CAPTCHA Busted? Company Claims To Have Broken Protection System

sciencehabit writes "A software company called Vicarious claims to have created a computer algorithm that can solve CAPTCHA with greater than 90% accuracy. If true, the advance would represent a major breakthrough in artificial intelligence. It would also mean that the internet will have to start looking for a new security system. The problem, however, is that Vicarious has provided little evidence for its claims, though some well-known scientists are behind the work."

Comments

90%

[WillgasM]

That's better than my success rate

Re:90%

[hobarrera]

And that's their undoing.
Show the user 10 captchas:
If none match -> It's an old bot
If some match -> It's human
It over 90% match -> It's this new algorithm.

There, solved!

Re:90%

[nospam007]

"That's better than my success rate"

Same here, but some overdo it with the use. My phone company uses it on the payment page where you have to enter the invoice number and credit card.

Are they afraid some bot would pay my bills?

Re:90%

[kav2k]

More like: if solving is not attempted, it's human.

Re:90%

[heypete]

They probably are worried about bad guys using the payment system in an attempt to verify stolen credit cards by making seemingly-routine purchases that would not seem out of the ordinary and thus would not trip anti-fraud measures.

A small company I used to work for was abused by credit card thieves in this way, and dealing with the fraudulent charges and the resulting chargeback fees was the top non-salary cost for a few months (exceeding even the colocation costs). The problem existed because they allowed users to create either a free or paid account for the service and, if they selected the paid account, they could enter the card information on the sign-up page. Later, they changed it so users would need to create a free account (which required a captcha) and then upgrade it to a paid account in the account settings. Fraudulent charges dropped to essentially nil after that.

If the phone company requires only the invoice number and credit card data to pay a bill (rather than having you create an account, log in, and then pay the bill) then it's likely they're dealing with a similar problem.

Re:90%

[jythie]

And thus began the arms race where eventually the only way to use the internet requires buying an up to date bot plugin for your browser... ^_^

In other news...

[Cyfun]

I cured cancer, stopped global warming, and found the last missing episodes of Doctor Who.

Just take my word for it.

Re: In other news...

[jd2112]

I'll take your word for most of those but I need video proof of the lost Dr .Who episodes.

Better than humans

[Manfre]

I wish I could get CAPTCHAs right 90% of the time.

Re:Better than humans

[meerling]

Agreed. Heck, even those spammers that for years have been collecting databases of solved captchas for their bots do much better at those damn things than I do.
And what really pisses me off is when you get a captcha wrong, either through incorrect entry or because it's decided you took to long, and the damn thing wipes out all the fields forcing you to redo the entire page! Those sites I truly despise I hope their programmers/scripters get a horrible infestation of something nasty.

New security system ?

[Lennie]

I'm sorry, but I don't consider CAPTCHA a security system.

I would say it's an anti-spam system.

CAPTCHA isn't one system...

[neminem]

This headline makes no sense. CAPTCHA is just a concept, there are hundreds of implementations. I'm sure some of them are crap and only block bots that aren't even trying, some block 100% of bots (and half the humans, too), and most are somewhere in the middle. So what does it mean to "solve CAPTCHA with 90% accuracy?" Does that mean he's tested it on every system out there, and aggregated the results? That would actually be interesting if he has, but more likely he's just tested it on one kinda-crap system that I could probably write a bot in a week to do the same thing.

It does sound like it's built to be more robust, working with more different types of captchas than perhaps many captcha-busting algorithms, but I doubt it's the first of its kind (maybe it uses a new algorithm, but it's still a captcha-buster, that's not new.)

Re:Captcha is a security system?

[slim]

Security is often annoying. Entering passwords is annoying. Getting RSA keyfobs out of your pocket is annoying.

When it's used to protect against brute force password attacks, a captcha is definitely a security mechanism.

When it's used to discourage spam, well, it's on the edge of the fuzzy area most people understand by "security". It's protecting the availability of a service, against the threat of spam making it unusable.

Semantic capthas?

[davidwr]

[imagine this as a captcha graphic]
Spell last month.

Or this:
[image]
Type the one that flies:
England Turkey Russia

Or this:
[image]
Type the word for
2 + number of days in a week

Or just to confuse things, split the "challenge" into code + html:
[image]
2 + number of days in a week
[html] What is the number above minus 4, as a word: ___

Re:Semantic capthas?

[Anonymous Coward]

Or this:
[image]
Type the one that flies:
England Turkey Russia

"As God as my witness, I thought turkeys could fly"

Re:Wish there was some more information

[marcello_dl]

> Although "Recursive Cortical Network" sounds really cool, it would be nice to, you know, learn a bit about how it WORKS.

It works just like the "Recursive Cortical Network", look it up.