0

When I found this comic:

enter image description here

I just asked my self, what flaws might this have? The system is sticking up with comments that require more comments on, but it would only be a problem if it where decreasing instead of increase.

And except of it beeing a bit more of an effort then typing a captcha and the confirmance might be delayed, but especially the latter is also solvable by a few solutions that instantly pop into my mind.

And even when at some point even bots get this done, than just as he is expressing aswell: That is just a good thing.

So what would prevent a captcha like mechanism like the one from the comic?

Note: This is not to be directly compared to CAPTCHAS, but under the assumption, that captchas lost its effectiveness due to more suitable AI.

Improve this question
9
  • "turing-test" probably wouldn't be a good fit for the tag system - it's not a term commonly used in security outside of the acronym CAPTCHA, and discussion of artificial intelligence, and issues relating to it (including security issues) would probably be better on other SE sites: StackOverflow for development, WorldBuilding for "what if" scenarios, ServerFault for hosting (including the "how to build a server an evil AI can't escape from" type questions). – Matthew Jun 7 '16 at 9:56
  • First thing that comes to mind is usability: a user does not want to type a whole bunch of text in order to acces something like a website. Else they start filling in random garbage which would not be distinctable from bot-spam and surely not constructive. – hamena314 Jun 7 '16 at 9:58
  • 4
    I'm voting to close this question as off-topic because it's too broad and solicits opinion – Lucas Kauffman Jun 7 '16 at 10:11
  • 1
    @LucasKauffman: I totally disaggree. I provide a given concept and ask for usability problems that would restrict its utilization. That kind of question I have seen on here perfectly fitting multiple times, while the only thing making it offtopic at all is just the (imho) untenable claim of beeing opinion based. – Zaibis Jun 7 '16 at 10:21
  • 1
    No matter how sophisticated a captcha is, it still can be tricked by humans. Sometimes porn-websites offer free entrance, the only thing the user has to do is login - via their captcha. But the first try fails ... another captcha loads ... they try again ... nope ... another captcha. What they dont notice is, that those captchas they are solving are copies of captchas for serious websites / anti-email spam. With that, the spam-bots get entry to the serious website. The same mechanism would work here: outsource the comment-writing to unknowing users elsewhere. – hamena314 Jun 7 '16 at 11:06
3

Captchas usually work fine for the most part, only in some instances it's hard to guess the captcha correctly.

As an example: Google uses pictures of house numbers. They gathered those pictures with their streetview cars and use the user input to get better results for navigation. (same goes for re-Captcha, which uses parts of books to recognize vague words)

Therefore the user only has to input some digits.

The approach from the comic takes the harder captchas and makes them easier by giving the user a task to type something. This will be considerably longer than those house numbers, resulting in many failing cases.

The other problem is, that captchas are still solvable by humans.

Example: Some shady porn-websites offer the user free access. The only thing they would have to do is login - after they correctly guessed the captcha. So they type the captcha in ... fail. Another captcha loads ... they type in, fail. Another captcha ... (and so on).

Because those captchas are copies of captchas from serious websites, that the attacker simply shows unsupecting users which they will solve for him, giving the spam-bot access to the serious website.

Therefore captchas are there to keep the bulk of non-smart spam-bots out, but are far from unsolvable. The usability must be high enough, so that users can gain entrance without doing too much and having too high of a failing rate.

If spam-bots are smart enough to sucess at every captcha, they simply might copy a nice, well-written and good-looking answer / comment from the same domain as the task and paste it. Often enough people dont read an answer in its entirety, but upvote it since it looks sophisticated.

Then were back at the original problem of spamming: bots post 1000 random comments and get entry with a small number of those. This might already be enough to earn the spambot-author money or entrance to a significant number of systems.

Improve this answer
2
  • But remember, my OP is targeting a cenario where AI is so far that it simply is aber to read out the captchas. So beeing useless. I don't ask "why don't we use this isntead of" And I see why captcha is the better option if we compared both concepts. But actually I just want to know, would this even work at all, regardless of captcha doing it better. Still both your counters are valid. and I'm going to upvote this. but yet its still missing my OP point of beeing not related to captcha. – Zaibis Jun 7 '16 at 11:22
  • I've adressed the point of ignoring usual captchas and use the comment-system, see my edit. TL;DR: spambots can copy&paste sophisticated looking comments and since many people dont read them in their entirety, they get upvoted and pass. – hamena314 Jun 8 '16 at 13:47
3

Remember the actual objective of spam bots. Their purpose is to advertise a website, either directly or indirectly through search engine spamming.

A constructive contribution to a website which also includes an advertisement for some product might get annoying. But annoying posts would get downvoted by other users and thus fail the test, so the bots need to be sublime about this. In my opinion sublime advertisement which looks like constructive contribution but is actually just clickbait is even more dangerous because the reader doesn't realize someone is trying to sell them something.

Black-hat SEO in form of link spam (place your link everywhere on the web until Google thinks you are more relevant than you actually are) hurts the usability of search engines and thus hurts us all, so it should be the responsibility of all internet users to prevent it wherever we see it.

Improve this answer
2
  • I thought more of bots registrating on websites to spam in whatever way they want but writing usefull comments to get past the registration. If they at some point are able to automatically write a usefull comment to register just to afterward spamm in their adds, makes still the tech to write usefull comments be out there. – Zaibis Jun 7 '16 at 11:04
  • In regards to your edit: I fully aggree, I really hate this kind of adds. BUT again, I was more talking about the comments as replacemant of captchas. In the sameway with a backed database that improves itself as CAPTCHAS actually are. So a user who wants to register for some site needs to give another user some advice to a specific situation. unrelated to what they want to post on the site itself. (where the advice is just related to some other 'captcha' comment, not an actual problem itself) – Zaibis Jun 7 '16 at 11:07
2

I don't see how this could work.

The first step is to have the user rate comments as constructive or unconstructive. At this stage, there is no way of knowing if the user is a bot or not - remember, the premise is that ordinary CAPTCHAS are broken. (And if there was a way to distinguish bots from human here, then what would be the point of this whole exercise since the problem is already solved?)

So it is fair to asume there would be lots of bots voting on comments. Bot owners have little interest in training their bots to actually provide correct feedback - they would probably opt for voting everything in one category or just randomizing.

Thus the signal the comment writing bots are supposed to be trained on would just be noise, and no matter how smart your AI is it would not lead to good comments. You have garbage in, so you would get garbage out.

Improve this answer
8
  • 1
    My first asumption about creating a base refference, would be downloading the open and free SE database and reusing all comments of this platform. Should be enough of a valid base set, or do you disaggree?:P – Zaibis Jun 7 '16 at 11:24
  • @Zaibis For this to work you need users to vote on the comments written by other users. But if many users are bots (or just lazy) the votes will just be random noise. Importing comments from somewhere else does not solve that. – Anders Jun 7 '16 at 11:34
  • 1
    Well the SE comments are allready voted. How I can't use this as refference? – Zaibis Jun 7 '16 at 11:36
  • @Zaibis Think of it like this: If all users are bots or lazy, voting at random, comments will get 50% upvotes and 50% downvotes on average. How could you possibly use that to differentiate good from bad or human from bot? I could write a bot just posting Rick Ashley videos and it would get just as many upvotes as a super AI posting profound philosophical insights. – Anders Jun 7 '16 at 11:40
  • Well, I'm just handwaving, but lets say a user has first to simply vote on 6 comments and then add 1 comment itself. while in voting process the user gets internaly a score, evaluated by how highly upvoted that se comment was, versus, did the tested individum up or down vote it. as higher the vote of the ref comment was as more it influences the score about right or wrong voting. The score needs to pass a specific treshhold and in the and the given comment is rated by the individums previosuly made score. I know this is flawed and exploitable but its just an spontanous handwaving. But got it? – Zaibis Jun 7 '16 at 11:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.