> Their audio captcha (no longer available?) involved listening to 3 MIDI tunes and picking "the sad one".
Given that a large part of the world doesn't use the major/minor dichotomy, or even equal temperament, this seems like a terrible way to verify someone is a human...
My favourite recaptchas, if one can have such a thing, are the shape sequence selection ones as they don't make significant assumptions about culture or education.
I'm very much of the opinion that almost all modern captchas are american-centric. Mailboxes, fire hydrants, Trams are not recognizable for billions of people.
My “favorite” ones happen where the site doesn’t pass on the language and you get a captcha in another language. So now you have to google translate and hope to language gods that the word doesn’t have multiple meanings.
I've had this happen to me before [0]: I just got one "mark everything that shows bikes" with pictures of cyclists, motorbikes and cars. The translation used the norwegian word "sykler" which to me is the human powered one. But it looked like it wanted me to also select motorized ones as well. That's something that's lost in the translation.
Assuming the content is in Japanese this is probably the expected result though.
For international websites it would be good to follow the users chosen language. But if a website doesn't have a english version(or other alphabet based version), expecting alphabets in a captcha is not very reasonable.
> expecting alphabets in a captcha is not very reasonable.
As an American expat living in a country that doesn't speak English by default... I'd say it's fairly reasonable. Captchas aren't the responsibility of the site owner, the captcha integration docs should explain how to pass the language through to them and should require developers to do so.
> Mailboxes, fire hydrants, Trams are not recognizable for billions of people.
Cheese is though? And I'm pretty sure most of the world would recognise those things anyway - you forget how much American culture is spread through films and TV.
Putting aside the fact that at least 50% of the world doesn't speak English and might not even know what "cheese" is, a lot of the world does not subsist on dairy products or use cheese and will not recognise images of cheese. Neither will they understand the traditional American schoolbus which is a very distinctive thing and will pick any old bus that appears on the photos as long as it looks like a large motor vehicle. Very few people percentage-wise will know what "crosswalk" or "sidewalk" or "mailbox" mean because these are very specifically American terms
Just for context, 65% of India is rural and a ton of these people do not have access to the internet and will have zero idea how to get through these arcane captchas. The internet is effectively locked off to them
Jeez you're right, how could I have overlooked the cheese?! I thought it was even worse than it is, assuming you're supposed to associate the camera with someone taking a picture and saying "cheese".
Is swiss cheese strictly American? That's the only one a user would need to know to proceed. They don't have to identify anything else beyond "not cheese".
Chinese captchas can be much worse when you're on domestic websites, to the point where I need to get my wife to solve it for me because I'm not sure which character doesn't have a specific stroke
Sure you can, but it's not trivial to make the random seem like a human random at a large scale. What are the parameters of a human slide and what kind of distributions are they? And there might be things they do under the hood that affect those parameters like fingerprinting. You would need a lot of data to imitate a human, but the provider of the captcha has a lot more data than you to counter your effort.
Thats why it's usually just easier to pay some people pennies to solve them by hand.
It feels like all of the captchas/alternatives are suffering the same problem of "computers are just better than people". By 2025, captchas will require in depth knowledge of American culture. I got this image from a time traveler: https://postimg.cc/3WrTbgmF
It's like they're maximizing ML success rate while minimizing non-white success rate. This is absurdly transparent implicit bias. I don't know how these things make it out the door. I don't get how these things can be shown and someone says "Yeah, I want that. I'll pay for that." Just pathetic all around.
It's probably no longer available because picking out "the sad one" just amounts to picking out the one in a minor key. Machines should be able to do that fairly easily.
That's the ironic part, machines are able to solve these just fine so they defeat the purpose entirely.
I wonder, does recaptcha work with your google account? Because at some point a lot of people will end up doing some kind of identity verification on there. But I think Google and co can make a reasonable assertion about being human by looking at activity across said Google account - location, emails, documents, etc.
> That's the ironic part, machines are able to solve these just fine so they defeat the purpose entirely.
I wonder if the strategy is to create such a large number of different tasks that it becomes practically difficult to build solutions for all of them individually.
For instance, detecting 'sad' music is an easy task, but what if that is only 1 of 500 possible Audio-Captcha types - which also include 'select the angriest speech' and 'identify which music was played on a record player'. Individually these are probably moderately easy to solve, but if they can write/create new Captcha types quicker than people can solve them, they would stay ahead (unless someone can generalise them - but generalising is a much more difficult challenge).
It's effectively the WarioWare approach to Captcha's - an individual WarioWare game would be trivial to automate/solve, however automating the full WarioWare series would be a real big task (again, unless some sort of generalised AI can be used).
They could even employ some interesting strategies with who/when they show particular catcha types to in order to throw off bot writers.
The strategy is security through obfuscation. Solutions to solve some specific CAPTCHAs haven't spread through the CAPTCHA-solving ecosystem yet. Solving most of these CAPTCHAs are easy, and you could probably repurpose and retrain existing solutions given enough data.
> Solving most of these CAPTCHAs are easy, and you could probably repurpose and retrain existing solutions given enough data.
You are right that you can probably repurpose / retrain solutions fairly quickly, but if the CAPTCHA-creators can create frameworks to create new Captcha-types fast enough (e.g. put a structure in place so it takes 1 person a day to create a new type, and you can have a team of 20 people churning out new ones constantly) then the economics of running a captcha-solving team becomes exponentially harder, and building a captcha-solver involves a lot more work.
i.e. If it is quicker to create a Captcha rather than solve it, and the people who are creating the Captcha's have more resources than the Captcha-crackers, they will stay ahead.
Security through obscurity is a valid strategy to slow down efforts, and will definetly help when you have teams of people working to defeat your security.
For many tasks it's cheap enough to hire captcha solvers. From that we should assume that a vastly larger number of tasks become cheap enough if someone trains automated solvers on the output of the human solvers.
It doesn't need to be perfect either in most cases - just good enough that you can drive down cost progressively by trying an automated solver first before passing it on to a human if it fails.
Ultimately you'll only stop people in those cases where the monetary value of bypassing it is very low. (EDIT: And because such solvers are reusable, you need to effectively never re-use captcha types between high-value targets and low-value targets or people will end up training solvers on high-value targets as part of paid services and they'll trickle down to lower value targets as soon as they're automated fully)
Frankly, some captcha's are getting obnoxious enough that we're getting close to the point where I'd be willing to pay for a subscription service to have people solve captchas for me just for my own personal use.
Their audio captcha (no longer available?) involved listening to 3 MIDI tunes and picking "the sad one".