Gmail and Hotmail Captchas Cracked | Hacker News Reader

Gmail and Hotmail Captchas Cracked

arstechnica.com

27 pointssoundsop28 comments

I like how the turing test is reversed.... It isn't so much a concern whether human's can recognize a computer (these days anyway), but rather, can a computer recognize a human.

Hmm actually no, its a concern whether a computer can recognize another computer, because captchas just prove that the end user isn't a computer.

then again, I guess its the same thing...its the "glass half full/empty" scenario.

Maybe it's time to beat the captcha-cracking guys at their own game: use mechanical turk to "interview" people signing up for a new email account.

If you signed up via an IM session rather than a web form it would leave a lot more context in the communication, which might be useful for making a determination. You could also give the Turker additional money for an account that hasn't been flagged for spam in 30 days.

I don't know if this idea has any merit at all, but it seems like a natural response to the arms race at hand.

So two turkers will end up talking to each other during signups?

I would rather a technical solution .

Would charging $5 a month for an e-mail account work for you?

Credit card validation for an account (charge $0.00 just to confirm the information?)

You'd actually submit an authorization for $1.00. An auth doesn't withdraw funds, it only allocates them, and it expires after a few days.

I think that'd be useful as a means of creating a universal web id, which could then be used in lots of areas.

I think the CC providers charge merchants for these. Do you know that to be incorrect? If I'm correct this means that it now costs email providers cents per account per month, which just took an expensive turn for the worse.

If it doesn't work that way I bet Visa amends their merchant agreement to start charging -- they aren't in the business of doing millions of identity verifications per month for free.

Oh, you definitely pay for the privilege of submitting Auth requests. You have to have a merchant account with the card issuer. The systems I've worked with went through a third-party gateway system which connects out to all the different card issuers. It's definitely not cheap to set up. I'm not sure if there's a per-request charge or not. I wouldn't be surprised either way.

Yeah because CC accounts are so hard to come by, esp for criminals.

I think there would actually have to be some money changing hands. Five dollars would be enough to throw out the spammers and still be a small enough amount to keep customers happy. This is assuming that their e-mail is extremely important to them.

I'm thinking Google and Microsoft can't do this. Perhaps there is a niche opportunity here?

No email provider who wants to be dominant is going to raise that kind of barrier to use.

I swear, the first program to pass the turing test will have been programmed to break captchas.

Now there's a way to bring about the Singularity.

Yes, matching distorted shapes w/ noise attached to a set of 26 to 62 unique shapes will bring self-aware AI.

With the history of unusual ways things have been discovered in science, I'm not sure if that is sarcasm.

Given the financial aspect I'd prefer a technical solution as well, just as the spammers surely must wish they could solve captcha computationally. Unfortunately they're willing to pay per account and unless their opponents (the major email providers) are also willing to, they have a significant advantage.

I liked the early days of gmail where an invite was required - an invites were really hard to come by. Invite-only could be another barrier if you don't give new accounts the ability to invite for some weeks, and trickle in the invites.

There is a solution to this, but it's one that won't be implemented for some time because it is properly a government function.

Verified Identity.

The swiss have something like this, and are offering it to users in other countries see http://www.incamail.ch/english/home.html?language=english

But to really work, it needs the force of law (not that it wouldn't be gamed, but it's a lot easier to throw someone in jail for crossing the post office than some random companies TOS).

you don't think a person should be able to sign up for a gmail or hotmail account anonymously without tying it to their real identity?

I'm not suggesting doing away with internet anonymity.

But I do think I would be a lot more comfortable transacting business remotely with people I knew had gone in to the post office or DMV and engaged in a legally binding act of self-identification.

This is completely orthogonal to free speech.

Does anyone know technical details about how to crack Gmail's captcha system? I've no interest (or reason) to actually implement this, but it is very interesting.

It seems captcha is being "broken" by people tirelessly entering captcha text by hand. For money of course. See:

http://securitylabs.websense.com/content/Blogs/2919.aspx

http://blogs.zdnet.com/security/?p=1835

> ... the list of CAPTCHA's it now understands and can bypass is reportedly fully up-to-date, and includes newer designs that ask the user to identify a cute cat or other distinct animal.

Basically, they've discovered a way to automate cuteoverload.com. And they're using this power to break captchas. Bastards.

why not extend the "click the kitten" with a huge database of pictures?

noone can do image recognition that well yet right?

Isn't that what the article says?

There's no further information on how the program has accomplished this feat, but the list of CAPTCHA's it now understands and can bypass is reportedly fully up-to-date, and includes newer designs that ask the user to identify a cute cat or other distinct animal.

I assume the cute cat picture is displayed among other pictures.

Yes but have a lage database of tagged pics and choose randomly what should be identified.

Well I guess the programs could learn a huge database too eventually.

Only solution is give these people a chance to make money in an honest way...

I wonder if one couldn't use the large tagged database of images from the ESP Game for this:

http://en.wikipedia.org/wiki/ESP_Game

To get a database that large, the spammers would have to set up their own ESP Game and tag a big chunk of the web.

Even better, show two images, one with known tags and one unknown, so that you can build the database further, like RECAPTCHA does.

Reply on news.ycombinator.com