
That feel when you can't captcha [video] - akkartik
https://www.youtube.com/watch?v=zGW7TRtcDeQ
======
jstanley
It used to be some benign OCR task, now it's "please identify street signs
from photographs we've taken". Once they can correctly classify street signs,
what else will they want? "please click on the faces you recognise?"? "please
click on the faces of your friends that are labelled with the correct names?"?

I've started opting out of Google Captcha's wherever doing so isn't too
burdensome. If I see a Google Captcha and I don't _really_ want to get to the
other side, I just close the tab and forget about it, rather than subject
myself to their capricious gatekeeping.

~~~
userbinator
Some people I know online have basically started buying "captcha tokens" \---
the same ones that spammers use when they want to bypass them in bulk.
Depending on your morals (keeping in mind these services are mainly third-
world-country sweatshop labour), it might be a better choice than spending
your own brainpower on such things, and a way of giving Google a virtual
middle finger.

~~~
mikeash
Doesn’t Google get what they want either way?

~~~
userbinator
They get solved captchas, but they're not using the user's brainpower and time
to do it.

~~~
andrewchambers
All google cares about is getting the captchas solved to train their AI.

~~~
NullPrefix
Cut the middle man out, they could hire the sweatshop directly.

------
Spivak
I use the Tor browser pretty frequently so I've gotten pretty good at these.
It's much easier once you realize that there are three sources of data that
determine correctness: basic computer vision, hurried/lazy humans, and a lot
of bots. It's not about truth it's about following the crowd.

\- Forget the slivers. If it's not more that 75% of the square forget about
it.

\- Anything not in the foreground might as well not exist.

\- Poles != Signs If you saw pole sticking out of the ground you wouldn't call
it a sign would you?

\- It's not about whether it's a storefront, it's about whether it obviously
looks like one. If you spend literally any time thinking about it it's a no.

\- Mark the most prominent vehicle and skip everything else. Only mark a
second vehicle if they're equally sized.

~~~
birksherty
So that means we have to think like bots not humans. Otherwise it wouldn't
have these rules and people would easily solve these. What's the point of
captcha?

------
candiodari
I remember 15 years ago making a neural net captcha OCR cracker (for DNS
registrations). And after about 3 hours I have my accuracy, recall and
confusion numbers and I'm not really getting them any better. This was a
captcha like from those old PHP libraries. Many colors (sometimes bright
yellow on white GRMBL), varying background color, a few things on the
background that were clearly not letters (like large circles).

Now in order to train this network I had to download 1000 or so captchas and
solve them manually, so I had written a quick program that allows a person to
solve captchas. So I figured "let's see how good it is", and used the program
to test myself (I figured, worst case I have some more raw data).

Turns out the neural net was 2% better than I was. It actually scored 2%
better on captcha solving than I did, and this was when I was trying really
hard, pausing when there's doubt and giving it 5 seconds thought. I was a bit
surprised that trying really hard or just going with my first guess didn't
make more than a percent difference.

Then I got someone who had nothing to do with IT to solve 50 captchas and
calculated ... precision was 8% below the neural net (also known as she'd do
about 1 in 6 wrong, whereas I only had one in 10-12 or so. The neural only had
one in 14-15 wrong. It was a pretty sizable difference).

And lastly I figured, this is not possible. I'm somehow messing this up. After
all, I should have made that same 8%+ errors on the original set of 1000
captchas I downloaded, did the network really _learn_ to read better than I
can, while being fed close to 10% falsehoods* ? So I generated the set where
it consistently errors. And ... Yep. It did. About 40% of those was just me
doing the ground truth wrong. I fixed them, but it only improved the CNNs
performance slightly.

* of course of those 10% wrong would still almost always have 4 out of 5 letters correct

------
EtDybNuvCu
I feel like users should be compensated for giving Google their time and
mental energy since this is literally making users manually tag their machine-
learning corpus for free.

~~~
IIAOPSW
your being paid with website content.

Take your pick. Do you want to pay with:

1) a few seconds of your mental energy

2) your privacy

3) background cryptocurrency mining

Thats just how the internet work. Content must be paid for somehow.

~~~
kerkeslager
> Thats just how the internet work. Content must be paid for somehow.

Not true. Some (most?) of the best content on the internet is there completely
for free, because people believe in it and put it out there out of their own
pocket.

The internet is _worse_ , because of the content that is paid for by the
methods you describe, than the internet of the 90s when content was there by
the methods I just described.

I do think there's some value in paying artists and writers for their work,
with, you know, _money_ , because those people have to eat too. But I refuse
to buy into this narrative where "I pay you for content and you give me
content" (a consensual transaction) is the same as "I request content from you
and you pretend to give it to me for free while secretly violating my privacy,
stealing my attention, and otherwise screwing me without my consent". These
are _not_ the same thing.

This is _not_ "just how the internet works", it's how a few people have
decided they want the internet to work because it's profitable to them, and we
don't have to put up with it.

~~~
brownbat
> The internet is worse, because of the content that is paid for by the
> methods you describe, than the internet of the 90s...

Yeah, when people comment that online content must be subsidized, I always
find it a little ironic. They're contributing information and analysis to a
discussion. Who's paying the subscription fee?

How could such a lifestyle, where they give away their mental energy for free,
possibly be sustainable?

The frequent rebuttal of "but my comments are low quality and barely worth
anyone's time!" is fun too.

------
drewg123
I miss the days when you just had to help them digitally encode writing. Now
I'm in the same "is the pole part of the sign" situation as this guy all the
time.

Does anybody know if captcha's are triggered or are made harder by ublock? It
seems to me like captchas are easier on my work chrome profile, which does not
have any extensions since I only use it for internal sites.

~~~
rcthompson
I think they are made more difficult by when Google observes "bot-like"
activity coming from you. When they started the "I'm not a robot" checkbox, I
used to be able to just check the box and it would let me through, every time.
Then, one day I had to download several dozen files, and each download had one
of these checkboxes. The first 10 or so files, it let me through like it
always did. Then it started giving me one CAPCHA screen for the next 10 files.
Then 2 screens. Then 3, and so on. That was several years ago, and ever since
then it _always_ gives me a long series of difficult CAPCHAs every single
time. I guess Google still thinks I'm a bot even after several years of
solving these things pretty consistently (I'd say I have about 90% success
rate).

For the record, I do tag boxes containing only sign posts, or only tiny
slivers of signs.

~~~
xirdstl
I find myself intentionally slowing down when completing forms in order to not
appear too bot-like and be forced to complete a captcha.

------
beardog
Part of the reason these are so difficult is that it will intentionally fail
you sometimes even when you're right to prevent malicious bots from learning
off of it, also a decent number of them are not fully solved by Google (they
show you both ones they know and ones they don't).

Basically its meant to be somewhat confusing.

~~~
bradknowles
Many sites do a canvas fingerprint, and send you to the captcha if the
fingerprint fails.

And then it’s captcha hell.

~~~
droidist2
A fingerprint? Like this thing?

[https://panopticlick.eff.org](https://panopticlick.eff.org)

------
akkat
Wait until you go abroad and instead of saying "find the street signs" it says
something in Japanese with no way of changing the language.

------
birksherty
I get these all the time when using VPN/proxy. These are basically harassment
for users.

They replaced the text captcha with these. Google knows that these stops
humans from going in. But, they don't fix it because they need to harvest
data. So, Google is evil. There is no doubt on that.

------
extralego
These Google captchas were much easier about 1 year ago. These days, I stop
and ask myself “Do I _really_ need to get past this guard?”.

------
mcochrane
I think it depends a lot on your IP too. I tried to do some google captchas in
TOR browser once and it took forever! Just like this video, even when you got
it right it still kept asking for more..

~~~
Baeocystin
Happens relatively frequently when using a VPN. If, for whatever reason, the
IP I'm using is currently getting the captcha-hell treatment, shifting to a
different exit address clears it up 95%+ of the time.

------
tziki
Someone should create a neural net that does this for you.

~~~
YaxelPerez
And train it by making people identify the correct solutions to get access to
a website

~~~
digi_owl
Heh, i recall claims that hackers where using Amazon's Mechanical Turk service
as a means of defeating captchas their botnets encountered.

~~~
amelius
I recall that hackers were sending captchas to porn sites. "Want to see this
picture, then solve this captcha." And then the answers were redirected back
to the original, legitimate site.

~~~
droidist2
True, sexual drive can be a great motivator. Porn users are tolerant of a lot
(popup ads, etc.)

------
gustavmarwin
The Chrome plugin Privacy Badger
([https://chrome.google.com/webstore/detail/privacy-
pass/ajhmf...](https://chrome.google.com/webstore/detail/privacy-
pass/ajhmfdgkijocedmfjonnpjfojldioehi)) is supposed to be useful to avoid
those.

I haven't been able to reach a conclusion on whether it is effective, anyone
uses this?

------
21
So, are you supposed to click on the sign support sticks?

What about squares which have just a sliver of the sign?

~~~
lstamour
Technically the sign support sticks aren’t signs. And some of the signs
clicked on weren’t street signs, if you identify street signs as those put up
by a government agency to regulate or assist with driving on a street. Also,
he clicked a hotel, which isn’t a storefront. When Google says storefront they
mean a multi-tenant store facing a street with a big sign indicating the
store’s name or purpose. Sometimes these locations are closed, but they rarely
look like hotels, houses or apartments. I have also had to pass, twice, by
saying nothing was relevant and not clicking anything. I’ve also had it show
me streets with cars and had it ask me to select storefronts... (Trick
questions, maybe to see if I click wrong then change my mind?) And I’m much
more likely to get it wrong on my iPhone than on a computer, perhaps Google
doesn’t have as much mouse movement data that way, and can’t fingerprint an
iPhone as uniquely?

------
caspervonb
Hard on humans, easy on bots.

------
hippich
We are working on hashcash.io - replacement for captcha. no more frustration
to guess what google meant, just computer proof of work and you are good to go

~~~
jraph
Please, do not drain my batteries, waste resources of my planet and make me
(or my employer, or my coffee shop, or my train company, or my library) pay
electricity to prove I'm not a robot.

Please, do not make Internet an energy hog more than it already is.

~~~
lomereiter
Your last statement theoretically could be addressed by tweaking the algorithm
settings such that it consumes at most [the time it takes for a human to solve
reCaptcha] x [average power consumption of a smartphone]. Not sure if it would
still hold its purpose, though.

------
sbov
I used to never get these back when I used Chrome. I started getting them once
I switched to Firefox. Is this a thing? or was it coincidence?

------
fractallyte
So at the end, when he says despondently, "I'm not a robot!"...

Paranoid fantasy: it's a PhilipKDick/BladeRunner thing. You see, actually he
_is_ a robot (as, apparently, are most of us), and this test is designed to
_prove_ it. It's a precursor to the Voight-Kampff machine...

------
ggm
I suspect the bad guys using captcha won't go to the good low barrier captcha
because there's no microcent transaction in it. It's a Gresham's law case: bad
captcha with revenue drives out good captcha with low overhead

------
rajeshpant
Hopefully more sites will upgrade to the new Invisible reCaptcha by Google. I
am using them on my sites and it is certainly less annoying and the user
experience is better.

~~~
philo23
Interesting side note, when Google isn't completely convinced you're not a
robot, it'll actually swap the invisible captcha out for these photo picker
ones.

------
nmridul
Whenever I see this, I intentionally select incorrect boxes. Let the AI eat
those incorrect data. If sufficient people do this, these AI free loading
stuff will stop.

------
DINKDINK
My hope is that in the future lightning network micro payments will be a
better alternative than captchas for rate limiting page access.

------
milankragujevic
cool seeing taran from ltt on hn...

------
baxtr
Oh I hate these so much.

