Slashdot Mirror
Can A Robot Fool 'I Am Not A Robot' Captchas? (businessinsider.com)
Business Insider reports on a new video showing a robotic arm apparently defeating the "I am not a robot" captcha test. An anonymous reader quotes their report:
The Captcha the robot fools tracks the user's mouse movements to make sure they're a "real" human. So rather than trying to trick it with software -- a tactic that can often be detected -- it goes down the hardware route. Using a capacitive stylus, the robot physically moves the mouse on the trackpad, as if it were a real human wiggling their finger around. The computer doesn't stand a chance.
So all you need is your own robotic arm -- although even then, it's apparently not that simple. The "I am not a robot" captcha grew out of Google's attempts to fight click fraud, according to a 2014 article in Wired, but it does more than watch mouse movements. It also "examines cues every user unwittingly provides: IP addresses and cookies provide evidence that the user is the same friendly human Google remembers from elsewhere on the Web," as well as some undisclosed variables, to create what Google describes as "a bag of cues."
So all you need is your own robotic arm -- although even then, it's apparently not that simple. The "I am not a robot" captcha grew out of Google's attempts to fight click fraud, according to a 2014 article in Wired, but it does more than watch mouse movements. It also "examines cues every user unwittingly provides: IP addresses and cookies provide evidence that the user is the same friendly human Google remembers from elsewhere on the Web," as well as some undisclosed variables, to create what Google describes as "a bag of cues."
If it's possible to do by a robot arm, it should be possible to do by faking the input from the stylus system. All you'd need is something like a finite element model of the physical system involving the robot and stylus (in the very worst case).
If the software can send coordinates to the robot arm, it can also send them directly to the browser.
The object to my adblocker. I object to the manner in which ads are served. And this story is not worth the $1 they want me to pay in order to keep my adblcoker on while I read it.
I am Slashdot. Are you Slashdot as well?
I can't stand the captchas where I can't possibly read what the fuck the letter/number/??? is.
It means "thank you terrible lizard".
Blank until
Our bestest Mandacrishna university teaches a 3 month Masters in PhD for rocket science. We accept credit cards. You will be a very good rocket science PhD, our priests guarantee it. Upon passing you will get H1B visa to work as an american scientist. No experience required.
Revert us application for the same.
This is how this works. You check the box then they check for a cookie set from a time you previously finished the captcha. In addition to checking if you're signed in to a Google account of some sort (Gmail, Google+, Youtube, etc).
I want to see this work on a brand new browser install.
Or you could use generative adversarial networks. Basically, you set up two neural networks: one tries to simulate human mouse movements, and the other tries to detect non-human behavior. You pit them against each other in a loop, so they drive each other's improvement.
And before the peanut gallery calls you an "entitled millennial cheapskate":
I use Firefox Tracking Protection, which blocks resources that track the user from one site to another. The functionality is similar to that of the Disconnect extension. But the detection code used by WIRED is so coarse grained that it can't tell an ad blocker from a tracking blocker. The site makes no attempt to fall back to serving ads that don't track users in this manner.
This was a stupid remote controlled arm. This says nothing about robots being able to fool a clickbox.
-- these are only opinions and they might not be mine.
If it involves an arm it's slow enough to prevent the kind of mass fraud this is designed to defeat.
I said it once, for the thousandth time, I never use a touchpad EVER, you insensitive one-armed clod!
WARNING: Smartphones have side effects--most of them undocumented.
Google writes "i am not a robot", but actually means "i am not a simple piece of automated code, but a full featured webbrowser used with a mouse with realistic movement patterns". Probably some more advanced plugin for systems like selenium would do better than a robot arm, but a simple "curl" script won't fool google. That's the point. Their image puzzles are very repetative as well and a good machine learning algorithm should beat them soon. Its really about collecting some behaviour patterns inside the browser, not about robots.
I learned it as well from this video. Some mouse movements seem to make the image patterns go away, in many cases even when you deleted cookies. I am not sure, if the site can decide to use a "higher security" captcha, which enforces clicking, though.
They're a fairly defeatable technology - but they do serve to keep honest people honest.
In the worst case you can proxy the capture. Solve it for one site solve it for another. How do you know when you fill a capture if it's one from a bot or genuine for the site? This is how: Make your own site, capture script (put it on stack overflow, npm, composer, etc everyone will copy and pasta it without checking) or something, make your bot. Your bot constantly puts captchas on a buffer. When a site needs it if the buffer is empty it generates, else it uses on off the buffer. Then it just forwards the success result. If you captcha site has good load the buffer can always be quickly consumed. Really good if you have enough control to just make it appear for a user already logged in to continue.
Who was that AC? It is one of the computers stolen from me. Mind this, eh? I need all files back.