5 ms·

The only reason why people don't use AI models to solve captchas is because paying humans is actually MUCH cheaper. This is not an advert, I only know about th

by rany_ 1y ago

The only reason why people don't use AI models to solve captchas is because paying humans is actually MUCH cheaper. This is not an advert, I only know about them because it was integrated with Invidious at some point: https://anti-captcha.com/ https://anti-captcha.com/ > Starting from 0.5USD per 1000 images

lan321 1y ago
Half of their employees seem to be from Venezuela. Makes sense considering what they did/do in OSRS to earn a living.
amelius 1y ago
I want this in my browser, and I'll happily pay $1 per 1000 uses.
- samschooler 1y ago
  Lucky you :) https://antcpt.com/eng/download/mozilla-firefox.html https://antcpt.com/eng/download/mozilla-firefox.html
amirhirsch 1y ago
Captcha can detect the same person passing a captcha over and over. We shadow-ban to increase the cost of this kind of attack. Source: I wrote the og detection system for hCaptcha
- rany_ 1y ago
  This is really interesting. How can you detect when it's the same person passing a captcha? I don't think IP addresses are of any use here as Anti-Captcha proxies everything to their customer's IP address.
  - amirhirsch 1y ago
    I don't know exactly what they do now, bloom filters was a thing then, also lots of heuristic approaches based on the bots we detected. the OP agent example actually would fail the very first test I deployed which looked for basic characteristics of the mouse movement Here's a fun experiment for someone: 1) Give N people K fake credit cards to enter into a form, and have them solve a captcha 2) Take recorded keyboard and mouse data similar to the captcha 3) Train a neural network model to identify I've been out of this for 6 years but I bet transformers rock this problem now.
    - rany_ 1y ago
      TIL that keyboard and mouse data is used to identify "bad" humans not just bots. It's a bit freaky but not at all surprising.
im3w1l 1y ago
There is nothing preventing this from becoming an issue. The current internet order is coasting on inertia.
- bugtodiffer 1y ago
  Why is it an issue that non-humans visit your site?
  - diggan 1y ago
    Apparently serving HTML + other static content is more expensive than ever, probably because people go the most expensive routes for hosting their content. Then they complain about bots making their websites cost $100/month to host, when they could have thrown up Nginx/Caddy on a $10/month VPS and basically get the same thing, except they would need to learn server maintenance too, so obviously outside the question.
    - johnisgood 1y ago
      I think this is way too true, unfortunately. I will say this again, but I think lowering the barrier to entry has created more problems or issues than it solved, if it even solved anything.
  - miki123211 1y ago
    3 reasons basically: 1. non-humans can create much more content than humans. There's a limit to how fast a human can write, a bot is basically unlimited. Without captchas, we'd all drown in a see of Viagra spam, and the misinformation problem would get much worse. 2. Sometimes the website is actually powered by an expensive API, think flight searches for example. Airlines are really unhappy when you have too many searches / bookings that don't result in a purchase, as they don't want to leak their pricing structures to people who will exploit them adversarially. This sounds a bit unethical to some, but regulating this away would actually cause flight prices to go up across the board. 3. One way searches. E.g. a government registry that lets you get the address, phone number and category of a company based on its registration number, but one that doesn't let you get the phone numbers of all bakeries in NYC for marketing purposes. If you make the registry accessible for bots, somebody will inevitably turn it into an SQL table that allows arbitrary queries.
metalman 1y ago
from "anti captcha" it looks like they are doing as many as 1000/sec solves, 60k min, 3.6 million an hour it would be very interesting to see exactly how this is bieng done?....individuals....teams....semi automation, custom tech?, what? are they solving for crims? or fed up people? obviously the whole shit show is going to unravel at some point, and as the crims and people providing workarounds are highly motivated, with a public seathing in frustration, whatever comes next, will burn faster
- ACCount36 1y ago
  They're solving for everyone who needs captchas solved. It's a very old service, active since 00s. Somewhat affiliated with cybercrime - much like a lot of "residential proxies" and "sink registration SMS" services that serve similar purposes. What they're doing isn't illegal, but they know not to ask questions. They used to run entirely on human labor - third world is cheap. Now, they have a lot of AI tech in the mix - designed to beat specific popular captchas and simple generic captchas.
- deleted 1y ago
  [deleted]

by rany_ 1y ago

lan321 1y ago

Half of their employees seem to be from Venezuela. Makes sense considering what they did/do in OSRS to earn a living.

amelius 1y ago

I want this in my browser, and I'll happily pay $1 per 1000 uses.

samschooler 1y ago
Lucky you :) https://antcpt.com/eng/download/mozilla-firefox.html https://antcpt.com/eng/download/mozilla-firefox.html

amirhirsch 1y ago

Captcha can detect the same person passing a captcha over and over. We shadow-ban to increase the cost of this kind of attack. Source: I wrote the og detection system for hCaptcha

rany_ 1y ago
This is really interesting. How can you detect when it's the same person passing a captcha? I don't think IP addresses are of any use here as Anti-Captcha proxies everything to their customer's IP address.
- amirhirsch 1y ago
  I don't know exactly what they do now, bloom filters was a thing then, also lots of heuristic approaches based on the bots we detected. the OP agent example actually would fail the very first test I deployed which looked for basic characteristics of the mouse movement Here's a fun experiment for someone: 1) Give N people K fake credit cards to enter into a form, and have them solve a captcha 2) Take recorded keyboard and mouse data similar to the captcha 3) Train a neural network model to identify I've been out of this for 6 years but I bet transformers rock this problem now.
  - rany_ 1y ago
    TIL that keyboard and mouse data is used to identify "bad" humans not just bots. It's a bit freaky but not at all surprising.

im3w1l 1y ago

There is nothing preventing this from becoming an issue. The current internet order is coasting on inertia.

bugtodiffer 1y ago
Why is it an issue that non-humans visit your site?
- diggan 1y ago
  Apparently serving HTML + other static content is more expensive than ever, probably because people go the most expensive routes for hosting their content. Then they complain about bots making their websites cost $100/month to host, when they could have thrown up Nginx/Caddy on a $10/month VPS and basically get the same thing, except they would need to learn server maintenance too, so obviously outside the question.
  - johnisgood 1y ago
    I think this is way too true, unfortunately. I will say this again, but I think lowering the barrier to entry has created more problems or issues than it solved, if it even solved anything.
- miki123211 1y ago
  3 reasons basically: 1. non-humans can create much more content than humans. There's a limit to how fast a human can write, a bot is basically unlimited. Without captchas, we'd all drown in a see of Viagra spam, and the misinformation problem would get much worse. 2. Sometimes the website is actually powered by an expensive API, think flight searches for example. Airlines are really unhappy when you have too many searches / bookings that don't result in a purchase, as they don't want to leak their pricing structures to people who will exploit them adversarially. This sounds a bit unethical to some, but regulating this away would actually cause flight prices to go up across the board. 3. One way searches. E.g. a government registry that lets you get the address, phone number and category of a company based on its registration number, but one that doesn't let you get the phone numbers of all bakeries in NYC for marketing purposes. If you make the registry accessible for bots, somebody will inevitably turn it into an SQL table that allows arbitrary queries.

metalman 1y ago

from "anti captcha" it looks like they are doing as many as 1000/sec solves, 60k min, 3.6 million an hour it would be very interesting to see exactly how this is bieng done?....individuals....teams....semi automation, custom tech?, what? are they solving for crims? or fed up people? obviously the whole shit show is going to unravel at some point, and as the crims and people providing workarounds are highly motivated, with a public seathing in frustration, whatever comes next, will burn faster

ACCount36 1y ago
They're solving for everyone who needs captchas solved. It's a very old service, active since 00s. Somewhat affiliated with cybercrime - much like a lot of "residential proxies" and "sink registration SMS" services that serve similar purposes. What they're doing isn't illegal, but they know not to ask questions. They used to run entirely on human labor - third world is cheap. Now, they have a lot of AI tech in the mix - designed to beat specific popular captchas and simple generic captchas.
deleted 1y ago
[deleted]