How to break a Captcha system in 15 minutes with Machine Learning

Hah! Come to think of it, CAPTCHA is basically the definition of "security through obscurity," except worse: it's "security through the difference between obscurity to machines and clarity to humans," and that's a game that will keep getting harder to win.

Google is literally using you as unpaid labor to label/validate their image datasets.

My guess is that either (1) your first attempt at validation didn't match what their automated system identified so it didn't have high enough confidence to proceed or (2) the first image is one you are classifying from scratch but the second/third image is the one that you are only validating against their guess.

In either case, it's amazing to me that Google is able to get the whole world to do unpaid menial work for them by offering a free product to website owners.

Historically the most reliable way to break a CAPTCHA was to pay a human to solve it via a sketchy service, for eg $3/1000.

The round trip time of those services can be quite long, narrowly within the CAPTCHA timeout window. By forcing some users to solve three iterations of the puzzle (the exact instructions are “stop when there are no more images containing <cars>”), Google forces multiple round trips to a CAPTCHA solving service. Also, the solving service and its client need to account for the expectation that the final image will have no <cars>, increasing complexity.

This increases cost 3x, slows solving rate 3x, etc. Ultimately google can never stop the problem of outsourcing CAPTCHA solving to a human, so their best option is to increase the cost and complexity of doing so.

ReCAPTCHA has a "Security Preferences" parameter where you can set the level of difficulty of the test. If you set it to "Most Secure" most or all users are presented with the multiple image identification scenario you describe. Easiest will simply present the "I am not a robot" checkbox modal which does some browser fingerprinting and other tests in the background. I believe there is also a heuristic that determines the difficulty of the test to present users if you leave the setting on the default medium difficulty. Could be mistaken, but this is my takeaway from implementing reCAPTCHA a few times.

Creating menial jobs isn't a problem. People being in situations where they need to settle for menial jobs is the problem.

What questions?

It would need 1) Not easily searchable 2) Not math-based 3) Easy 4) Internationalizable

I would see "spot the grammar mistake" as one that furfills 1-3, but can't figure out oone that does all 4.

Cool idea and thanks for sharing!

One of the challenges here (which I'm sure you are very aware of) is that perception tricks that fool computers like flickering images also can block out users with different types of visual impairments. Sometimes users with even minor or infrequently-symptomatic visual impairments won't be able to read an image[1] that uses a special "trick" like this.

For example, consider the risk of triggering an epileptic seizure with flickering. At a certain point it becomes an accessibility/legal issue.

[1] The animated example from nytf3's paper - please note that in contains strong flickering: http://people.csail.mit.edu/recasens/images/captcha.gif

But whatever process the human eye uses to piece together a flickering image should itself be fairly simple, right?

couldn't you just capture a sample of frames and take the mean ?.

I would like this NOT to be broken. reCAPTCHA is currently one of the few captcha systems the still work to some extend. It locks out most spam bots and keeps my sites clean. Of course it's a good idea to try and break it, to see how "secure" it is.

I imagine that those are hard to beat with machine learning precisely because they stump Google's own algorithms. By answering them, you're helping train their neural networks (which is why I rather resent having to answer them).

| Do you consider that a CAPTCHA? Yes:"Completely Automated Public Turing test to tell Computers and Humans Apart"

But funny enough, I believe that data is used to help with machine learning to identify the objects, so we are CAPTCHA'ng ourselves into harder and harder CAPTCHA's.

The "I am not a robot" types are interesting because they don't just test you, they monitor your behavior. "If it looks like a duck, swims like a duck, and quacks like a duck, then it probably is a duck."

Many times I don't even get to the second step. I only click "I am not a robot" and I've passed.

Are Captcha's a paid service and my examples are sites buying into only the lowest level of ID?

Or is this something akin to a decision made vs my access frequency/behaviour where the algo decides it's reasonably sure I'm a human so no need to waste bandwidth on sending and confirming images?

> I don't know what you call those new Google captcha

Dunno what to call them, but I consider them educational interactions with AI [0]

[0] https://xkcd.com/1897/

Yep, this is a pretty simple CAPTCHA picked to illustrate a concept for teaching purposes. But more complex CAPTCHA images don't necessarily make anything more secure depending on how the whole system works.

In fact, one of the most effective attacks against Google's ReCAPTCHA is more simple than anything in this article - you just request the audio version of the captcha, feed it to Google's own Speech Recognition API (or a competitor), and give Google back it's own result [1]

[1] https://github.com/eastee/rebreakcaptcha

You might be right. But who cares if using a deep neural network takes 15 minutes? There’s also no need to use a chainsaw to cut down a Christmas tree, but if you’re already holding a chainsaw...

The model used in the post (LeNet) is very small compared to what we typically think of in terms of modern deep neural networks. The LeNet architecture itself was published in the 1990s and was designed for character recognition so this is a natural application of it. kNN would work for many characters in this example, but you would run into a problem with overlapping text. kNN on raw pixel intensities requires a nice segmentation of the ROI. More image processing/segmentation/morphological operations could be applied to help in that case, but given a small network architecture that will naturally learn these filters a tiny CNN works well with little preprocessing.

When someone solves a problem with a thing and you're not that impressed, the best response is "cool" or "learning new things is fun" or, like, nothing.

Telling someone they didn't need to do it with that tool is presuming that a) you know why they did it, b) that you are able to judge the suitability for that of that tool for that purpose and under those constraints, and c) that there is no one else who has ever needed to use that exact tool to solve that exact problem under those same constraints.

While KNNs are simpler conceptually, DNNs are fairly easy to put into practice, thanks to Keras and other libraries. A KNN approach would likely involve more code - for things like Data prep

The advantaged of Dnn is that they are easy to understand, very well supported, solve a wide variety of problems, and gpu costs are very rapidly coming down. Plus you can use them to play games!

very likely, something like PCA + KNN does well on mnist. I think what will start to get tricky is rotation invariance.

Hi, Adrian here, author of the book you are referencing. You are referring to the highest tier of the book. There are other lower tiers as well that are cheaper.

The highest tier (again, which you are referring to) includes 800+ pages, detailed experiment journals on how to reproduce the state-of-the-art publications (ResNet, SqueezeNet, VGG, etc.) on ImageNet (which is 1.2 million images). I demonstrate how to implement each model from scratch and then train them, detailing which parameters to change and when. The highest tier is for people looking to train really large networks on massive datasets where you could be spending thousands of dollars in the cloud for GPU costs (you can't train these networks without a GPU, or ideally multiple GPUs). I've also included the pre-trained models as well if people want to get started with them and skip training. This tier is really for researchers/practitioners who need to save time and finances by starting with experiment journals that detail how to replicate the results.

The lower tiers are for people just (1) getting started with deep learning in context of computer vision and/or (2) looking to apply best practices. Each book also includes video tutorials/lectures once I have finished putting them together. Realistically I should rebrand the book as a course as it's much more in line with something you would get from Udacity (only with more theory and more detailed code and implementations).

If anyone has any questions about the book do feel free to ask.

There are some tasks that haven't been solved well by machine learning algorithms yet. Like visual question answering. However I'm not sure how easy it would be to get them into the form of a CAPTCHA without making it easy for a bot to just guess and get it right a lot of the time. And even though they haven't been solved well, it's probably good enough to get past a CAPTCHA a lot of the time.

I expect these sort of systems will move to 'social proofs' - do you have a long-standing account etc.

I think the point is to use a realistic example

They could have done that but then the data wouldn't have been the same as it would be when they were trying to solve real CAPTCHAs. The OpenCV part where they found the characters in the CAPTCHA leads to some messiness in the training data, which will also be there in the 'real' CAPTCHA data when the system is tested. I'd say training the model on this messy data would lead to better results, especially for the case where the letters overlap.

And sadly it seems the bots have improved even more then the CAPTCHA's. Googles latest variation of "Click on all boxes that contain X until none are shown" takes a significant amount of time to complete. It also seems that the faster you are in clicking the images the longer the next image takes to load, often leading to me hitting submit only to have to start all over again since the next image still contained what Google was looking for.

Sometimes I think it might be easier to just run a ML algorithm to complete them for me...

> with every click you contribute to the driverless cars vision improvement

Interesting I hadn't heard that. Supporting links:

--neural nets captcha analysis--

https://spectrum.ieee.org/tech-talk/robotics/artificial-inte...

--obligatory XKCD--

https://xkcd.com/1897/

It can be almost as easy, but it can be made as hard as you want. These kind of Captcha exercises are a fun way to test ideas especially if you want to work on "attention" models (spatial Transformers, ROI, deformable convolutions, soft attention, hard attention). You can also try to "read" one letter at a time using a RNN. You may even test the new capsule networks for their rotation invariance. All these different network architectures, encode various strategies one can use to decode a picture. Obviously all will work at > 99% on the simple cases, but as you increase the captcha difficulty you will see that the more modern architectures can trade computation for increased accuracy.

this is exactly what the "you only look once" model does. It will give you bounding boxes and a classification for every object in the image it recognizes.

https://pjreddie.com/darknet/yolo/