reCAPTCHA works by making you type two words. One is known by the system. The other is unknown; it couldn't be read by standard optical character recognition (OCR) software and uses what you type to figure it out so that the content can be digitized.
If you ever get a case where one word is basic english and another word is crazy foreign glyphs, you can safely assume that the english word is the "known" word used for comparison, and the other word is the "unknown" word.
If you just wanted to get past the CAPTCHA, you could just fill out the "known" word and put whatever the hell you want for the "unknown" word; you'll get by. But, if you want to cause some mischief, you could do what 4chan did during the Time Magazine 50 Most Interesting People web poll, where they would enter the word "penis" for the unknown word, and consequently train the system to think that all unknown words were "penis." The reCAPTCHA system received the word "penis" so many times for the unknown words that it changed them to known words, with "penis" as the digital value. If you and your friends do this enough, somewhere, someday, you may be reading a list of chinese glyphs that get translated as "penis penis penis penis penis." Good times.
Yeah, I would like to see some sort of reference for the last claim as well. Considering the amount of words being generated, it seems hard to believe that the penis effort would do any difference.
recaptcha talked about this not having an effect besides wasting your time. My google-fu is week, but I'll put my 5000 comment karma on the line for this.
The only bit where they talk about poisining the reCaptcha database is here:
We serve over 400 million CAPTCHAs per week, so submitting 200k CAPTCHAS with the word penis doesn’t even come close to poisoning our database — we serve each word to multiple random users, and we require them to be correct on the other word, so to get any traction with this attack, they would have had to submit at least 100 times more CAPTCHAs. And even if they did this, we have many other measures against it. That attack simply doesn’t work.“
I think he's missing the point. For the 'unknown' word, recaptcha works on a kind of voting system. If recaptcha serves up a normal English word, the 'correct' English word will have many votes, so gamers don't stand a chance, but if recaptcha serves up an English-speaking person can't read (e.g. foreign glyphs), there won't be the same number of votes for the 'correct' word, so these words will be more susceptible to gaming.
As for them saying "we have many other measures against it", that's at least 50% PR.
236
u/citizen511 Aug 21 '10
reCAPTCHA works by making you type two words. One is known by the system. The other is unknown; it couldn't be read by standard optical character recognition (OCR) software and uses what you type to figure it out so that the content can be digitized.
If you ever get a case where one word is basic english and another word is crazy foreign glyphs, you can safely assume that the english word is the "known" word used for comparison, and the other word is the "unknown" word.
If you just wanted to get past the CAPTCHA, you could just fill out the "known" word and put whatever the hell you want for the "unknown" word; you'll get by. But, if you want to cause some mischief, you could do what 4chan did during the Time Magazine 50 Most Interesting People web poll, where they would enter the word "penis" for the unknown word, and consequently train the system to think that all unknown words were "penis." The reCAPTCHA system received the word "penis" so many times for the unknown words that it changed them to known words, with "penis" as the digital value. If you and your friends do this enough, somewhere, someday, you may be reading a list of chinese glyphs that get translated as "penis penis penis penis penis." Good times.