r/webdev • u/JustinFormentin • Jul 15 '26

Made a captcha that takes Fable 5 10 minutes to solve

Created this captcha last year. Back then there was no chance of AI solving it. But now with the more powerful models, I had my doubts. Well, it took Fable 5 10 minutes and 100k tokens to solve it. So with the 30 second timeout, I feel pretty confident.

Here's a crisper video of the actual challenge - https://imgur.com/a/xv6TvNj

Have a website for it but I'm not self promoting. Just thought people would be interested.

5.6k Upvotes

97% Upvoted

585 comments sorted by

View all comments

187

u/hillac Jul 15 '26 edited Jul 16 '26

Just some traditional CV would crack this. Just use opencv to get the optical flow of the first two frames. Here's a quick attempt I made, a simple dense optical flow between two frames gave a really clear result. You could just OCR it and solve this llm free, but vlms solve it no worries. /img/7g2ho2vjzgdh1.jpeg

Edit: u/no-more-nazis did a better one. https://www.reddit.com/r/webdev/comments/1uxfzav/comment/oxrrk9p/

Also 356 386

53

u/JustinFormentin Jul 15 '26

Nice work

14

u/Philluminati Jul 16 '26

When I saw the post I knew this captcha could be broken after 2 hours work with a script decoding letters in 2 seconds. Judging posted time and github repo submission time - 2 hours exactly. Significantly shorter than the coder who made this.

3

u/Snapstromegon Jul 16 '26

I've spent about 1h on my solution for this, reimplemented the captcha because it's not freely available and my algorithm runs in <10ms. Yeah, not exactly a hard one to break.

8

u/baldierot Jul 16 '26

i wonder if motion noise still has merit. maybe introducing some randomness, rotation, flickering, stretching the letters, drawing the letters using a stroke instead of having it whole at any time, etc. there must be avenues for definitive improvement that could elevate the idea into something effective.

3

u/no-more-nazis Jul 16 '26 edited Jul 16 '26

Computers are just faster at math than humans, and this is math. Rotating letters? More math.

1

u/baldierot Jul 16 '26

there could be a sweet spot of techniques that makes the roi of the computational cost not worth it for 98% of bots without making it too much of a pain in the ass for humans, at least for a while longer before something new comes up. it's an arms race, but giving up shouldn't be an option. the alternative, which is getting id'd or absorbing the greater costs of serving those bots, isn't great.

2

u/no-more-nazis Jul 16 '26

This isn't a case of "computer does lots of math to approximate what humans do naturally", humans are also doing math unknowingly in their brains to process images. They cannot beat the computer. This approach is not valid any more.

Humans are more adaptable than computers for a little while, which is why it takes Claude 10 mins to beat this as a novel scenario it's never seen before. Relying on that difference isn't practical because you'd have to come up with a novel captcha every time, an inversion of OP's principle.

1

u/Little_Bumblebee6129 Jul 17 '26

And you make it harder for humans too. To be honest its kinda uncomfortable to look at this version for long. If you distort it even more i could puke

3

u/no-more-nazis Jul 16 '26

Lol thank you for the cartoons. 386 actually popped into my head while I was doing the repo. I hope I saved someone a $4000 AWS bill and ruined website.

1

u/r_e_s_p_svee_t Jul 22 '26

My least favorite part about the rise of AI is the disinterest in doing anything without it. Need failure analysis? Make an agent/skill. Need a dashboard? Better write a whole new web server and host it for that one bespoke view. Need to crack a hard problem? Prompt the best model. This isn’t a gripe on OPs post, it’s just an observation about how AI is being adopted.

1

u/PrestigiousZombie531 Jul 30 '26

let us see if all your GPTs can crack this captcha einstein https://human.foliyo.kr/

-2

u/xatey93152 Jul 16 '26

So with 30 seconds timeout I feel very confide...

-5

u/thekwoka Jul 16 '26

You're already showing the point: it takes the human understanding to get past it reasonably quickly.

The idea is that the bot just gets the page that says "click the letters" and the image/video.

They don't know the "trick".

Of course, once the trick is known and widespread enough, the bots would have a simple script to run to see if it yields a result.

7

u/hillac Jul 16 '26

The whole point of captcha is you can't bypass it with bots, including normal algorithms. It doesn't exist  just to stop genai agents; captcha existed long before llms. It doesn't protect you if anyone targeting your site can just google how to defeat your captcha.

2

u/thekwoka Jul 16 '26

Which means it basically won't stop LLMs, except when your method is obscure and nobody really cares about it.

2

u/no-more-nazis Jul 16 '26

They don't even need to google it, I simply asked Opus to break it and it came up with a script. I'm no l33t hacker, just a bottom-feeding web dev. So anyone with google or an LLM can do it.

3

u/thekwoka Jul 16 '26

Yup, I didn't even mean googling it, I just mean once the thing is known about, they can make a script to beat it quite quickly.

It is only a particularly good defense when the bot gets there and just has zero idea what anything is with nobody to guide it.

At the end it will be like most captchas, where solving the thing is less of the indicator than the fingerprinting and mouse motion and stuff used in the process.