Slashdot Mirror
Google ReCAPTCHA Cracked
stormdesign writes "Despite denials from Google, a security researcher continues to assert that the Search King's reCAPTCHA system for protecting Web sites from spammers can be successfully exploited by Internet junk mail panderers."
so hard that not even your users will be able to 'crack' it and login to your store. no, its really good. and doesnt need remote services. (like recaptcha)
Read radical news here
that website administrators will have to actually verify user accounts?? Might mean more work for admins but isn't that a fair trade off for quality content?
The Copper Tribe - Office Software Solutions
Come on Google, we all know that in the Capcha war, we only have one weapon left, capcha porn. There isn't a spambot alive who could answer "In the above movie, how many cocks were inside Jenna Jameson?" or "what sex position is this?"
Monstar L
In capitals, like this?
Did they pull the crown from the hands of the Pope, himself at the coronation ceremony, and declare - as did Napoleon - "I am King!"
"Flyin' in just a sweet place,
Never been known to fail..."
I seem to recall somebody posting a video showing reCAPTHCA-cracking with something like 30% accuracy. That's very broken.
FTA:
Researcher Jonathan Wilkins published a paper recently that included an analysis of reCAPTCHA’s security. In automated attacks he conducted against the system, he reported he had an alarming success rate of 17.5 percent.
Well, last year someone showed ad DEFCON that he could solve the reCAPTCHA CAPTCHAs with an efficacy of 30% already.
So how is this news? Am I missing something?
...last year.
Google reCAPTCHA cracked
Written by John P Mello Jr on January 5, 2010
As much as it's nice to know reCAPTCHA is working towards a good cause (digitising old books, if you live under a rock or something), the amount of times I've got incomprehensible jibberish from it makes me rather unsympathetic towards their cause. It'd be nice to think there was some better way of keeping spam out, but I guess developer laziness and Google's endless crusade to rule the Internet we'll be stuck trying to decipher nonsense from the 1900s for a good while yet.
Granted this is still in research, and it is an "M$" project at the moment, but using animals for a captcha may be the next thing.
http://research.microsoft.com/en-us/um/redmond/projects/asirra/
That would explain why my recaptcha protected forum suddenly started getting 30+ new accounts a day.
Regards
elFarto
... we get the flurry of Wordpress spam registrations and a spike in Gmail related spam?
ticketswapz.com - Buy, Sell, Trade Sporting Event and Concert Tickets
Please Identify which animal is a Eierlegende Wollmilchsau.
Yesterday I decided to sign up for World of Tanks open beta. It took me 12 tries (including 3 failed sound ones) to fill reCAPTCHA correctly. Most of the time it just displays nonsense.
Who logs in to gdm? Not I, said the duck.
Too bad really, I like the google captchas because they were easy to read (and served a greater purpose with the book scanning). honestly I wish they would make some of these things harder though. how often do you really need to make an email account? I've done it just a couple times with google and wouldn't be bothered by a more complex captcha system. i suspect they don't do this because they wouldn't want people to get frustrated and go to hotmail instead because the captcha was too hard.
though in the end you can never really win since the most high profile targets will just get focus from actual humans
on a side note i wish the article had more details on how he was cracking. I suspect most slashdotters like myself have pondered captcha systems and how to improve them.
http://www.networkmirror.com/mlsurCyIbkJu5Qpr/www.allspammedup.com/2010/01/google-recaptcha-cracked/index.html
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
This approach is doomed, really. Clearly we can come up with other tasks that are difficult for computers and easy for humans, and wait until AI catches up, and move to something else. At some point much sooner than AI fully replicates human intelligence the tasks will be so difficult that in the vast majority of cases it's not just worth it for a human to go through it (e.g. # of cocks inside Jenna in a video , as suggested above). What do we do then? The captcha approach is a temporary solution, and if I had to guess I'd say within 2 decades the "spammer singularity" described above will come.
weinersmith
I run a small forum that uses recaptcha . I used to get about 5-10 spam registrations a day. On the 6th I got 148, and the 7th I got 230.
I eventually instaled a plugin from StopForumSpam.com which is a combination blacklist/keyword checker to help weed out spammers and it's back to normal, or even below normal levels.
Now spammers are indirectly using their massive botnets for the cause of OCR conversion of books. :)
This is teh intarwebs(tm), pr0n == free , unless you're doing it wrong.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
To figure out how to do it. Ironic, no?
successfully exploited by Internet junk mail panderers
How does one pander to junk mail?
Perhaps the word you were looking for is peddlers?
https://www.eff.org/https-everywhere
I used reCAPTCHA on a small phpBB board. Because of the small number of users, I activate any accounts manually, However, since the first of the year I must have gotten 40 attempted registrations. Very annoying, because I got an e-mail for each of them. Switched to a question that only someone familiar with my board would be familiar with, seems to have stopped that stuff.
Seriously, why not something like google goggles for tax forms? Or is that out there already and I'm just not looking hard enough?
"Quote me as saying I was mis-quoted." -Groucho Marx
I use a script for emailing the addresses of my clients and the script is server-side code. And since that does not load unless the form (for an email) is completely filled out, nobody can pre-look at my code and figure out anything.
Client's email address is in a lookup in an SQL database, so nobody can see that, either.
Solution is to capture then BLOCK the IP address of anyone sending spam through the form. So far, I have seen two messages from Belize and one from India. And now those people can no longer even load the websites they spammed. As their world gets smaller and smaller, maybe they will have so few people to email, they'll quit.
This may not work for someone as big as Google, but it certainly works for me and my website clients.
Gods don't kill people, people with gods kill people.
The nature of Spam is changing. It used to be about penis pill ads being sent indiscriminately by email. Now Spam is being used by major marketers and public relations firms to influence the national discourse and nobody is using email. Spammers are hitting blogs and forums and news sites to try to credibly sway public opinion. They pose as average impartial citizens and try to spread propaganda. Spam is about trying to shout out other people by aggressively inserting the viewpoints of their corporate or political masters. Every major PR firm is going to recommend that it's clients pursue an active online strategy. Not just a website. Not just a responsive blog. Not just a Facebook page. But an army of professional trolls with talking points and corporate directions to sway public opinion in a Web 2.0 setting. Spam has gotten much more insidious because the purveyors of Spam realize that to be effective they must effectively make themselves indistinguishable from the common man.
Digg recently had to reorganize because an army of amateur conservative trolls ("Digg Patriots" and others) was effectively promoting conservative information and burying liberal viewpoints. They got busted because they were ambitious and cocky amateurs. But Burson Marsteller has about 100000000x the money and sophistication and is never going to get caught so easily.
There's a war out there, old friend. A world war. And it's not about who's got the most bullets. It's about who controls the information. What we see and hear, how we work, what we think... it's all about the information!
Speaking of a spam dry spell, my mail's spam is down dramatically since the new year.
I haven't parsed logs to find out of my antispam measures are more effective or if the total rate is just down. Anyone else noticing similar?
Not only should the captcha be an image or an audio file but it should also be a question. Then the response shouldn't be just the text version of the question but the text answer to the question. I suggest the questions on the Mensa test.... although that may be setting the bar a little low for Internet use.
Google can deny it all they want. Everyone running a decent-sized forum with reCAPTCHA noticed spammers getting their bogus registrations through on January 4th. One day it was working great, the next day spam.
And I don't like spam.
reCAPTCHA is broken. Period.
People who say "sheeple" have about as much sophistication as an AOL user, and in fact are probably actually AOL users.
I don't; I was just refuting the statement that there is no way to verify user accounts before the user has posted anything. For a local population that can be handled by moderator(s) familiar with the region, that's sufficient. For a larger scale operation where the moderators are not necessarily in the same locality as the users, you would need to use some other method. Maybe ask the visitor to tell you how he feels about his mother?