Slashdot Mirror
CAPTCHA Busted? Company Claims To Have Broken Protection System
sciencehabit writes "A software company called Vicarious claims to have created a computer algorithm that can solve CAPTCHA with greater than 90% accuracy. If true, the advance would represent a major breakthrough in artificial intelligence. It would also mean that the internet will have to start looking for a new security system. The problem, however, is that Vicarious has provided little evidence for its claims, though some well-known scientists are behind the work."
That's better than my success rate
I cured cancer, stopped global warming, and found the last missing episodes of Doctor Who.
Just take my word for it.
In Soviet Russia, dot slashes YOU!
I wish I could get CAPTCHAs right 90% of the time.
I'm sorry, but I don't consider CAPTCHA a security system.
I would say it's an anti-spam system.
New things are always on the horizon
I just re-serve the CAPTCHAs on my own popular website. Crowdsourcing for the win.
Although "Recursive Cortical Network" sounds really cool, it would be nice to, you know, learn a bit about how it WORKS.
This headline makes no sense. CAPTCHA is just a concept, there are hundreds of implementations. I'm sure some of them are crap and only block bots that aren't even trying, some block 100% of bots (and half the humans, too), and most are somewhere in the middle. So what does it mean to "solve CAPTCHA with 90% accuracy?" Does that mean he's tested it on every system out there, and aggregated the results? That would actually be interesting if he has, but more likely he's just tested it on one kinda-crap system that I could probably write a bot in a week to do the same thing.
It does sound like it's built to be more robust, working with more different types of captchas than perhaps many captcha-busting algorithms, but I doubt it's the first of its kind (maybe it uses a new algorithm, but it's still a captcha-buster, that's not new.)
Time for the reverse CAPTCHA. If you can guess it correctly, you must be a bot.
Security to who? More like an annoyance
did you forget to take your meds?
From the video, I think they used mathematical optimization. Multiobjective vectorial optimization if I had to guess. The big breakthrough here is that instead of OCR'ing the image they tried to rerun the captcha construction algorithm controlling the random choices the algorithm makes. Each choice is a variable here. Them you implement a function that measures how close this variables get to the CAPTCHA image. Now you use optimization to get to the global minimum of this function.
At least that is how I would have done it.
[imagine this as a captcha graphic]
Spell last month.
Or this:
[image]
Type the one that flies:
England Turkey Russia
Or this:
[image]
Type the word for
2 + number of days in a week
Or just to confuse things, split the "challenge" into code + html:
[image]
2 + number of days in a week
[html] What is the number above minus 4, as a word: ___
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
The summary suggests this marks an advancement in AI, but it depends on what AI means. There are generally two areas of AI: 1) artificial "thinking" , and 2) Using advanced algorithms to get things done. Most people think about #1 when you say AI, however solving captcha is just an example of #2. I would argue that #2 really isn't "AI" at all. In fact, all advancements in "AI" are of type #2. Attempts at #1, thus far, have been absolute failures.
I sort of hope that the CAPTCHA-busting code is just vapor, and it doesn't get released.
If it does come out and get into widespread use, what will likely result are websites likely going another step up the chain and doing more annoying stuff such as requiring access through Facebook, demanding a phone number for SMS authentication (of course, said number ends up getting sold to robodialers), or more intrusive means.
I see some CAPTCHA replacement schemes like counting how many cat butts are facing a person in a row of six photos and inputting the number, but those seem at best a stopgap measure, and block out access to the site to the blind.
Obligatory
Another researcher had a program that solved captchas with better accuracy years ago. He didn't release it "for the common good".
Snort. Captcha isn't a security system, it's an anti-spam system which helps slow down bots. You can achieve the same effect with a simple timer.
Captcha has been busted for years, all you have to do is have your bot grab the captcha image, and present it to a real human on a different site. Porn places are traditionally the most common, you can have an army of people breaking captcha without even realizing they're doing it.
The only thing Captcha has really been doing is making it nearly impossible for colorblind people to access your site.
I wonder if the turning test is: does the subject attempt to solve something too obscure or does in spin for another puzzle. Failing on the poorly made ones instead of rejecting them and going on to the next might show which is a human and which is a machine.
More likely, link and it still did not happen ^_^
Does Download.com have it yet? I need a program like this to help me figure those freaky, wormy wordnumbers out.
If you read Black Hat World, you find that CAPTCHAs are a solved problem for spammers and fake account creators. The better systems run them through several OCR programs in parallel. That knocks off about 67% of them. There's a lot of special casing involved, but from the spammer's viewpoint, this is a solved problem. Getting from 67% to 90% would be convenient, but humans aren't at 90%. If all the OCR programs give up, the problem is sent to an outsourced service where low-wage people solve CAPTCHAs all day.
The Black Hat forum system itself makes users play and win a short video game to lock out 'bots.
First reliable text recognition software developed!
http://xkcd.com/810/
If you found the article worthless, you pass. If you found the dancing letters in the video entertaining, you also pass.
That's happened several times. It's an arms race... the current CAPTCHAs you see where there's 2 images to solve, one of which is essentially OCR and the other is an actual scrambled CAPTCHA, is a direct response to the previous versions being solved.
Guardian article from 2008 called 'Captcha is broken, now what?', which in turn references a Captcha-breaking algorithm that was created in 2005, "and demonstrated it by posting automated comments to nearly 100 blogs to demonstrate their vulnerability."
http://www.theguardian.com/technology/2008/aug/28/internet.captcha
Palaces, barricades, threats, meet promises
Alternately... use the alternative audio and run speech recognition on it to solve the captcha.
No one thinks outside the box any more...
Was it batman?
If you have 10000 computers trying to hack accounts into 600000 sites, the timers will do nothing. Each computer will make one attempt on each server once every 10 minutes. But the computers as a group will be making 166 attempts per second on each server.
Most captchas were cracked 17 months ago.
It's time for something that's easier for humans and harder for computers. For example, these images have been tweaked such that the standard routines don't work:
https://bettercgi.com/sb5/
There's a new system on the way called BORE - Back Orifice Recognition Engine. They claim no two are alike. A seat is included with the system.
Eternity: will that be smoking, or non-smoking? I Corinthians 6:9-10
Spammers, and bots seem to have broken it sometime ago, is this something new?
I don't understand that comic, if users are viewing and being asked to rate the spam posts isn't it mission accomplished for the spammers?
Sig is for Signature, so you don't have to manually sign every post.
If you think about it.. what we are asking is... show us something you can do that a computer cant do..through a computer. Mildly mind boggling logic puzzle there.
Back in 2008 this apparently happened many times. I only recalled the one.
Support my political activism on Patreon.
Recaptcha from google has been broken for awhile. I had it implemented on my site and got about a dozen spam sign-ups a day.
The moment I switched to a local "mycaptcha", which should have been easier to OCR, they stopped dead.
If by "mission accomplished" you mean that the spammer gets his post through - yes. However, it's hard to monetize that success when the requirement for said message getting through is that it's usefully informative or otherwise helpful to the human readers of the forum.
Ultimately, if such a thing happens (I personally foresee anti-CAPTCHA technology evolving into the first proper AI somehow), it will be more of a win for the human users than the spammers. Signal:Noise ratio is the main problem holding back those online communities as far as I can tell. Hell, maybe an artificial spam-intelligence will help us the way targeted advertising was *supposed* to do, and ad moguls still claim it does.
How's this for a new business model: become a useful member of society by providing useful information in accessible places, and then using your new-found credibility to push services that make you money. Sounds a lot like celebrity endorsement, maybe, but perhaps there's a whole market for "computer problem" experts, or "aftermarket automotive modifications" experts, or other niche knowledge bases. Turn your weird passions into cash! OK advertisers, you want a place at the table in whatever form Web 3.0 takes, get on it.
Goddammit just when I get my first +5 the Beta rolls out and kills everything