Slashdot Mirror
CAPTCHA Busted? Company Claims To Have Broken Protection System
sciencehabit writes "A software company called Vicarious claims to have created a computer algorithm that can solve CAPTCHA with greater than 90% accuracy. If true, the advance would represent a major breakthrough in artificial intelligence. It would also mean that the internet will have to start looking for a new security system. The problem, however, is that Vicarious has provided little evidence for its claims, though some well-known scientists are behind the work."
That's better than my success rate
I cured cancer, stopped global warming, and found the last missing episodes of Doctor Who.
Just take my word for it.
In Soviet Russia, dot slashes YOU!
I wish I could get CAPTCHAs right 90% of the time.
I'm sorry, but I don't consider CAPTCHA a security system.
I would say it's an anti-spam system.
New things are always on the horizon
I just re-serve the CAPTCHAs on my own popular website. Crowdsourcing for the win.
This headline makes no sense. CAPTCHA is just a concept, there are hundreds of implementations. I'm sure some of them are crap and only block bots that aren't even trying, some block 100% of bots (and half the humans, too), and most are somewhere in the middle. So what does it mean to "solve CAPTCHA with 90% accuracy?" Does that mean he's tested it on every system out there, and aggregated the results? That would actually be interesting if he has, but more likely he's just tested it on one kinda-crap system that I could probably write a bot in a week to do the same thing.
It does sound like it's built to be more robust, working with more different types of captchas than perhaps many captcha-busting algorithms, but I doubt it's the first of its kind (maybe it uses a new algorithm, but it's still a captcha-buster, that's not new.)
Time for the reverse CAPTCHA. If you can guess it correctly, you must be a bot.
From the video, I think they used mathematical optimization. Multiobjective vectorial optimization if I had to guess. The big breakthrough here is that instead of OCR'ing the image they tried to rerun the captcha construction algorithm controlling the random choices the algorithm makes. Each choice is a variable here. Them you implement a function that measures how close this variables get to the CAPTCHA image. Now you use optimization to get to the global minimum of this function.
At least that is how I would have done it.
Security is often annoying. Entering passwords is annoying. Getting RSA keyfobs out of your pocket is annoying.
When it's used to protect against brute force password attacks, a captcha is definitely a security mechanism.
When it's used to discourage spam, well, it's on the edge of the fuzzy area most people understand by "security". It's protecting the availability of a service, against the threat of spam making it unusable.
[imagine this as a captcha graphic]
Spell last month.
Or this:
[image]
Type the one that flies:
England Turkey Russia
Or this:
[image]
Type the word for
2 + number of days in a week
Or just to confuse things, split the "challenge" into code + html:
[image]
2 + number of days in a week
[html] What is the number above minus 4, as a word: ___
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
The summary suggests this marks an advancement in AI, but it depends on what AI means. There are generally two areas of AI: 1) artificial "thinking" , and 2) Using advanced algorithms to get things done. Most people think about #1 when you say AI, however solving captcha is just an example of #2. I would argue that #2 really isn't "AI" at all. In fact, all advancements in "AI" are of type #2. Attempts at #1, thus far, have been absolute failures.
I sort of hope that the CAPTCHA-busting code is just vapor, and it doesn't get released.
If it does come out and get into widespread use, what will likely result are websites likely going another step up the chain and doing more annoying stuff such as requiring access through Facebook, demanding a phone number for SMS authentication (of course, said number ends up getting sold to robodialers), or more intrusive means.
I see some CAPTCHA replacement schemes like counting how many cat butts are facing a person in a row of six photos and inputting the number, but those seem at best a stopgap measure, and block out access to the site to the blind.
Obligatory
> Although "Recursive Cortical Network" sounds really cool, it would be nice to, you know, learn a bit about how it WORKS.
It works just like the "Recursive Cortical Network", look it up.
---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
If you read Black Hat World, you find that CAPTCHAs are a solved problem for spammers and fake account creators. The better systems run them through several OCR programs in parallel. That knocks off about 67% of them. There's a lot of special casing involved, but from the spammer's viewpoint, this is a solved problem. Getting from 67% to 90% would be convenient, but humans aren't at 90%. If all the OCR programs give up, the problem is sent to an outsourced service where low-wage people solve CAPTCHAs all day.
The Black Hat forum system itself makes users play and win a short video game to lock out 'bots.
First reliable text recognition software developed!
http://xkcd.com/810/
Alternately... use the alternative audio and run speech recognition on it to solve the captcha.
No one thinks outside the box any more...