Breaking the MintEye image CAPTCHA in 23 lines of Python

http://www.jwandrews.co.uk/2013/01/breaking-the-minteye-image-captcha-in-23-lines-of-python/

by cidquick • 14 years ago

129 56 14 years ago

jwandrews.co.uk

StavrosK• 14 years ago

Very interesting article, and an insightful realization. I had no idea Sobel could do that.

experiment0• 14 years ago

What? Edge detection is pretty much the only use for the Sobel operator.

http://en.wikipedia.org/wiki/Sobel_operator

Goranek2• 14 years ago

Breaking captcha is bad, mkay :)

daeken• 14 years ago

No more so than finding security vulnerabilities. Captchas that are trivial to break are going to be broken no matter what, so it's better for someone non-malicious to break it and make it well known, so that people don't use the captcha, than for it to go unnoticed.

hcarvalhoalves5• 14 years ago

If you're using a CAPTCHA, you're doing it wrong already.

brownbat2• 14 years ago

Yeah, all these CAPTCHA stories are definitely making me think there's no refuge left of simple tasks humans can do that machines can't.

What's the replacement? Tying every account to a mobile phone or credit card?

Goranek2• 14 years ago

Hhahahaha, comment on the blog

"Please post the Visual Basic codes for this. The language you post in the article is not Visual Basic.

Thank you."

xD God !

borplk2• 14 years ago

It's totally sarcasm

raverbashing• 14 years ago

Wasn't there something about how 'high' sarcasm is undistinguishable from the real thing.

Unfortunately I can't make the distinction, and I think it's most likely the commenter was serious

hcarvalhoalves5• 14 years ago

Not sure it's sarcasm, more like some blackhat SEO who wants to exploit it.

quink• 14 years ago

It just works on so many levels.

It really makes me wish for some kind of federated comments system or unique username so I can go out and find more of his work!

boyter• 14 years ago

As someone who wrote a captcha decoding article http://wausita.com/captcha/ which ranks pretty highly I can honestly say requests like this are real. Heck I even get abusive emails from spammers when they ask for help and I point out the relevant portion they should read rather then just supplying "tha codez"

If it is sarcasm this guy nailed it. Looks like half my inbox.

borplk2• 14 years ago

I'd love to see MintEye respond.

paulgb2• 14 years ago

"Like all CAPTCHAs, sliding CAPTCHA can be cracked . Still, it's more usable and mobile friendly"

https://twitter.com/EyeOnTheMark/status/291837470486704129

buster• 14 years ago

Its actually a super fun excercise to do. I did that years ago with a browser game that showed images on login, some years ago. Also with python. It was a fun learning experience because it's so much more visual then your typical "todo list tutorial" or "hello world".

mistercow• 14 years ago

That's a really clever way of detecting the swirl effect. As for simply measuring overall sharpness, that could be thwarted by normalizing the FFT after swirling. That wouldn't help against the sum-of-edges technique though (in fact, it would make it worse).

martinced• 14 years ago

Love it. +1.

But wouldn't an obvious answer to this be to use a background full of swirl, then add people onto it, then swirl again (so the background swirl is swirled twice).

Then when you'd be "deswirling" with you code, you'll be finding something always swirled?

maybe even use a background who's "swirled right" and then "swirl left" the "backgroung + people" (or nyan cat or whatever)?

hcarvalhoalves5• 14 years ago

> Then when you'd be "deswirling" with you code, you'll be finding something always swirled?

It wouldn't change what he is detecting, which is the sum of the edges.

moccajoghurt• 14 years ago

Did you read the article?

flaviojuvenal• 14 years ago

remembered me of how Interpol was willing to keep the reverse twirling capability as confidential: http://thelede.blogs.nytimes.com/2007/10/08/interpol-untwirl...

paulgb2• 14 years ago

For those interested, the minteye captcha has been broken by other methods as well.

Speech recognition: https://gist.github.com/4520930

Laplace: https://gist.github.com/4564489

Fourier transform: http://nbviewer.ipython.org/urls/raw.github.com/rjw57/mintey...

aidos2• 14 years ago

Could someone explain the general idea behind using FFT in these situations (excusing my ignorance)? I recall it from my university days but that was completely out of context. I know you can use it to decompose audio signals into frequency components, I don't understand how it applies to images though.

kens• 14 years ago

The basic idea is that just as an audio signal can be decomposed into frequency components, an image can be decomposed into frequency components, but in two dimensions. (Imagine stripes of varying frequency and direction instead of sine waves of various frequencies.)

Sharp edges in an image have high frequency components, just like a sharp transition in an audio signal. Filtering the high frequencies will blur the image, while filtering low frequencies will enhance edges.

This is very oversimplified, but will hopefully give you a bit of an idea. I encourage people to learn more about Fourier theory, because it explains a lot.

One introductory page that you may find useful is: http://cns-alumni.bu.edu/~slehar/fourier/fourier.html

wrt54g• 14 years ago

Since the algorithm can only detect the relative swirled amounts of a set of the same images, a solution could be to, rather than using a set of the same image, use a set of different images swirled different amounts (or with some other transformation), and the user must select the unmodified image.

robomartin11• 14 years ago

This is nitpicking. Well, maybe not.

This code does not take a swirled image and solve it. It takes a set of images with various swirl levels and finds the one with shortest sum of edge lengths.

The code does not do any un-swirling of the image. It also uses external libraries to convert to grayscale, apply the Sobel filter and the sum of edges.

I other words, it is far from breaking the swirled CAPTCHA in 23 lines of Python. If you had to write the un-swirling, gray-scaling, Sobel filtering and summation code in Python you'd be looking at a much larger pile-o-code.

The demo and the intent is good. I just wish the title didn't say "23 lines of". I don't think the article would have suffered at all if the title was "Breaking the MintEye image CAPTCHA with Python".

Again, the intent and what is being demonstrated are excellent. The title, in my not-so-humble opinion, is hugely misleading.

chmod7754• 14 years ago

>it is far from breaking the swirled CAPTCHA in 23 lines of Python

Except it does break the captcha in 23 lines. I don't get your point.

Why would he need to do any 'un-swirling' in the first place? That's not the point of the captcha. The captcha provides you with multiple images and you have to pick the least swirled one - which is exactly what his code does.

And you argue that because he did use external libraries it's not 23 lines of python. Of course it is. He had to write only 23 lines that make up the logic to break the captcha. If you'd argue that one would have to add any previous work (or lines) done by other people to the linecount of your own project, I could also argue that 'print("Hello")' is not one line of python, because it uses some standard python library, which in turn calls native code, that native code would make a few syscalls and at some point resulting in multiple hundred lines of compiled kernel C code being executed.

So the linecount of his 23 lines python script would actually be: 23 lines of python + various libraries + the entire Linux kernel = roughly 20 million lines of code. Good job.

And yes, that was nitpicking. And I'm angry for some reason.

cidquick5• 14 years ago

Well put. The title is indeed completely factual! Including '23 lines' was just to let people know at first glance that the solution is simple.

> If you had to write the un-swirling, gray-scaling, Sobel filtering and summation code in Python you'd be looking at a much larger pile-o-code

I would also like to point out these are also all very simple operations, which would only take a few lines of Python/C/whatever to do. Python just happens to have a pre-written libraries to save reinventing the wheel.

floody-berry• 14 years ago

If you aren't going to have a cut off point for what is considered solving the problem and what is considered ancillary, then you can define new languages where a zero byte input stands for whatever solution you want, simultaneously one-upping everyone and contributing nothing to the conversation.

robomartin11• 14 years ago

No need to be angry. None of this is going to remove food from your table or affect your life in any way whatsoever. Take it easy. I am just opening the topic for conversation. We can discuss things without pulling out semi-automatic weapons, right?

When someone publishes code and says something like "solved <problem> in <n lines> of <pick your language>" there generally is an implied "my language is better than yours" subliminal message that, for some strange reason, is based on line count.

Let's not debate the merit of line count as a measure of how good a language may or may not be. If we are going to go there I'll write the same solution in APL and we'll start counting characters instead. Again, line or character count, in my opinion, is not a measure of the "superiority" of a language.

The 28 line solution is not pure Python. How do we define pure Python. Let's just say that "solved <problem> in <n lines> of Python" to me means that you download and install Python:

http://www.python.org/download/releases/2.7.3/

Install nothing else whatsoever and write code that solves <problem>.

OpenCV, which is what the author used for a couple of aspects of this code, is an extensive (and really cool) C++ library that is being accessed from Python. Here's the source:

https://github.com/Itseez/opencv

I'll leave it up to the reader to find the source for the Sobel method.

A much more honest title could have included something like "solving <problem> with <n> lines of Python using OpenCV".

As I said before, the intent of the article and what is being demonstrated are good, no, great. I just wish the title was a little more reflective of reality. That's all. No need to get worked-up. This is not that serious of an issue. Just a comment.

mikeash4• 14 years ago

And if you had to write the OS it runs on you'd have a really huge "pile-o-code". What's your point?

robomartin11• 14 years ago

> What's your point?

Simple. To go along the lines of your example:

Headline: "Microsoft Word written in 50 lines of Python".

Reality:

The fifty lines of Python do nothing more than call a set of Microsoft libraries written in C and C++ that, well, result in MS Word.

Did the author really write MS Word in 50 lines of Python?

Of course not. It would be absolutely insane to even suggest the idea that this could even approach a valid metric.

Nope, the author simply made use of external non-Python libraries that are the results of probably hundreds of thousands of lines of code and many man-years of work. He does not, for even a microsecond, get to claim that he wrote MS Word in 50 lines of Python.

That's my point. Is it a little bit clearer now?

Breaking the MintEye image CAPTCHA in 23 lines of Python

Related Stories