OCR and Neural Nets in JavaScript
A pretty amazing piece of JavaScript dropped yesterday and it's going to take a little bit to digest it all. It's a GreaseMonkey script, written by ‘Shaun Friedle’, that automatically solves captchas provided by the site Megaupload.
Context & Ripple Effects
The CAPTCHA debate was already underway in coverage questioning whether CAPTCHAs could keep working, while an earlier account showed that these challenges could also turn human responses into book-digitization work. Friedle's script gives that debate a concrete target: Megaupload's visual gate can be handled from within the browser by OCR and neural-network logic.
First-order effects
- Megaupload's CAPTCHA no longer reliably separates manual users from scripted activity for anyone able to run Friedle's GreaseMonkey script.
- GreaseMonkey users gain a browser-based way to bypass a friction point that Megaupload uses to deter automated access.
Second-order effects
- Megaupload and other sites relying on similar image challenges face pressure to change their tests, because a reusable client-side solver lowers the cost of adapting automation.
- CAPTCHA designers must treat OCR and pattern-recognition improvements as part of the threat model rather than assuming distorted text alone stops scripts.
Third-order effects
- If visual CAPTCHA schemes remain easy to model, anti-abuse systems will shift away from a single static puzzle toward defenses that are harder to replay or automate.
- The episode sharpens the tension in CAPTCHA design: tests useful for human work, as in book-digitization-based challenges, also create structured image-and-answer data that can inform automated recognition.
The trend: CAPTCHA security is becoming an arms race between browser-accessible machine vision and sites' methods for distinguishing automated requests from human activity.