Geohot tries to break Google's recaptcha | Hacker News Reader

Geohot tries to break Google's recaptcha

github.com

90 pointsartf39 comments

Open articleView on HN

This problem was solved long ago to the apparent satisfaction of the marketplace: http://bypasscaptcha.com

George, the devil is in the details. You can't do everything overnight.

0% chance of success.

Thanks, dang and sctb, for encouraging people to flag and neg my comment wishing Geohot good luck.

Perhaps your "good luck" was snipey and didn't add anything...

It wasn't. Perhaps we should be thanking sama, on the other hand.

>the Google Self Driving Car Cheaters

How is the Google self-driving car team cheating?

Or is he just being a sore loser about how his own self-driving car venture didn't work out?

I think he wants to imply that everyone who is trying to build a self driving car is working on it in house, testing and tweaking while collecting data to make it better and possible. But what Google has done is, they tried and couldn't get the ball rolling that well in the commercial market as expected and eventually they created 'Waymo' which will partner with car manufacturers who will create prototypes for them to make ride sharing autonomous cars. Which sounds more like a mashup of Tesla and Uber.

lol, comma.ai still exists and is still winning self driving cars. https://github.com/commaai/openpilot We have some amazing things scheduled for 2017

This repo is literally a joke for George to learn Go, in a similar vain to https://github.com/geohot/lowqualityraytracer being about learning raytracing.

Google is "cheating" because they are crowdsourcing labels with CAPTCHA, but then of course there's https://www.producthunt.com/posts/comma-coloring

A Github repo is not what I would call "winning the self driving cars"

Correct me if I'm wrong, but comma.ai still exists.

Pretty sure he abandoned the car project when he realized how much of a massive liability that was.

No, not quite.

They got a letter from the NHSTA asking to clarify a bunch of stuff with regard to safety, and rather than respond, they decided not to sell their product.

The details are a little strange, but easily found with a quick Google search.

That doesn't contradict what the op said

Why only street signs though? The new captchas I've seen ask you all sorts of random image recognition things, like identifying the squares with grass, with tea, with eggs, etc.

Pardon me if this is stating the obvious, but the captcha images being decoded serve a second purpose. In short, Goggle is crowdsourcing the decoding of those images in a mechanical Turk sorta way.

Why street signs and house numbers? Because when your taken as much Street level photos as they have some are gonna need human review.

At first, ReCaptcha was used to transcribe books, and then in 2012 Google began to use it for street data. The GP is referring to its newest use, which is based on an image classification algorithm. Image search used to rely on nearby words on websites and in the URL, since computer vision was just a research technology.

Ironically, this new captcha has already been attacked using Google's own reverse image search: https://www.blackhat.com/docs/asia-16/materials/asia-16-Siva...

A possibility to break these might consist in using Google's image reverse search and check whether the word which you are supposed to identify images for appears on the result pages. However, the Google search is protected by reCaptcha - so you could build your own image reverse search or you use one implementing captchas which are easier to break.

Otherwise, if you own a highly frequented website, you could ask your users to solve the captchas for you by proxying the challenges to them.

For the "which image is..." type captchas, there is always an option to "refresh" the captchas and get a different challenge. After 1 or 2 refreshes, you almost always get a street sign challenege. I was playing around with breaking Google's captchas a few weeks back and tensorflow's basic image recognition demo is actually already good enough that it too can almost always correctly identify which of the 9 or 12 images contain street signs. So I think that's a good start- exploiting the fact that Google favors showing street signs, and that in many cases you can already programatically identify street signs with image recognition. Obviously it's not perfect or Google wouldn't need to farm users to aid in improving image recognition , but it's good enough where you can break the captcha roughly 50% of the time.

Current solutions on the market solve new google recaptcha with up to 50% accuracy. Let's see what Geohot can do.

Has he read this paper? https://www.blackhat.com/docs/asia-16/materials/asia-16-Siva...

Clever idea, but Google also has some bot (and maybe also captcha farm) detections to try to ban captcha gamers. I think you'd also need a distributed and human-seeming proxy network.

Wonder if anybody commenting has read the readme. This is just a learning experiment.

Is it really wrong for a famous hacker to dip his toes in a new language by doing something that is not state of the art?

He was the biggest hacker, tried to be an entrepreneur, now he is working hard to became the biggest comedian of Silicon Valley. Seems like the comedian role might actually work out.

He never was the biggest hacker.

Nevertheless he's got the chance to become the biggest comedian :) I think Hollywood would work out better for that...

He cracked the ps3 and iPhone. PS3 haven't been hacked for a long time.

Here's my solution: rerecaptcha.

1) Own or work with a very popular site with people filling captchas often

2) Instead of showing a full random captcha, use the recaptcha technique against itself: show a small random captcha alongside a full recaptcha that you want to break

3) Use the random known captcha for validation and profit from the user entered recaptcha

You have to admire the showmanship: using a language Google created to try and break a Google-made system.

Should use Tensor Flow for his classifier

Should use Google Cloud Machine Learning to host the resultant model.

... this code literally just scrapes images from recaptcha right now, and it barely does that.

If you want it broken, all you have to do is take these images and feed them through a captcha cracking service that uses humans and get them to input numbers for the corresponding squares. Works fairly well in my experience. And $1/1k you can't argue with.

That price is inhumane. Assuming the worker can solve 1 captcha every 10s in average, when working full time at 25 working day and 8 hours / day, a worker can clear 72000 captcha per month, grossing $72. The take home pay might be like half of it? Even in developing countries, $36 per month is too damn low for that mentally taxing work.

a good solver should be able to do it much faster than 1 every 10s. As someone who sees a lot of recaptcha captchas (i.e. per week I solve probably 1k+ working on a similar project) you notice patterns, that makes it much quicker and not particularly mentally taxing.

With the proper tools, someone should be able to on average do them in under 5s and perhaps even faster. I just did a test, and I was able to do 20 recaptchas in a bit over a minute (65-70s, rough timer)

Now, I wouldn't want to do for pay 8 hours a day, but at 3s a captcha it and at $1 per 1K captchas, one is looking at about $1/hr, which probably isn't bad in some parts of the world. (per a quick google search, "In 2009, the average monthly income in India was Rs 3000 [1]. If we assume 160 hours worked per month, that comes out to Rs 18.75 per hour, which is about 0.40 USD per hour. Given that about half of the country lives on a dollar per person per day [2], this estimate sounds reasonable.Oct 28, 2011")

Geohot never stops to amaze me, at least.

Geohot - https://www.youtube.com/watch?v=9iUvuaChDEg

I'm never really sure how I feel about Geohot. I know for sure I liked people like him a lot more when I was younger and thought that everything was within close reach.

I hope that he keeps on winning... maybe it will inspire youngsters to try the impossible before reality knocks the wind out of them.

Reply on news.ycombinator.com