CAPTCHA Busted? Company Claims To Have Broken Protection System

sciencehabit writes "A software company called Vicarious claims to have created a computer algorithm that can solve CAPTCHA with greater than 90% accuracy. If true, the advance would represent a major breakthrough in artificial intelligence. It would also mean that the internet will have to start looking for a new security system. The problem, however, is that Vicarious has provided little evidence for its claims, though some well-known scientists are behind the work."

Comments

90%

[WillgasM]

That's better than my success rate

Re:90%

[hobarrera]

And that's their undoing.
Show the user 10 captchas:
If none match -> It's an old bot
If some match -> It's human
It over 90% match -> It's this new algorithm.

There, solved!

Re:90%

[nospam007]

"That's better than my success rate"

Same here, but some overdo it with the use. My phone company uses it on the payment page where you have to enter the invoice number and credit card.

Are they afraid some bot would pay my bills?

Re:90%

[kav2k]

More like: if solving is not attempted, it's human.

Re:90%

[heypete]

They probably are worried about bad guys using the payment system in an attempt to verify stolen credit cards by making seemingly-routine purchases that would not seem out of the ordinary and thus would not trip anti-fraud measures.

A small company I used to work for was abused by credit card thieves in this way, and dealing with the fraudulent charges and the resulting chargeback fees was the top non-salary cost for a few months (exceeding even the colocation costs). The problem existed because they allowed users to create either a free or paid account for the service and, if they selected the paid account, they could enter the card information on the sign-up page. Later, they changed it so users would need to create a free account (which required a captcha) and then upgrade it to a paid account in the account settings. Fraudulent charges dropped to essentially nil after that.

If the phone company requires only the invoice number and credit card data to pay a bill (rather than having you create an account, log in, and then pay the bill) then it's likely they're dealing with a similar problem.

Re:90%

[jythie]

And thus began the arms race where eventually the only way to use the internet requires buying an up to date bot plugin for your browser... ^_^

In other news...

[Cyfun]

I cured cancer, stopped global warming, and found the last missing episodes of Doctor Who.

Just take my word for it.

Re: In other news...

[jd2112]

I'll take your word for most of those but I need video proof of the lost Dr .Who episodes.

Better than humans

[Manfre]

I wish I could get CAPTCHAs right 90% of the time.

Re:Better than humans

[meerling]

Agreed. Heck, even those spammers that for years have been collecting databases of solved captchas for their bots do much better at those damn things than I do.
And what really pisses me off is when you get a captcha wrong, either through incorrect entry or because it's decided you took to long, and the damn thing wipes out all the fields forcing you to redo the entire page! Those sites I truly despise I hope their programmers/scripters get a horrible infestation of something nasty.

Re:Better than humans

[doublebackslash]

That is really lazy work on the programmers part. It is trivial to use AJAX to submit the form and selectively wipe the captcha field whist refreshing the captcha. Thats what I do when we require a captcha for one reason or another.

Re:Better than humans

[alexgieg]

And what really pisses me off is when you get a captcha wrong, either through incorrect entry or because it's decided you took to long, and the damn thing wipes out all the fields forcing you to redo the entire page!

If there's a button to refresh the captcha I click it once to see what happens. If it reloads only the captcha then I take my time filling the form and when I'm finished click it once again, fill the captcha and submit. If however clicking the captcha reload button reloads the entire page, then notepad, reload page, copy-paste, submit it is.

These two "algorithms" have allowed me to experience much less pain and frustration than I otherwise would have had.

New security system ?

[Lennie]

I'm sorry, but I don't consider CAPTCHA a security system.

I would say it's an anti-spam system.

I broke it a long time ago

[key45]

I just re-serve the CAPTCHAs on my own popular website. Crowdsourcing for the win.

CAPTCHA isn't one system...

[neminem]

This headline makes no sense. CAPTCHA is just a concept, there are hundreds of implementations. I'm sure some of them are crap and only block bots that aren't even trying, some block 100% of bots (and half the humans, too), and most are somewhere in the middle. So what does it mean to "solve CAPTCHA with 90% accuracy?" Does that mean he's tested it on every system out there, and aggregated the results? That would actually be interesting if he has, but more likely he's just tested it on one kinda-crap system that I could probably write a bot in a week to do the same thing.

It does sound like it's built to be more robust, working with more different types of captchas than perhaps many captcha-busting algorithms, but I doubt it's the first of its kind (maybe it uses a new algorithm, but it's still a captcha-buster, that's not new.)

Reverse CAPTCHA

[Anonymous Coward]

Time for the reverse CAPTCHA. If you can guess it correctly, you must be a bot.

Re:Captcha is a security system?

[slim]

Security is often annoying. Entering passwords is annoying. Getting RSA keyfobs out of your pocket is annoying.

When it's used to protect against brute force password attacks, a captcha is definitely a security mechanism.

When it's used to discourage spam, well, it's on the edge of the fuzzy area most people understand by "security". It's protecting the availability of a service, against the threat of spam making it unusable.

Semantic capthas?

[davidwr]

[imagine this as a captcha graphic]
Spell last month.

Or this:
[image]
Type the one that flies:
England Turkey Russia

Or this:
[image]
Type the word for
2 + number of days in a week

Or just to confuse things, split the "challenge" into code + html:
[image]
2 + number of days in a week
[html] What is the number above minus 4, as a word: ___

Re:Semantic capthas?

[Anonymous Coward]

Or this:
[image]
Type the one that flies:
England Turkey Russia

"As God as my witness, I thought turkeys could fly"

This does not mean advancements in AI

[Anonymous Coward]

The summary suggests this marks an advancement in AI, but it depends on what AI means. There are generally two areas of AI: 1) artificial "thinking" , and 2) Using advanced algorithms to get things done. Most people think about #1 when you say AI, however solving captcha is just an example of #2. I would argue that #2 really isn't "AI" at all. In fact, all advancements in "AI" are of type #2. Attempts at #1, thus far, have been absolute failures.

Re:Wish there was some more information

[marcello_dl]

> Although "Recursive Cortical Network" sounds really cool, it would be nice to, you know, learn a bit about how it WORKS.

It works just like the "Recursive Cortical Network", look it up.