Hacker News Reader

Comment by Swizec | Hacker News Reader

I am fairly certain it would be quicker to program a computer that can brute force a checkmate in one than I can solve these things by hand.

You have what, 11 pieces, they can move into 64 positions each (at most, much less in reality). That means a computer must brute force 64*11 = 704 attempts.

In other words, no time at all to bruteforce this once you've read the grid. Reading the grid in itself is rather trivial since you only have a small number of clearly distinguishable pieces to recognise.

So after an afternoon of coding, I could have a computer that solves this CAPTCHA in a few seconds. As a human I need more than 30 seconds just to read the current situation on the board.

View on HN

Yes, an afternoon of coding to be able to post spam on exactly one website. Until they change the captcha.

Unlikely but not impossible.

I've seen forums get flooded for no other apparent rationale than some random skiddie had nothing better to do for an hour or two than irritate the admins. It being not worth anyone's time to break isn't actually a feature, but it being relatively easy for anyone with time to waste on it is a flaw.

Actually, the captcha predicate is a GET request that looks like this:

http://en.lichess.org/captcha/78pkfjgz?solution=e5+e4 which returns 1 or 0.

So the brute force captcha solution is to go through 8^4 (~4k) get requests, which you could code in five minutes and execute in a minute.

I would imagine it'd be fairly trivial to limit the number of requests.

OP may have been suggesting it's not actually a CAPTCHA in the first place, under the understanding that CAPTCHAs are at least nominally supposed to target something computers are bad at.

Chess is even a particularly ironic implementation because it was one of the first traditionally human passtimes where computers excelled.

A site can have a CAPTCHA that's so bad it's not actually a CAPTCHA even if no one bothers to attack it. My hidden forum could require a user to sum one thousand integers before seeing any posts. I probably wouldn't attract any spammers (because no one would join to read their spam), but that doesn't mean the so-called CAPTCHA is beyond reproach.

So you are, literally, arguing for security by obscurity. "Oh, my captcha is unique, therefore nobody will bother".

There are easier to implement unique captchas, than chess.

I'd agree partially, but I'd comment that it's also security by diversity. If every site had a unique captcha solution requiring custom software for a defeat, the force multiplier effect of "write once, run everywhere" would be hugely diminished, and it would be much less cost effective to implement various types of spam. So, the particular security strategy here is indeed weak, but I would say that it might actually strike closer to the root of the problem than just making a really hard, but still universally applied, captcha technology.

You are not making any sense.

The economics of spam commenting makes sense if it can be done automatically at a massive scale. If only one or a very small number of "humanity tests" exist, then cracking those tests has a high payoff value. Having a huge number of different, ad-hoc authentication schemes would make developing automatic cracks unacceptably expensive for the actual level of benefit achieved by posting the spam comment. Therefore, being a site with a unique CAPTCHA system attacks the core value proposition of spam comments, which strikes the root of the issue.

Another way to look at it is like the entire collection of CAPTCHAs on the Internet is really just one big CAPTCHA library, which tests a subset of "human" abilities. The larger the subset, the more difficult it will be to circumvent. Relying on one or two special abilities makes it easier for a machine to emulate those behaviors and gain access. I hope that clarifies the point I was making.

Obscurity can be a great tool for security. But you have to understand its limitations, and expect at some point it will fail.

Custom captchas are probably a great use of this.

If you don't want to think about how to checkmate maybe this website isn't for you.

Probably not, but we are talking about the CAPTCHA itself :)

You raise a good point about making captchas that target your target audience in that they aren't really designed to keep out bots, but humans who wouldn't fit in. This looks very much like that sort of captcha.

Basically, it's the internet equivalent of "You must be _this tall_ to ride".

Good point. Maybe this could be used as an anti-captcha then, to prove that you are a robot (although i can't think who would want that)

Anticaptcha is easy to implement: just ask for some straightforward heavy calculation and require quick response (less than a second).

Reply on news.ycombinator.com