Slashdot Mirror
Can A Robot Fool 'I Am Not A Robot' Captchas? (businessinsider.com)
Business Insider reports on a new video showing a robotic arm apparently defeating the "I am not a robot" captcha test. An anonymous reader quotes their report:
The Captcha the robot fools tracks the user's mouse movements to make sure they're a "real" human. So rather than trying to trick it with software -- a tactic that can often be detected -- it goes down the hardware route. Using a capacitive stylus, the robot physically moves the mouse on the trackpad, as if it were a real human wiggling their finger around. The computer doesn't stand a chance.
So all you need is your own robotic arm -- although even then, it's apparently not that simple. The "I am not a robot" captcha grew out of Google's attempts to fight click fraud, according to a 2014 article in Wired, but it does more than watch mouse movements. It also "examines cues every user unwittingly provides: IP addresses and cookies provide evidence that the user is the same friendly human Google remembers from elsewhere on the Web," as well as some undisclosed variables, to create what Google describes as "a bag of cues."
So all you need is your own robotic arm -- although even then, it's apparently not that simple. The "I am not a robot" captcha grew out of Google's attempts to fight click fraud, according to a 2014 article in Wired, but it does more than watch mouse movements. It also "examines cues every user unwittingly provides: IP addresses and cookies provide evidence that the user is the same friendly human Google remembers from elsewhere on the Web," as well as some undisclosed variables, to create what Google describes as "a bag of cues."
If anillegal indo-chip can fool employers with their phony yoga masters degrees, so can a robot
Mister Roboto
You don't necessarily have to mark street signs, house numbers or storefronts in pictures in order to pass the Captcha? I cannot remember a single instance when I didn't have to solve one of those annoying puzzles, so this makes me wonder ... am I a robot?
If it's possible to do by a robot arm, it should be possible to do by faking the input from the stylus system. All you'd need is something like a finite element model of the physical system involving the robot and stylus (in the very worst case).
If the software can send coordinates to the robot arm, it can also send them directly to the browser.
The object to my adblocker. I object to the manner in which ads are served. And this story is not worth the $1 they want me to pay in order to keep my adblcoker on while I read it.
I am Slashdot. Are you Slashdot as well?
I can't stand the captchas where I can't possibly read what the fuck the letter/number/??? is.
Whaz tha... It has been broken a long time. You rely on captcha's, you are just feeding the myth. As once mentioned, the coordinates can be sent directly to the browser, though most captcha breaking programs do not use a browser - the emulate one, including cookies. Google had a news release a few years ago that they had a program that broke every captcha. If Google has it, don't you think others can code it up?
Or you could use generative adversarial networks. Basically, you set up two neural networks: one tries to simulate human mouse movements, and the other tries to detect non-human behavior. You pit them against each other in a loop, so they drive each other's improvement.
And before the peanut gallery calls you an "entitled millennial cheapskate":
I use Firefox Tracking Protection, which blocks resources that track the user from one site to another. The functionality is similar to that of the Disconnect extension. But the detection code used by WIRED is so coarse grained that it can't tell an ad blocker from a tracking blocker. The site makes no attempt to fall back to serving ads that don't track users in this manner.
This was a stupid remote controlled arm. This says nothing about robots being able to fool a clickbox.
-- these are only opinions and they might not be mine.
If it involves an arm it's slow enough to prevent the kind of mass fraud this is designed to defeat.
I said it once, for the thousandth time, I never use a touchpad EVER, you insensitive one-armed clod!
WARNING: Smartphones have side effects--most of them undocumented.
Google writes "i am not a robot", but actually means "i am not a simple piece of automated code, but a full featured webbrowser used with a mouse with realistic movement patterns". Probably some more advanced plugin for systems like selenium would do better than a robot arm, but a simple "curl" script won't fool google. That's the point. Their image puzzles are very repetative as well and a good machine learning algorithm should beat them soon. Its really about collecting some behaviour patterns inside the browser, not about robots.
As long as there is a11y features available, is it that hard to automate this with tools like dogtail (in GNU/Linux)? Is a physical hardware ever required?
Scripts, which incidentally are NOT robots, have been able to crack Captcha for many years. Why is this not already more widely known? Even a Google search will turn up hundreds of such scripts, many of which are freely available.
...maybe I should buy this robot.
(What do these things detect anyhow? Because for me it's about 50/50 whether I get through or get diverted for "further testing").
I often fail these checks, as well as the image picking task that follows.
I think its some combination of script blocking and and just being a bit abnormal with my interpretation of ambiguous tasks (pick all squares containing street signs? Is the private billboard a street sign? Is the post part of the sign?). I feel like such tasks are trying to normalize thought: the more similarly I match other people, the better I do: I don't like that.
They're a fairly defeatable technology - but they do serve to keep honest people honest.
In the worst case you can proxy the capture. Solve it for one site solve it for another. How do you know when you fill a capture if it's one from a bot or genuine for the site? This is how: Make your own site, capture script (put it on stack overflow, npm, composer, etc everyone will copy and pasta it without checking) or something, make your bot. Your bot constantly puts captchas on a buffer. When a site needs it if the buffer is empty it generates, else it uses on off the buffer. Then it just forwards the success result. If you captcha site has good load the buffer can always be quickly consumed. Really good if you have enough control to just make it appear for a user already logged in to continue.
The real work behind "I am not a robot" is in the reputation score that Google computes for you by looking at all the baggage you carry-around with you by virtue of them having their fingers in every pie in the world. Most of the time, the "I am not a robot" checkbox is a formality, and even that will be removed very soon for people who are good little consumers. Whether this thing was a robot (it wasn't) or a pantograph or whatever is irrelevant, because the robot needs to establish a reputation with Google to even begin the hack.
Of course, eventually that will happen as well. Robots will be competing with humans to establish online profiles which ... can be used to establish more online profiles.