Forgot your password?
typodupeerror
AI Google Security Spam

Google Updates ReCAPTCHA With Easier CAPTCHAs For Humans 81

Posted by timothy
from the destroy-all-humans dept.
An anonymous reader writes "Google today released an update to its reCAPTCHA system that creates different classes of CAPTCHAs for different kinds of users. In short, it makes your life easier if you're a human, and your work much harder if you're a bot. Unsurprisingly, Google wouldn't share too much detail as to how the new system works, aside from saying it uses advanced risk analysis techniques, actively considering the user's entire engagement (before, during and after) with the CAPTCHA. In other words, the distorted letters are not the only test."
This discussion has been archived. No new comments can be posted.

Google Updates ReCAPTCHA With Easier CAPTCHAs For Humans

Comments Filter:
  • by Anonymous Coward
    I'm having enough trouble posting as an AC on /. as it is. Now I will have to put up with Google. Using Lynx with all these crappy images is getting to be a bitch!
  • by Anonymous Coward on Saturday October 26, 2013 @07:09AM (#45243857)

    The CAPTCHA is influenced by what you do after you exit it?

    • Re: (Score:3, Insightful)

      by Anonymous Coward

      Google can't see the future, but we can.

      It's a future in which Google has added so many barriers to using their services that they have no human users left. Only the bots don't care about having to deal with all the added tedium.

    • The CAPTCHA is influenced by what you do after you exit it?

      My guess is that Google watches what you did after the PREVIOUS captcha and uses that to determine how to display upcoming ones.
      This could be useful to detect capthca farms where people sit all day and just solve the captcha for spam bots. If you immediately move from one to the next to the next without spending any time looking at content then it's time to serve you something that takes more time to solve. If, on the other hand, you solve only a few captchas a day they can give you something easy.

    • by Hentes (2461350)

      If you have knowledge of every property about everything and enough computational resources, you can simulate the future. Google has both.

  • Spoiler! (Score:3, Informative)

    by Anonymous Coward on Saturday October 26, 2013 @07:10AM (#45243863)
    They're extending the user categorisation checks. It checks your IP address against a risk and Geo database. You're all smart enough to know what makes certain users riskier (eg: excessive requests, certain countries, is a Tor exit node etc.). They're just doing that properly now.
    • Re:Spoiler! (Score:4, Informative)

      by mstefanro (1965558) on Saturday October 26, 2013 @11:42AM (#45244977)

      I can confirm that this happens for Tor exit nodes. They serve their CAPTCHAs to third-party
      websites as well, and if it so happens that you want to use a website via Tor that uses their
      CAPTCHA on login, the challenges they give you simply cannot be solved. I am not exaggerating,
      I have been trying for ten minutes in the past to login on a certain website via Tor and was unable
      to. Finally, I found the solution at the time: you have to go to google's login page one time and then
      all the CAPTCHA's start becoming readable.

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        Finally, I found the solution at the time: you have to go to google's login page one time and then
        all the CAPTCHA's start becoming readable.

        If you mean you have to go there to log in, rather than just load the page, doesn't that rather defeat the purpose of using tor in the first place?

  • Poor Granny... (Score:4, Insightful)

    by beaverdownunder (1822050) on Saturday October 26, 2013 @07:22AM (#45243891)

    She ends up on a bum IP and ends up getting hopelessly indecipherable gibberish as the verification for paying her electric bill?

    Not sure blacklisting is the best way to go about this...

    • My mother had a run-in with Microsoft's captchas a few times due to failed login attempts and when that happens, she usually asks my sister to unlock her account but even my sister often has trouble with it so she ends up asking me.

      Quite ironic that tests designed to tell humans from machines seem to cause humans to fail so much.

      • by NotSoHeavyD3 (1400425) on Saturday October 26, 2013 @08:16AM (#45244053)
        On those ones have you ever tried hitting the button that's supposed to say the captcha out loud just in case you can't read it?(Which is most of the time) I swear it sounds like some sort of inhuman moaning straight from the Necronomicon that would be more appropriate to summon some sort of demon.
        • by deains (1726012)

          On those ones have you ever tried hitting the button that's supposed to say the captcha out loud just in case you can't read it?(Which is most of the time) I swear it sounds like some sort of inhuman moaning straight from the Necronomicon that would be more appropriate to summon some sort of demon.

          And thus, Inglip was born.

        • Yes, I did try their audio captcha... when I couldn't figure out why the image captcha was refusing my answers, I tried audio wondering how much worse it could possibly be and for the most part, I could not even figure out what the heck I was hearing. Instructions said there was supposed to be a dozen words in there but I only managed to catch 3-4 and did not feel like listening to that gibberish again to try finding the others.

          That made me feel like captchas are worse than the problems they are attempting

      • This is embarrassing... but also terrible interface design. I once spent 10 minutes trying to solve a Microsoft captcha. It turned out that the page was designed such that pressing "enter" to finish the captcha actually triggered some other form option. I tried multiple browsers. And finally... decided to try clicking the submit button with the mouse.

        I wasn't too impressed.

    • Where did Google mention IPs?

    • Why do you (and an AC above) assume it has anything to do with IP addresses? Wasn't that part of a different story on TOR recently?

      My first thought was that it might have something to do with capturing timing of keystrokes or mouse movements, perhaps even before the CAPTCHA is displayed (i.e. while reading the story before trying to comment).

  • So it serves up numbers to humans - does this mean that only computer-hard captchas are going to help reading books?

    Further it knows you're a computer/human already but gives a test to reaffirm this anyway? Seems wasteful but I guess it acts as a safety net and allows better classification in the future...

    • What it could mean is that Google has caught up with the Copyright Term Extension Act of 1998 and finished all notable books in the English language published before 1923. Google has to set reCAPTCHA to read house numbers for Google Maps to pass the time until 2019 when copyrights will start expiring again barring yet another legislative extension.
      • I forgot that's what they were trying to do. So if you see some online books with completely absurd words in them, you can blame me. You see, when I get a CAPTCHA, I always make a good faith attempt to solve it on the first go.

        On the second, I figure that if they're going to screw me around by not accepting a reasonable interpretation of their CAPTCHA, I'll do the same thing: the generated part I try to guess. The photo part, well, for that I'll enter something completely ridiculous.

        Which probably make

      • by mcgrew (92797) *

        Insightful? Mods, he's going for funny. Google isn't using capchas to decipher books, that's silly. They're using high speed scanners and OCR. I have one of those scanners at work*, it will scan 300 pages in about a minute. And the one I have is getting pretty old.

        * We have to send thousands of pages of paper documents to the government on CDs every month.

        • by chihowa (366380)

          Are you going for funny? reCAPTCHA [google.com] has always been about deciphering books:

          reCAPTCHA is a free CAPTCHA service that helps to digitize books, newspapers and old time radio shows.

          reCAPTCHA improves the process of digitizing books by sending words that cannot be read by computers to the Web in the form of CAPTCHAs for humans to decipher. More specifically, each word that cannot be read correctly by OCR is placed on an image and used as a CAPTCHA. This is possible because most OCR programs alert you when a word cannot be read correctly.

          • by mcgrew (92797) *

            Are you going for funny?

            Apparently I'm just ignorant. Thanks for the link, I hate being ignorant (unless you're talking about fashion or sports or celebrities, don't mind being ignorant about them).

  • So if it already knows we're human, why do we still have to fill in a captcha?
    • by Anonymous Coward

      That's the human back-end of their OCR service (e.g., translating pictures, etc.)

    • If the earlier checks suggest it's likely to be a bot, use a harder captcha to double check. If it's likely to be a human, use an easier captcha as confirmation.

      If the system is pretty sure it's a returning user, FaceTuring doesn't require a captcha at all. I don't know if recaptcha ever goes as far as not requiring the captcha at all.

    • by NoZart (961808)

      Because then nobody would do the OCR work for them.

  • "Google wouldn't share too much detail as to how the new system works"

    Easy, it just does a lookup to the NSA, to find out your real name :)

  • The Blogspot implementation: http://googleonlinesecurity.blogspot.com/2013/10/recaptcha-just-got-easier-but-only-if.html [blogspot.com] In order to leave a comment on the post you have to do the following three steps. Step One: Decipher that often undecipherable StreetView street number. Step Two: 'OCR' that rarely legible text from Google Books project. Step Three: Sign-in with your Google or OpenID account. As I see it, the first two steps are completely unnecessary torture of end users for the sole benefit of the Googl
  • 1. Google uses analytics and other techniques to find the IP addresses that are "captcha-busters".
    2. Automate their captcha generator to feed into these with honeypot pages to see which ones they can bust.
    3. Assemble lists of ones they cannot.
    4. Profit!

    It's a dynamic, revolving door, but when automated it's great. BTW I wouldn't mind a new job there, hint hint.

  • uses pictures of Cats that we humans get to vote on - what's funny, who's grumpy, stupid, OMG Kill it! Social experimentation/analysis of the worst kind. Maybe Google will finally be able to profile what is human and will then be able to bear Skynet.

  • the reason we have these human verification systems is obvious, as small group of people are ruining it for everyone. perhaps if we actually have strict enforcement of catching spammers then we wouldnt need all this annoying bullshit.

    right now we are developing stronger armor when what we should be doing is stopping the shooter/spammer.

    • right now we are developing stronger armor when what we should be doing is stopping the shooter/spammer.

      Seems easier said than done! I don't have numbers to support this, but I would think most form spam comes from botnets. As long as Oracle (Java), Adobe (Flash), and Microsoft (ActiveX) products (among others) continue to have security issues, malware will continue to thrive. And so will botnets.

      On topic, as a web developer I ended up just custom coding a little check box that asks if my users are human and programmatically placing the form submit button the page after that is clicked. Since a bot can't

      • Seems easier said than done! I don't have numbers to support this, but I would think most form spam comes from botnets.

        i never said it would be easy but seems it's a very low priority. also, i think punishment should be much higher than it is considering the scale and duration of the spamming. if spammers get sentenced to life in prison, i think there would be a change in how spamming is perceived. it's the risk versus reward issue that keeps spam so prevalent.

    • by tlhIngan (30335)

      the reason we have these human verification systems is obvious, as small group of people are ruining it for everyone. perhaps if we actually have strict enforcement of catching spammers then we wouldnt need all this annoying bullshit.

      right now we are developing stronger armor when what we should be doing is stopping the shooter/spammer.

      The problem is that spamming is a social problem - there's no technological solution to social problems. There's a lot of technological solutions that get close, but none act

  • Everyone knows CAPTCHA's are supposed to discriminate between humans and robots based on their cognitive capabilities, but I always assumed it was the humans they were trying to keep out. *punches random keys in attempt to match what looks like the last will and testament of a deranged chicken with tourettes*

  • ... how long, until the only ones able to correctly solve the captchas are computers ... throughout the last couple modifications to the generated images, it already got to the point where I'd have to reload the images multiple times until I got one that I could get close to being able to read ...but maybe my natural senses are just not up to par with AI ...

  • I've been whining about this for years.
  • by pongo000 (97357) on Sunday October 27, 2013 @03:44AM (#45249835)

    ...no doubt the same techniques used in their excellent spam filter setup on gmail. You know, the one that will repeatedly mark incoming mail as spam even though you have already marked it over and over as "not spam". Or the classic: Google marks as spam incoming mail with a sent-from address that matches an already verified alias in your own account.

    Yeah, I know, there's no way I can be right in light of the thousands of PhD's employed by Google. The collective brainpower is staggering, so Google will always be right in everything they do.

    • by stoploss (2842505) on Sunday October 27, 2013 @06:10AM (#45250161)

      What you describe can happen if the headers in the email appear to be forged. *That* can happen if your email is being routed strangely.

      Here's one example: my organization uses hosted gmail for our domain email. However, our *institution* sold out to Microsoft. We were allowed to continue to use our hosted gmail. "Whew, dodged that bullet!", I thought, until email from other gmail users started being marked as "Person X may not have sent this email", and my Amazon.com order/shipping notifications started being sent to the spam folder.

      What happened? Our institutional overlords required that our email be routed through MS' outlook.com servers. Thus all our inbound email appeared to have forged headers. GMail legitimately ignored my whitelist filter rules when it appeared that the field values for "from:", etc, were forged.

      This may not reflect your situation, but I'm sure there are other weird scenarios where email to/from gmail can appear to be forged.

"Go to Heaven for the climate, Hell for the company." -- Mark Twain

Working...