spammy its outgoing messages look(or, within a given service, how often other members mark that account's mail as spam). On forums, you could do the same in response to other user's moderation of posts.
This would work relatively poorly for high value things like bank accounts (though high value stuff can be handled by more expensive means, like phone confirmation) but it could be quite useful for low value things like webmail accounts. The task of sorting humans from bots on a single computer generated task is getting ever harder, particularly if you need to make a binary yes/no decision on the spot; but giving an account greater or lesser resources according to how human its activity looks is much more tractable. It won't be perfect; but it should reduce the value to spammers of the accounts they do get.
And if the posts were held before becoming visible, there wouldn't even have been one.
The community your are a member of seems to be near this level of completeness.
Having a few trusted reviewers who read all posts before letting them pass would be the last step.
People often complain about schemes like this that their messages need to be seen immediately so people can respond immediately but I say having two or three moderators would make the whole process pretty quickly anyway.
Remember when you used to mail things? THAT took time and the world STILL progressed.
I don't know the meaning of the word 'don't' - J
Captcha is really security by obscurity. Readily identifiable information is obscured in such a way as the computers (supposedly) can't find it.
Real security requires a secret. It's as simple as that. So long as the secret can be identified without knowing the secret, your security system is a joke.
Computers are getting better, faster, smarter, cheaper. Moore's wall gets higher every single year, and soon, it will be routine for computers to match or exceed human intelligence. (It can be argued that they already do, particularly in the case of a certain US President)
Therefore, anything that relies on human intelligence to "weed out" machine intelligence will eventually fail. Captcha is the testing ground for the passing of the Turing Test!
I have no problem with your religion until you decide it's reason to deprive others of the truth.