Hacker News Reader

Comment by nwh | Hacker News Reader

Doesn't this just make the CAPTCHA easier to solve for a bot?

There's 20 frames in each challenge image, 20 different sets of data to process and compare for a correct result. It's also three letters long.

ED: The form itself is included in an iframe, with the following tag:

    <meta http-equiv="Expires" content="Sat, 1 Apr 2006 23:59:59 GMT">

ED2: The audio CAPTCHA sounds even weaker. You could probably just pipe that to Googles dictation API and you'd be set.

View on HN

It probably does, but it also makes it easier for a human. I would guess that humans gain from it far more than bots do (since humans are really good at distinguishing moving objects), which should be the primary goal of a captcha.

Couldn't a bot just look at the first frame?

If this becomes a trend, then surely the first frame won't always be the most obvious frame to choose.

If you were coding this I'm sure you'd jumble the start point anyway.

Or even better: Iterate over the frames until you find one which is very easily solved.

It can look at all frames and average predictions; this should boost the accuracy as errors will likely cancel out.

Accuracy is not always the only factor in play. The computational power required to process 20 frames is 20x the normal image. And the overhead of actually comparing the frames 20^2 if each frame is compared to every other frame. Since this is done automatically by bots, speed most certainly does affect the final performance of a bot.

Comparison of frames? I was only thinking about averaging predictions for each frame which is just 20x slower. Still I think that the process is way more constrained by the time to fetch new CAPTCHAs than by OCR, so this doesn't really matter.

In theory, you could make the letters overlap so much that it is difficult to distinguish them in a single frame. This would give humans a distinct advantage over robots. However as it stands, a single frame is barely obscured at all, and I'm sure it could be easily broken.

I agree. Their assumption must be that OCR fails when a letter has covered regions, and to make it more readable to humans they provide the missing information in other time frames. But the letters have very nice borders and shadows, they are not deformed and have rigid motions which is trivial to track. Even in a single frame they provide more information than a traditional captcha. But the concept is promising and will definitely work with few modifications (e.g. no stroke color, time dependent deformations, not showing all letters in all frames etc.)

Sure, but then it gains none of the advantage given to the human.

Why not? If it can grab all 20 frames, it has 20 times more data than it would normally have to solve the captcha.

Even if the captcha recognition's success rate is only 5%, its overall recognition rate is going to go through the roof.

You also get to do something you can't do with static captchas, compare the results. If 70% of the frames recognized the first letter as A, it's likely to be A, and so on.

As the letters move, they briefly do the really hard task of segmentation for you.

If there is any incentive to crack this captcha, it will be cracked very soon if not already, it looks like a very easy one to write.

It shouldn't be necessary to have separated letters in the first frame.

What makes you think the individual frames look like the letters? They certainly don't have to. At the price of a little flickering you could, say, show the top half of the letters in one frame, the bottom half the next, the right half the next and so on. Or randomly leave out one letter in every frame. Or even throw in different replacement letters for one frame each.

Maybe they're hoping the overlapping letters make it more difficult to solve through a bot?

I have to admit I'd expected something better, although it's certainly not a form designed to be seen (I'm assuming it's required for legal reasons)

I was thinking they'd use motion blur - humans are good at seeing through that. But they don't blur. Each frame is crystal clear. Giving the bot 20 data instead of one, as you say.

It actually makes it a lot easier for humans, while not making it immediately easier for bots which will need to be tuned to use motion.

Pretty smart.

Sure, but it wouldn't take a lot of tuning to update a bot to read the animated frames and then you're back to square one. In fact, with 20-odd frames and only three (entirely upper-case!) letters to select it looks very easy to develop a bot that would get a very high success rate.

Actually benefiting from the motion requires a new algorithm. Probably not that hard to design, but not trivial either.

As always CAPTCHA is a game of cat and mouse. When something is completely broken, you need to think up something new.

Are the people using the captcha-breaking algorithms the ones developing them? Probably not. These things take time... the best way to combat them is probably to change what your captcha looks like and works like every week or so.

You don't actually need to use the motion to improve the success rate. Just run the normal algorithm on each frame and elect a winning solution.

They don't really have to be tuned for motion, you can just consider each frame individually.

In that case you don't gain anything from the motion (except maybe the ability to vote between your bot's output for the individual frames, but that also makes your bot 20 times slower).

With this implementation you don't, but it's not hard to construct it such that there is no single frame with enough information to construct the whole message. If you screen capture there are several frames where you really can't tell what the middle letter is, but it's obvious what the message is.

The real issue is a computer can compare the images individually and combine them so if it get's 'G_G', 'GF_', and '_FG' it's going to assume 'GFG'.

Actually makes it a lot easier for BOTs. This one is very easy to break.

Don't people from nigeria offer captcha breaking services for something like $1/thousand now?

motion? just take a single frame and OCR it!

And the GIF I've got seem to has all the letters in the first frame anyway? What do they get by using animated GIF then?

At the risk of sounding snarky, it's form over function.

It is pretty snarky, considering this is a one-off use of a 3rd party captcha solution on a form only required for legal reasons for a time limited promotion.

I doubt the unique capture implementation was done for a one off limited time form, I would have thought that this is something Apple has cooked up for re-use across multiple projects and this just so happens to be one of the first.

The comment wasn't snarky, it was accurate.

I have far too many repeats when I ask for a new one, NTN, RNC, and SAZ, are three that stood out

Not to mention the motion makes separating out the letters easy[1]; optical flow can be used to segment the individual letters.

[1]: Have not actually attempted this.

I'm surprised they don't include letters in different colors and only have you distinguish ones of a particular color. Or make certain colors blink having the user select only the ones that are blinking.

I hope not, these are refreshingly easy for humans, compared to the rest.

Maybe an Apple engineer can chime in

Reply on news.ycombinator.com