Stanford Researchers Teach Machines to Beat Captchas
Stanford Researchers Teach Machines to Beat Captchas
Posted 10/31/2011 at 3:06pm
| by Ryan Whitwam
17
Comments
Print
We’ve all struggled with those often unreadable security Captcha codes from time to time, but if some new research out of Stanford is any clue, machines might be better at it than us very soon. By using machine vision algorithms, the Stanford team was able to defeat 66% of Visa’s Captchas, 70% of those used by Blizzard, and about a quarter of Wikipedia’s Captchas. This may spell trouble for a multitude of other sites, as well.
While some of these numbers might not sound like a huge problem, the team suggests that any hit rate over 1% means Captcha is too broken to continue in use. Since the cost associated with having a computer try again and again to solve the Captcha is so low, those with malicious intent could blow through this security measure with no problem. Most companies use various layers of security, but Captchas are relied upon heavily for weeding out bots.
The Stanford team had no luck whatsoever with Google’s ReCaptcha system, which is used widely. This indicates that the visual filtering and de-blurring techniques aren’t entirely there, but its success with other systems could mean it’s just a matter of time.
More like this
17
Comments
Comments are closed on this article
Silencer
November 01, 2011 at 1:31am
Maybe one of the spammers' links, will take us to the new 'plug-in'. I'd like to be able to post here, as easily as they can! :O)
URGjM was this captcha!
SeverianSilk
October 31, 2011 at 9:32pm
Age old problem in security. If something can create it, something can figure it out. I say we adapt the xkcd method and have captcha ask questions like "Did you cry when Littlefoot's mother died?" To determine if you're human.
thetechchild
October 31, 2011 at 10:03pm
But how would you determine the questions/answers? Pre-create a list? That would fail as a deterrent for obvious reasons.
All that needs to be added is more blurring and warping of each individual character in multiple font/color renderings, with a *random* element applied (pseudo-random, technically). If you have a character with 15 colors, and all the characters are of different size, warping, blurring, and orientation relative to the one before/after it, then you have a confusing word. Add in a distorted grid of easily distinguishable but still varied colors in the background, and you now have what looks like a rainbow mess to a computer, but a distinct word to a human.
SleepyCatChris
October 31, 2011 at 6:12pm
Serious question: has their funding been looked at to see if spammers might somehow be involved?
thetechchild
October 31, 2011 at 10:15pm
Wrong question to ask. That's like asking "are security researchers affiliated with hackers?" Taking the side of the paranoid corporations, suing and condemning those who advocate better security, is an idiotic stance. Regardless of whether or not this work could be accessed by or supported by spammers, the work itself is applicable. It proves beyond doubt that it can be done, and therefore even if spammers couldn't steal it directly, we now know they would get there soon.
A better question would be :
How and why can captchas be improved in order to thwart such methods? (or, how is ReCaptcha avoiding these flaws?)
I Jedi
October 31, 2011 at 4:01pm
This is great news, as we can finally get rid of our captcha here at MxPC.
Holly Golightly
October 31, 2011 at 7:55pm
Yes, they should have ditched captchas long ago. As a tech site, they really should have posted this info themselves long ago. Sadly, I see see those annoying captchas, and I just want MaximumPC to just get rid of them already.
thetechchild
October 31, 2011 at 10:22pm
Funnily enough, there's quite a lot of spam on MPC... (or there was, recently) Perhaps they should've implemented peer review system (spam flagging) and autobanning of major spammers.
Also, instead of blocking or alerting if it's "wrong", simply have the user complete new ones until he/she/it thinks that one was correct, and also have autobans in place for high failure rates or extremely high overachieving (in captcha submission count). [Note that this does require you to remove any "choose different image" options]
Since you don't know how many you got right until it's over and done with, bots will have to statistically guess how many they need to complete based on their average success rate, while humans should be relatively sure after 2 or 3 tries that one was good, and have at least a 50% pass rate.
Captain_Steve
October 31, 2011 at 3:15pm
This is good news for Maximum PC; they no longer have to feel bad about not being able to keep the bots out of the comments section.
kixofmyg0t
October 31, 2011 at 4:01pm
Very good web.
visit www.maximumpc.com PC review! very nice for you!
you wil love!
(actually tried to look for a actual spam post to infringe...err...copy and couldnt find one. +1 to max pc staff for cleanin up! Also the fact that I got hit up with a capcha in posting this is just bitter irony lol)
ABouman
October 31, 2011 at 4:24pm
Not entirely sure what's working but we HAVE seen a lovely absence of spam latley...
Silencer
November 01, 2011 at 11:22pm
Wow! Really?!? Dear?!? Where? 'Cause, NOT ME! I see it everywhere, even some *HERE*!
While trying to post this at 6:36pm EST 11/1/2011, I did see this though (and all the time too):
Your submission has triggered the spam filter and will not be accepted.
Lovin' it. I suspect a stupid IP ban, 'cause I posted a few times, or too fast or something.
I'll be sure to post this, *when I can*. Idea: Lose all of this B.S. It ain't working, and, it's f'ing me up.
ABouman
November 02, 2011 at 10:32am
I check the comments every morning when I get in, and every evening before I leave, in order to manually delete any spam that gets through manually. Lately, I haven't been seeing as much spam, however, yesterday I was out of the office, so the spam wasn't removed.
That being said, I understand that the current captcha system is not working and I'll be discussing alternative solutions with our web dev team soon.
Silencer
November 04, 2011 at 7:09am
Good Morning Hotness!
Just saw 7 fresh spams. The most recent 7, here, as of now:
http://www.maximumpc.com/article/windows/microsoft_announces_first_real_details_about_windows_8
Cya! ;O)
Silencer
November 02, 2011 at 11:35am
Thank-you! :O) (U R so, u no!)
... To complete this form, please complete the word verification below. ...
Neel Chauhan
November 01, 2011 at 8:22am
Why doesn't Maximum PC use Google's ReCaptcha instead of whatever is used now.\
By the way, my captcha was MZikQ
kixofmyg0t
October 31, 2011 at 5:29pm
Until now. Funny, I had to do a capcha on every post in here but a bot managed to post spam....
Connect with MaximumPC
Featured Content
The gang discusses the GTX 690, Trinity, Ivy Bridge, Amazon, big-box stores, MMOs,...
This month's issue
Feature
Build a PC On Any Budget
Feature
Cloud Services Showdown
How-To
Encrypt Your External Drive
Build It
Upgrade an X58 Rig
Most Commented Articles
Latest Max PC Tweets
- maximumpc: Original RickRoll Video Returns to YouTube After 24-Hour Copyright Hiatus http://t.co/MaH9Sxyy2 days 3 hours ago
- maximumpc: Corsair has decided not to go forward with its $78 million IPO, citing weak equity market conditions http://t.co/A5a4DAzj2 days 3 hours ago
- maximumpc: Want to work at Maximum PC? Our Online Managing Editor, Alex, is moving away, so we need a new one. http://t.co/9Z7JCh0E4 days 1 hour ago
