AreYouHuman CAPTCHAs defeated using SimpleCV | Hacker News Reader

AreYouHuman CAPTCHAs defeated using SimpleCV

spamtech.co.uk

25 pointskscottz23 comments

From my brief time playing around with the demo on the AreYouHuman page, it seems like the game is loaded onto the client side, and the javascript then initiates a callback to the php form indicating the results. Since the client has complete control over the javascript, it seems like it would be possible to simply send the server fake acknowledgement that the user has completed the game successfully. This seems fundamentally flawed and differs from regular captcha, where the client side has no awareness of right and wrong answers, and can't give immediate feedback. It simply acts an input to the server, which then judges the correctness, and if it isn't correct, returns a different problem, so a bot would have to start all over again.

So I think beating this captcha wouldn't require computer vision and stuff, simply sniffing the traffic on a successful run of the game and then replicating it appropriately later.

Also, how will this captcha system scale? They'll have to keep coming up with new sets of objects where some of them belong on a target and some don't.

From the video, the `AreYouHuman' captcha strikes me as quite culture-specific. `Put the tools in toolbox', `make pancakes' -- some people will know what and how to, others will not.

Meanwhile, a simple bot, as demonstrated, achieves high success rate. Could also be improved with automated learning , using suitable AI library; such libraries are freely available for making games.

With both false negatives and false positives high, the captcha's either done for, or at least needs some serious tweaks.

Why does the captcha allow infinite retries?

And why it lets you keep trying once you solved it?

Not that any of that would really fix the captcha, you'd just need to improve the code accordingly.

Image-based CAPTCHAs are already getting to the point where I can barely make out the letters. I'm guessing half the time and get annoyed when my guess was incorrect. The computers will only get better at solving them; what happens when there's no easy way for a computer to verify that it's talking to a person?

Disable comments! Batten the hatches, skew the mizzenmast, Turing to starboard! Knuth to port! There's a mean storm ahead and I'm not losing any more men. NOT ON MY WATCH.

I have created Image Based CAPTCHA. which is combination of Normal CAPTCHA and advanced CAPTCHA.

You can find the research details here. If any CAPTCHA scientist want to further research on my CAPTCHA, I can OpenSource it completely.

http://dndcaptcha.blogspot.in/2010/04/textareaid.html

How does the script move the mouse?

There are many python libraries available for controlling the mouse/keyboard. Here are a few I've used or heard of:

Autopy: https://github.com/msanders/autopy

PyMouse: http://code.google.com/p/pymouse/wiki/Documentation

Dogtail: https://fedorahosted.org/dogtail/

If you're on Windows, I believe win32api / win32con also can work.

Cool. I don't suppose there is anything cross platform?

I know Autopy is cross platform, and I'm pretty sure PyMouse is too. Not sure about Dogtail.

It isn't used in this case, but Autohotkey is quite a popular scripting/macro language that allows you to simulate mouse and keyboard use programmatically. It's cross platform, and can be run straight through the interpreter or compiled into native executables on many platforms by bundling the interpreter.

The whole CAPTHCA concept (while it is certainly clever) just seems backwards. Why are we trying to stop automation? It seems like we should be designing systems that accomodate automation, not try to stop it. If "automation is the problem", then something is wrong with the larger system. It would mean, e.g., that Googlebot is a problem because it is an automaton and not human.

We cannot just assume that everything that is automated is something we need to stop simply because it is automated.

Maybe the design of email is the problem?

Maybe the design of blog comment systems are the problem?

CAPTCHA's are aimed at stopping automation. That appears to be the only criteria they filter on. It just seems strange.

Of course CAPTCHA's will eventually be useless. Because most of us are working our tails off trying to push automation forward, not find ways to block it simply because it is automation.

>Maybe the design of blog comment systems are the problem?

How would you design a blog comment system that doesn't get spam without using a CAPTCHA?

If technology was advanced enough: An automaton that sweeps comments, keeps only ones that are relevant and deletes the rest. Both automatons and humans can comment, as long as their comment is relevant.

So you just have your bot Google the article's keywords and repost content it finds along with spam links. Or heck, just repost part of the article or another comment. Practically guaranteed relevance. Some bots already do this. Even this fictional ridiculously smart AI is not up tithe task.

in my greatly hubristic and obscenely self absorbed and self important opinion, the best way to have comments on a blog is moderation only, with a fake out instapost that confuses spammers, along with whatever pixie dust gmail uses to filter spam email.

If it has a spam link then it isn't relevant.

I'm not an expert on spam, but doesn't almost all blog spam contain a working hyperlink somewhere? So what if you just instruct commenters who want to post links that they should leave off the http:// or break the url some other way. Then have your blog scripts automatically fix all such broken url's into working hyperlinks. What is the likelihood a blog spammer would post a broken url?

Probably the same likelihood as a spammer deliberately constructing a custom spamming bot just for your website... but good point - It'll be difficult if the spammer posts mangled URLs as part of their spam.

I imagine you could use some idiosyncratic scheme; lots of different ways you could do it. Do blog spammers have time to customise their scripts for specific sites? Is it worth it? My guess is they tailor them to different types of popular blog software. And then have to hit a very large number of blogs. Sort of like email spammers have to send out enormous quantities of email.

I'm not the one to ask. Isn't what we're doing right here on HN similar if not identical to "blog comments"? We have read an "article" (or "post") and now we're commenting on it.

So it seems to me at least one person has designed a system that allows this and keeps out spam without using a CAPTCHA.

Consider this:

CAPTCHA is prohibiting comments based on the manner in which they are submitted. But what are really trying to stop? "Spam". How do we know what is "spam"? We look at the content. It might be hard to define "spam" because it is a subjective determination. But we know it when we see it.

What if someone writes some interesting content that is "not spam" but wants to submit it in an automated fashion? CAPTCHA stops him from doing that.

CAPTCHA stops automation. It may stop spam. Or may stop something else.

That's my issue with CAPTCHA. It is not aimed at spam, at least not directly. It is aimed at automation.

>So it seems to me at least one person has designed a system that allows this and keeps out spam without using a CAPTCHA.

That more to do with Hacker News being a low-value target than with its anti-spam prowess. If you really wanted to spam Hacker News, you could.

Why do you think HN is a low value target?

Reply on news.ycombinator.com