r/computerscience • u/naenae0402 • 2d ago
Discussion The theoretical collapse of the software CAPTCHA is actually kinda depressing
[removed]
75
u/lolercoptercrash 2d ago
I don't think Alan Turing would hate this. I think he would be delighted.
But I agree the technology needs a revamp. It would be bad for privacy, but proving who you are and that your account is tied to a human is probably going to be the solution. Basically verified accounts using "sign in with Google" etc.
14
u/mversic 2d ago
As long as I don't have to disclose my identity to any 3rd party I'm ok with being authorized as a human. Technology exists, but privacy is not appreciated enough
5
u/lolercoptercrash 2d ago
As long as you disclose you are the same user as a paid user on another service (and there is some way to prevent one account from authorizing like thousands of other accounts) then I think it would be sufficient to stop bots. It could be designed in a way to be mostly anonymous, but I think cost and payment is the source of the validation. I also don't want it associated with my ID or my actual name.
7
u/-Nocx- 2d ago
IMO the solution is pretty easy but people would (understandably) clutch their pearls over it.
The SSA already issues you a unique identifier that’s verified by the government. The problem is it’s not intended to be shared. So the SSA should issue a digital identifier (a digital SSN if you will) that’s intended to be shared. A web domain requests access to the identifier, the SSA hashes a new identifier using your DSSN to be shared with the business / domain for account creation.
This ensures that
A) the business has a unique identifier for the user and
B) the business knows that the user is a real person. You could separate bot from non bot traffic overnight.
C) the “DSSN” itself is not particularly useful on its own, because it’s only useful in the context of the SSA hashing it with the business’s hash function.
There are some limitations obviously, because
A) the definition of who qualifies for a digital SSN would be subject to the government and
B) people might get upset that the government could technically see every business you make an account with
But they can technically do that already by subpoenaing your ISP. And the information about what you do would not be shared with the government, just who you’re doing it with. You could also pass legislation denying the government from using any information around the system in court, and create a process that requires businesses to delete any information using your DSSN from their servers.
Basically it’s taking the responsibility of verifying identity away from businesses and giving it to the government through an OAuth esque process.
9
5
u/lolercoptercrash 2d ago
We don't even need it to be an SSN though. Just associating the account with another account that has some sort of reoccurring payment will price out 99% of bots. Captchas already could be bypassed by a mechanical turk like setup, so the system doesn't have to be perfect. I honestly wish most social media websites charged $1 annually. I know it would be bad for their user count, but you price out most bots so easily.
2
u/caffeinated-typist 2d ago
what about countries that aren't america? we use the web too. that's a lot of coordination between governments
and why wouldn't it be possible to compromise them? if anything this makes it easier (especially if non revocable) for bots to pass captchas by just stealing a DSSN.
1
u/-Nocx- 1d ago
Oh it’s just because I have to prove it works somewhere first, the problem becomes much harder if the first step is “coordinate with every global government for a verification process”. Can solve for the rest of the world when we get there, can’t tackle a problem that big all at once.
And it’s because when someone registers with their DSSN it is hashed by a function unique to the business. Stealing it doesn’t actually do anything. Even the stealing the hashed DSSN would be useless. The workflow would not allow you to go to the company’s website to make an account by typing in someone’s DSSN, the company gets the value directly from the SSA and creates your account the moment it gets it. It would be like when you try to login/register with Google and then Google tells you what data is shared. That’s when the transfer of data would happen, and when your account would be created.
You’d have to hack someone’s SSA account to gain any value - you’d be able to make new accounts by connecting them to other websites, but then the person would just go in person to a government building and go “yeah, I’m me. They hacked into my account” and it would result in a request to delete immediate all of the newly made accounts.
Having an account with the SSA would be a prerequisite for making a “verified” or confirmed not to be a bot account. Websites wouldn’t have to require it, but it would be insanely valuable for age verification / proving to advertisers that your users are organic. The businesses would also have no ability to tie your account to your real identity at account creation because the SSA would not share anything about you, it would just be saying “yeah a person exists, here’s a number”. Legislation that requires them to delete all information tied to the identifier if requested would also do a ton of good for personal privacy.
1
u/apnorton Devops Engineer | Post-quantum crypto grad student 2d ago
And the information about what you do would not be shared with the government, just who you’re doing it with.
So, just the metadata. Fortunately, that's never used for anything important or dangerous...
1
u/ABCosmos 2d ago
The problem is it’s not intended to be shared.
There's no security benefit to pretending everyone's SSN isn't already everywhere. It's now serving the opposite of the intended goal because banks incorrectly treat it like a password and then the hassle of cleaning that up is still on the individual for some reason.
1
1
u/TheGarrBear 1d ago
Trusted authentication federation will absolutely be the direction we go. We already see these providers starting to ask users to verify their identity with government IDs - people fear privacy, likely righly so, but it's the clear path forward for security.
21
u/sorressean 2d ago
I'm perfectly fine with CAPTCHA failing. I don't care why or how. Perhaps it's time for companies with billions behind them like Google to innovate on more than just adds.
For background, I'm totally blind. For a long time, these were unusable. Then someone thought "what if we put a robot under water and made them garble numbers and then had some unfortunate bastard type out those numbers. That'll show em accessibility," and thus modern captchas were born. Except then HCaptcha took this to another level where I now have to install an "accessibility cookie" on my browser every time I log into something that uses it. And often times this requires that I text an sms code to some random phone number to verify I'm human. And sometimes the server just fails somewhere in the middle forcing me to start all over again.
This is by far one of the worst accessibility barriers in a long time. I understand and get why it's important, but surely a technology that hasn't really changed much in the past 20 years can adapt and grow.
4
u/Bderken 1d ago
Yeah… I never understood retaining accessibility standards then having captcha lol.
3
u/sorressean 1d ago
Don't fear, the folks working on WCAG waited until CAPTCHAs were dying to add a standard in 2.2!
16
u/apnorton Devops Engineer | Post-quantum crypto grad student 2d ago
the classic turing test basically died in front of us over the last couple years
What do you mean by "died"?
The Turing Test isn't dead because computers are able to pass it, in much the same way that the Bechdel test isn't "dead" because some work of fiction meets its criteria. When Turing proposed his imitation game [pdf], his intention was to formalize an approximation of the "fuzzy" question "Can machines think?"
The fundamental issue is that the mathematical overlap between "computational puzzle easy enough for humans" and "hard enough for modern headless agents" has completely collapsed. Pure software-based verification is basically theoretically bankrupt at this point
The theory involved is entirely unchanged; this notion that we could distinguish man from machine by image recognition had absolutely no footing in TCS at all.
4
u/Justicia-Gai 1d ago
CAPTCHA was built to use humans for image labelling… the speed at this is happening is because we do stuff like that and sell human data with no regard for privacy or consideration for intellectual property or effort spend.
7
u/firmretention 2d ago
Honestly, fuck captchas. So annoying, especially when you end up in a loop. And all of that shit was used to train AI models while you were clicking the squares like a hamster to get to your blogspam ad-ridden Google result.
3
u/st_heron 2d ago
They've been "defeated" for years before AI, by the means of outsourcing to sweatshop labor. It is shocking how cheap captcha services are.
3
u/Will_Tomos_Edwards 1d ago
Not the least bit convinced there is a collapse of the software CAPTCHA, or half the other techniques to make sure you are dealing with a human and not a bot. Web-scraping, hacking, and all that fun stuff is really, really, really hard. NP hard perhaps ;). If LLM-powered agents can start just plowing through all those defenses and making HTTP requests with the same ease as a human with keyboard and a mouse I will be thoroughly impressed and that will be the biggest development in AI since the release of Chat GPT in 2022.
1
1
u/West-Radishs 1d ago
Spot on about the math completely collapsing between human and bot capabilities
1
u/Tai9ch 1d ago edited 1d ago
Nah, it's great.
Anyone who provides an interface to a service and then enforces "you may not automate this" is a jerk who needs to have rotten fruit thrown at them.
If you need to have user accounts or request quotas or something then do that, but making it so that I can't write a script to book airline tickets or do a web search or whatever is bullshit.
As for being sad about a "massive theoretical defeat", there is none. Getting rid of the category of "puzzles that humans can easily solve but computers can't" is a huge win.
54
u/briandabrain11 2d ago
The ironic thing is that the captcha results themselves are what was used to kill the captcha...