If bots that can break CAPTCHAs become widespread, the volume of spam, scams, and other junk traffic is going to cause problems for many people and small websites.
Increase the cost of having bots do it, while...
...also increasing the time wasted by humans. Time which is considered much more costly/valuable than whatever $ value spent on the bots.
So maybe the time has come to regard captcha's pointless, and just drop that nonsense.
Big Tech built their empires on scraping and stealing data (How do you think LinkedIn or Facebook got started?) But when we try to scrape them they throw a massive hissy fit, and so they put a lot of engineering into CAPTCHA systems to keep their data locked away. Eventually, the pinnacle of bots will be something that reads the framebuffer, and manipulates a mouse and keyboard to scrape websites.
This has got these companies freaked out, because all the founders know the dirty secret of their origin story, and that someone else can come along and do exactly the same thing to them.
Thus the XKCD CAPTCHA: https://xkcd.com/810/
We’ll have to change the game again now that bots can beat humans at it.
The main tenets of apps that are resilient to bot spam are 1) scalability, so that they can handle huge quantities of traffic and bot-generated content, and 2) the ability to differentiate high quality from low quality content (regardless of whether it was created by a human). Ironically, AI is probably the solution to the second problem.
But the bots I wrote to get unfair advantages in auctions or tickets are probably of the kind most bots are.
This is by design. The ones where you have to identify a bus, crosswalk etc are all used to train ML models. Your results are checked against other for the captcha, but sometimes you are the first person to see the image and there’s no way to check your answer so you’ll always get served another.
Another smart thing is that they actually segment the picture by moving the squares slightly.
Do you have a reference for this? I wouldn't have thought a process like that would be needed now-a-days for training ML models.
Human labels are absolutely still needed, for now at least.
https://techcrunch.com/2012/03/29/google-now-using-recaptcha...
The Captcha presents you with 9 squares. It selects a identification test at random (crosswalks, trains, buses, stoplights, etc). For this example let's say the identification test is to identify crosswalks. The squares are then filled as follows:
1) Two of the squares are requested that pass the identification test at an alpha value p < 0.05 (meaning it is more than 95% confident it IS a crosswalk).
2) One square is requested that passes the identification test at an alpha value of p < 0.01 (meaning 99%+ confident, effectively certain it IS a crosswalk)
3) One square is requested that fails the identification test at an alpha value of p < 0.01 (it is almost certainly NOT a crosswalk)
4) Two squares are requested that fail the identification test at an alpha value of p < 0.05 (it is 95% confident that it is NOT a crosswalk)
5) Three squares are requested that need have low confidence intervals p > 0.05
The captcha then shuffles these 9 images at random, it offsets the images a little bit by altering the crop slightly to prevent memorization by bots. Then it presents these 9 squares to the users asking them to identify according to the identification test.
The captcha scores the user based on their selection with the 6 known squares. The response you give on the 3 low-confidence squares has zero impact on you passing or failing the test. From what I was told, you must successfully identify both of the 99% interval squares correctly (one that passes the id test and one that doesn't). That is a hard pass/fail. From there, the captcha scores your response on the 95% confidence interval squares to the expected values. It compares that to other variables such as the speed that you answer them, the movement of the cursor and other variables (such as selecting, deselecting, etc). It also compares IP address google session data as part of its determination to determine the liklihood of humanity in the user. My understanding is that is is moderately forgiving. If the user is determined to be human based on those responses, then your responses are fed back into the confidence intervals for all of the images presented (other than the two "known" squares). Data by users that fail the Captcha is discarded so it doesn't feed into the confidence metrics of the images presented.
From what I was told, you can actually incorrectly identify 2 squares and still pass the captcha. The IP address and mouse movement plays a significant impact in the response as well as your ability to identify the two known squares.
Three of the squares are entirely unknown to the bot. You are purely feeding the confidence on those images for future use in the CAPTCHA and other google products. But there is no test where you are "guaranteed to fail" as mentioned above. Every test presented to you can be passed. There are 2 known squares which you MUST answer correctly. Your behavior and computer data and answers on the mid-confidence squares are what further impact your pass/fail determination. The three unknown squares never impact your pass rate. They are filler, the captcha only watches how you interact with the filler squares, not what you actually respond.
Sadly, when a site with captcha has decided to fail your every attempt, there is no feedback on why. You can request new sets as much as you wane; you can submit perfect results as much as you want, and you can try alternate methods offer (such as audio captcha) as much as you want. Typic'ly, when this happens, the following don't help: incognito/private mode; toggling extensions, adding some less direct mouse movement, forrce-reloading the page. Occasionally, other browsers or other hardware (phone, tablet, desktop), Windows/Linux/Mac, changing user-agent string might help.
And even though you can do a lot unsupervised these days, supervised labeled data is still something really useful for training ML models (often in combination with larger unsupervised corpuses).
Humans will lose!! lol ;-)
At least that's how the old "type these two words" CAPTCHAs worked. It was crowdsourced human OCR of whatever text the machine OCR couldn't make sense of. I'm not sure if "find the bus/motorcycle/crosswalk/light" is the same way, but perhaps, and it does seem to offer leeway when there's only a few pixels of that item in the frame.
I used to choose correctly but being sent through 5 chains of CAPTCHAs is modern hell.
This is trivial.
I've also noticed that captchas are getting more difficult. Is that because the AI needs to sharpen recognition skills or because that's needed for differentiating human from 'bot?
Nowadays, it seems the kind of captchas I get when under suspicion of being a bot are simply there to delay. Especially google captcha with their extremely slow fade out box selections.
>>“Furthermore the bots’ solving times are significantly lower in all cases, except reCAPTCHA, where human solving time of 18 seconds is nearly similar to the bots’ time of 17.5 seconds.”
This is currently an obvious tell for the standard CAPTCHAs, as you mentioned, "performing at a superhuman level". However, it's an easy bot behavioral fix, so.... what is the next step? Offer a game of chess and look for a human the playing style? Seems you'd have to offer a menu of games, but not "Global Thermo...."
Modern captchas do a lot of background work regarding how human your inputs look, whether you have a human-seeming fingerprint, etc. Often when I'm behind a VPN and on Linux I have the same issue, because my setup simply looks "too botty" no matter how good I am at telling which squares have a firetruck in them.
Curious, do you use a VPN or Tor? Either of those will cause CAPTCHAs to make you solve multiple puzzles.
The only site I visit that has ever been annoying with CAPTCHAs is PCPartPicker.
Job done!
Even maybe add a
answer = getrandombool(somesensiblepercentage) : rightanswer() : wronganswer();
For good measure
Many CAPTCHAs already operate this way. "Bots can do things at suspiciously superhuman speed" isn't new.
Failing that, we can't be more than a couple of years away from generalized solvers that can simply be implemented as browser plugins, at least on the desktop. The job of coming up with a fair, equitable and non-discriminatory test that only humans can pass is going to be an impossible one.
That's the Epic Games Store for me.