[00:00.000 --> 00:00.920]  Here we go.
[00:01.020 --> 00:01.760]  Alright, okay.
[00:02.440 --> 00:04.900]  So welcome to our talk on CAPTCHAs.
[00:05.020 --> 00:06.000]  We're Hacked Existence.
[00:06.560 --> 00:07.620]  I'm dr_dave.
[00:09.300 --> 00:10.420]  This is r3dfish.
[00:12.580 --> 00:14.900]  We'd like to talk today about CAPTCHAs.
[00:14.980 --> 00:16.840]  They're a popular thing.
[00:17.060 --> 00:19.240]  We see them all over the place, just about everywhere.
[00:20.840 --> 00:22.920]  But man, they sure are a nuisance, right?
[00:23.160 --> 00:29.740]  But they are doing us a lot of good in keeping bots and black cats from abusing valuable online resources, right?
[00:30.000 --> 00:30.500]  Wait, wait.
[00:30.600 --> 00:30.860]  Hold up.
[00:30.980 --> 00:31.160]  Hold up.
[00:31.220 --> 00:31.440]  Go back.
[00:32.880 --> 00:35.860]  So I don't know if you guys can see this, but this is the Statue of Liberty burning.
[00:36.100 --> 00:38.300]  And it says, imagine a world without CAPTCHAs.
[00:40.740 --> 00:42.180]  New York is in flames, right?
[00:44.620 --> 00:48.140]  So first, we'd like to start out with a little bit of humor, just to get you in the mood.
[00:49.020 --> 00:50.640]  You know, this is the old joke.
[00:50.640 --> 00:56.300]  You just wanted to post your comment in the news section, but you can't do it until you solve the CAPTCHA.
[00:58.900 --> 01:07.500]  And, you know, we'll get to talking about reverse Turing tests and hard AI problems, but this is a nice little bit of irony.
[01:09.800 --> 01:11.960]  So, you know, we'll test your humanity.
[01:12.160 --> 01:13.580]  The young kids probably won't get that.
[01:14.400 --> 01:16.280]  Okay, so this is me.
[01:16.520 --> 01:17.940]  I'm a bum academic.
[01:18.520 --> 01:22.860]  I think about CAPTCHAs all day and AI and machine learning stuff.
[01:23.900 --> 01:30.500]  I do both attack and defense, and I enjoy all types of information security research.
[01:32.040 --> 01:33.040]  So this is me.
[01:33.220 --> 01:38.240]  I have a business degree, so I'm actually not an engineer, although I do consider myself a developer.
[01:39.160 --> 01:45.680]  If you went to DEFCON 17, you might have seen my speech called Hadoop, Apache's Open-Source Implementation of Google's MapReduce Framework.
[01:46.120 --> 01:55.540]  So, basically, when Hadoop was in version 0.17, so very, very infant, I gave a speech on how it worked and what MapReduce is.
[01:56.020 --> 02:00.240]  For those of you who don't know, it's basically the base of what Google's search engine works off of.
[02:00.240 --> 02:06.580]  It's how they deal with all of the scrapes that they do from the Internet, how they rank pages, and relate them all.
[02:07.520 --> 02:09.660]  You can check us out at hackedexistence.com.
[02:09.780 --> 02:11.060]  Eventually, the slides will be up there.
[02:12.380 --> 02:16.840]  Shameless plug, check out my YouTube channel, youtube.com/hackedexistence.
[02:17.020 --> 02:24.500]  All kinds of tutorials, everything from Wi-Fi pineapple, building websites in Django, Raspberry Pi, all kinds of good stuff up there.
[02:24.660 --> 02:25.580]  So, check that out.
[02:27.780 --> 02:31.160]  Okay, so, we're going to be hearing this word a lot tonight, CAPTCHA.
[02:31.280 --> 02:32.580]  What does it actually stand for?
[02:32.720 --> 02:37.100]  It stands for Completely Automated Public Turing Test to Tell Computers and Humans Apart.
[02:37.840 --> 02:45.220]  So, there's a little bit of argument about who invented it first, a group out of Yahoo or Dr. Louis Von Ahn from Carnegie Mellon.
[02:45.660 --> 02:47.620]  Generally, Dr. Von Ahn gets the credit.
[02:48.820 --> 02:50.480]  He's the inventor of reCAPTCHA.
[02:50.600 --> 02:51.800]  I'm sure we've all heard of that.
[02:52.400 --> 02:57.480]  So, the whole purpose of this is just to tell, hey, is this user on my page a human or a bot?
[02:57.480 --> 02:58.980]  How do we tell, you know?
[03:00.780 --> 03:04.220]  The goal is to prevent the abuse by bots and black hats, right?
[03:04.320 --> 03:15.500]  So, you know, if we just have a form wide open, someone can come in and write a clever Perl script or Python script or whatever your favorite web form interaction scripting language of sources.
[03:17.480 --> 03:20.020]  The goal is just to protect scarce resources, right?
[03:20.140 --> 03:21.860]  You have a finite amount of bandwidth.
[03:21.860 --> 03:27.080]  You have a finite amount of server space, finite amount of account space, whatever it may be.
[03:27.220 --> 03:30.480]  You need to make sure that you can police it in a meaningful way.
[03:32.740 --> 03:36.320]  So, that's the challenge you face as a web service provider, right?
[03:36.540 --> 03:40.300]  The cost of your security versus the cost of the operation of your service.
[03:40.880 --> 03:51.380]  So, you know, you have to have some level of tolerance for bot activity in your service because, guaranteed, there's going to be some spammers somewhere looking for trouble, right?
[03:51.600 --> 03:56.920]  But you need to make sure that the cost of your security is not greater than the cost of operating your service.
[03:56.920 --> 03:59.000]  Otherwise, why the hell would you bother with it, right?
[03:59.600 --> 04:00.700]  Sort of a moot point.
[04:02.620 --> 04:10.200]  So, we face an existential crisis fairly quickly in CAPTCHA when we can just pay a human to solve it, right?
[04:10.300 --> 04:21.260]  Then we've defeated the entire point of this discerning between human and a bot because now we have a legitimate wet brain sitting in front of the computer solving the challenge.
[04:22.160 --> 04:32.820]  So, we get to a point where, you know, you can pay like five dollars for a thousand solutions and, you know, you farm it out to a farm and what's done is done, right?
[04:32.820 --> 04:40.860]  You get extremely high accuracy, usually 90% plus in solve rates and, generally, it just ruins your day as an administrator.
[04:41.900 --> 04:47.560]  So, we have to start thinking about CAPTCHAs in an economic sense.
[04:47.720 --> 04:51.220]  You know, what does this cost to protect a resource, right?
[04:51.300 --> 04:55.840]  So, you're forcing the attacker to pay and expend resources, right?
[04:55.840 --> 04:58.500]  So, we can sort of think about it in a game theory way.
[04:59.400 --> 05:04.040]  So, one, you know, effective way of doing this is Amazon's Mechanical Turk, right?
[05:04.220 --> 05:06.260]  Who all here has used Mechanical Turk?
[05:06.400 --> 05:06.640]  Anyone?
[05:07.360 --> 05:08.040]  Show of hand.
[05:08.280 --> 05:10.320]  So, when they say you can't see the audience, they're not lying.
[05:10.760 --> 05:11.340]  It's just black.
[05:12.200 --> 05:12.480]  Okay.
[05:12.660 --> 05:22.000]  Well, if anyone's used Mechanical Turk, you can pay people to do small tasks for you for a small fee and generate data this way, right?
[05:22.000 --> 05:27.240]  So, this is sort of an example of a human solutions farm that we'll encounter.
[05:28.040 --> 05:29.640]  So, there's three major types.
[05:29.900 --> 05:32.300]  The text-based one, you've all seen this, right?
[05:32.680 --> 05:37.180]  Alphanumeric characters with some noise added in to obfuscate the text.
[05:38.020 --> 05:39.660]  They're very widely deployed.
[05:39.900 --> 05:40.900]  They're easily scalable.
[05:41.260 --> 05:42.240]  They're very unique.
[05:42.240 --> 05:44.520]  They have a very large sample space.
[05:45.320 --> 05:48.540]  And they've been the gold standard for quite some time.
[05:49.220 --> 05:53.920]  We're going to talk about how they've fallen out of favor when we get into our tax section.
[05:55.420 --> 06:00.700]  But you still see them just about everywhere because they're so damn easy to implement.
[06:01.140 --> 06:05.500]  And you can just find them on every PHP, bulletin board, comment section, whatever.
[06:05.740 --> 06:06.380]  They're going to be there.
[06:07.080 --> 06:09.220]  The future is image-based ones, right?
[06:09.420 --> 06:13.620]  So, we're seeing now a move towards image-based CAPTCHAs.
[06:13.620 --> 06:20.880]  These ones ask you to perform an image or object recognition task as the hard AI problem, right?
[06:20.980 --> 06:23.860]  We want to know that you have the ability to recognize an object.
[06:24.040 --> 06:24.940]  This is a cat.
[06:25.100 --> 06:25.900]  This is a flower.
[06:26.080 --> 06:28.460]  This is a telephone, et cetera, right?
[06:28.980 --> 06:31.860]  That's not to say computers can't perform that task.
[06:32.340 --> 06:37.860]  But up until very recently, that was generally considered a hard computer vision problem.
[06:38.320 --> 06:41.160]  We'll see where we've evolved in computer vision shortly.
[06:41.880 --> 06:45.060]  Then, last but not least, let's not forget our blind users, right?
[06:45.200 --> 06:49.080]  Some people have disabilities, you know, blind, deaf, whatever it may be.
[06:49.260 --> 06:51.080]  We need to make sure we accommodate them.
[06:51.300 --> 06:54.000]  So, audio-based CAPTCHAs are there for the blind.
[06:54.500 --> 06:57.440]  It speaks a phrase and the person has to enter it in.
[06:57.640 --> 07:06.320]  There's also some obfuscation added in to the audio to prevent speech-to-text translators from just automatically answering the challenge for them.
[07:06.920 --> 07:09.520]  But obviously, that has some impacts on usability.
[07:10.240 --> 07:14.980]  It's not a perfect solution, but it does provide access for our blind users.
[07:16.700 --> 07:20.760]  So, now we'll come to the criteria for evaluating a design.
[07:20.960 --> 07:23.260]  So, there's three major criteria that we care about.
[07:23.600 --> 07:25.940]  Usability, scalability, and robustness.
[07:26.340 --> 07:31.340]  So, when we think about these ideas, we have to ask ourselves a couple of questions, right?
[07:31.620 --> 07:33.220]  So, usability is key.
[07:33.220 --> 07:36.500]  If humans can't solve it, your CAPTCHA is garbage, right?
[07:36.980 --> 07:39.740]  Whatever it is you come up with, it's no good.
[07:39.960 --> 07:43.500]  So, we want to make sure that users understand the challenge, right?
[07:43.620 --> 07:49.620]  So, when we say challenge, what that is, is the question posed to the user to verify their humanity.
[07:49.780 --> 07:50.840]  That's what a challenge is.
[07:51.020 --> 07:55.420]  So, when we say, enter the letters into the following text field, that's the challenge, right?
[07:55.420 --> 07:58.680]  So, can the user understand it and answer it quickly?
[07:59.020 --> 08:04.580]  So, the general rule of thumb is that CAPTCHA should take no longer than 15 to 30 seconds to solve.
[08:04.800 --> 08:08.820]  Any longer than that, and you're starting to negatively impact the user experience.
[08:09.560 --> 08:12.560]  And generally, the user will begin to become frustrated.
[08:12.740 --> 08:14.000]  They won't perform the task.
[08:14.180 --> 08:17.940]  They'll neglect whatever it is that you put behind the CAPTCHA.
[08:18.500 --> 08:21.440]  And then, of course, we have to consider our impaired users, right?
[08:22.080 --> 08:28.260]  So, scalability is actually, in my opinion, the second most important criteria.
[08:28.600 --> 08:31.080]  How well does your challenge scale?
[08:31.560 --> 08:34.800]  So, that means, can you accommodate a large number of users?
[08:35.080 --> 08:39.220]  So, you know, think about, you know, let's say you run a basket weaving forum, okay?
[08:39.600 --> 08:41.740]  And there, you know, you have 30 users.
[08:42.500 --> 08:49.500]  You just need a CAPTCHA that's going to keep out, you know, your standard PHP bulletin board, bots, nothing fancy.
[08:50.460 --> 08:52.980]  Now, imagine you're running Gmail, okay?
[08:53.140 --> 08:59.740]  The number of people and the sophistication and resources of the attackers who are going to be hitting you is going to be much higher.
[09:00.080 --> 09:05.420]  And you want to make sure that the uniqueness of your challenges is extremely high.
[09:05.540 --> 09:06.760]  We don't want any repeats.
[09:06.900 --> 09:11.560]  We don't want anything that could lead to dictionary attacks, database attacks.
[09:11.640 --> 09:20.040]  Any bit of information we can keep out of the hands of the attacker is something we want to do as much as possible.
[09:20.940 --> 09:23.060]  And then, finally, the automated portion.
[09:23.460 --> 09:25.900]  Can the challenge be generated without humans?
[09:25.920 --> 09:27.120]  That's extremely important.
[09:28.340 --> 09:30.540]  That's the completely automated part.
[09:30.840 --> 09:42.080]  I've seen, personally, in academic literature, a lot of designs that require some aspect of human intervention, such as a labeled image database, for example, something that...
[09:42.080 --> 09:43.020]  Yes, we have a minute, Joan?
[09:43.080 --> 09:47.520]  We have rules recapture where they're trying to make it a little bit harder to circumcise.
[09:47.700 --> 09:48.840]  Okay, we're going to get to that.
[09:48.960 --> 09:49.820]  I'm glad you brought that up.
[09:49.940 --> 09:52.020]  We will definitely address that in detail shortly.
[09:53.260 --> 09:57.620]  And then, last but not least, robustness is sort of a descriptor for security.
[09:57.820 --> 09:59.340]  Is it resilient to attacks?
[09:59.500 --> 10:13.180]  So we know there's things like segmentation attacks, filtration attacks, things to get our tricks out so that the standard computer vision tools, optical character recognition, whatever it is, will be effective again in solving these challenges.
[10:14.200 --> 10:16.480]  And then, also, real-time content.
[10:16.680 --> 10:19.360]  That's something that is hot in the field right now.
[10:19.480 --> 10:20.200]  We're looking at that.
[10:20.380 --> 10:24.440]  If any of you have seen the latest recapture, you'll see Google Maps data.
[10:24.680 --> 10:32.660]  They're asking you to solve, you know, click on the storefronts or identify all buildings that have a street number on them or something to that effect, right?
[10:32.820 --> 10:38.780]  So they're sourcing this content in the real world and they're having you answer the challenge quickly.
[10:38.780 --> 10:47.120]  They do an aggregate, you know, they'll ask 10 or 12 people the same thing, and then see if you... there's a high enough threshold to authorize the challenge, right?
[10:48.300 --> 10:52.100]  So here's a... now we're going to get into the section about breaking captures.
[10:52.660 --> 10:55.320]  So here's a little ha-ha, velociraptor, right?
[10:55.420 --> 10:57.340]  If he has trouble reading it, is he a robot?
[10:57.900 --> 10:58.840]  Well, we don't know.
[11:00.280 --> 11:02.900]  So now we'll get into the breaking techniques.
[11:04.280 --> 11:07.100]  Optical character recognition, I'm sure you've all heard of this, right?
[11:07.100 --> 11:13.000]  It was originally designed so you could scan documents back from paper into a digital format on your computer.
[11:13.860 --> 11:17.460]  So just shout out, how many people had a scanner in the 90s?
[11:17.600 --> 11:18.200]  A flatbed scanner?
[11:20.000 --> 11:23.960]  All right, so OCR has been evolving since then, right?
[11:24.660 --> 11:26.320]  So it's pretty good now.
[11:27.160 --> 11:38.400]  So we're almost at a point now where with deep learning models, which we'll get to later on, because of the regularity and structure of text, it doesn't really vary that much.
[11:38.840 --> 11:45.360]  So when you get, you know, you and I can tell a T in a thousand different fonts because we know what a T looks like.
[11:45.420 --> 11:48.440]  We have a conceptual model in our brain of what a T looks like.
[11:48.660 --> 11:57.700]  When we develop a neural network that can perform the same function nearly as well as we do, you're going to see where text becomes real shitty real quick.
[11:59.180 --> 12:05.340]  Segmentation is just we want to be able to separate individual characters or important pieces of an image out and identify them.
[12:06.840 --> 12:14.440]  Filtration is designed to cut through noise, filter out additive noise, lines, garbage, things like that.
[12:15.620 --> 12:17.480]  We have computer vision algorithms.
[12:17.480 --> 12:20.180]  Who here has played with Intel's OpenCV at all?
[12:20.600 --> 12:22.680]  Just give me a yay-yay if you have.
[12:23.540 --> 12:27.220]  Okay, so we got a couple people there who do computer vision stuff.
[12:27.780 --> 12:31.140]  Object recognition now is becoming increasingly more powerful.
[12:31.660 --> 12:35.400]  It's no longer as trivial as it once was.
[12:35.860 --> 12:38.560]  Scene tagging and image annotation now are hot.
[12:38.780 --> 12:41.720]  Who here has seen IBM Watson Alchemy?
[12:43.160 --> 12:45.420]  That's really fancy stuff.
[12:45.600 --> 12:46.480]  That's bleeding edge.
[12:46.640 --> 12:55.940]  It can provide image annotation where it gives you contextual information about an image, such as that let's say there's a guy on a beach drinking a Corona.
[12:56.160 --> 13:00.200]  I will say, man on the beach holding a bottle, right?
[13:00.300 --> 13:00.880]  That's creepy.
[13:01.060 --> 13:03.160]  That's some next level stuff there.
[13:03.340 --> 13:03.660]  That...
[13:04.280 --> 13:07.780]  I've been in the machine learning game for six years and that blew my mind.
[13:08.600 --> 13:11.220]  Deep learning models are hot now.
[13:11.420 --> 13:13.220]  They're third generation neural networks.
[13:13.840 --> 13:15.380]  Google uses them a lot.
[13:15.380 --> 13:19.720]  They were the initial developers of this for processing their maps data.
[13:20.180 --> 13:26.880]  They're very powerful, very adaptive, and extremely good at image processing tasks.
[13:28.300 --> 13:30.580]  Speech-to-text, I think, is fairly straightforward.
[13:31.080 --> 13:33.180]  So we'll keep it there for now.
[13:36.260 --> 13:38.700]  Okay, so now we'll get into breaking tools, right?
[13:38.840 --> 13:40.420]  So let's say you're a black cat now.
[13:41.640 --> 13:43.840]  And you're faced with a CAPTCHA challenge.
[13:44.120 --> 13:45.800]  Is there an automated breaker around?
[13:45.980 --> 13:47.280]  If the answer is yes, great.
[13:47.540 --> 13:47.920]  Use it.
[13:48.100 --> 13:50.900]  But what do you do when you reach CAPTCHAs that you can't break?
[13:51.460 --> 13:57.260]  Well, now the fancy ones will let you farm the ones you can't break out to a human to solve them.
[13:57.500 --> 14:04.660]  So for example, death by CAPTCHA is a service provider that will sell you human users to break the CAPTCHAs you can't break.
[14:04.980 --> 14:13.980]  So as a black cat, this allows you to optimize your expenses, where you break the automated ones with your automated breaking tool, and the ones you can't break, you pay for, right?
[14:15.100 --> 14:20.120]  So they also now have the ability to share custom algorithms for defeated challenges.
[14:20.120 --> 14:23.540]  So let's say you spend the time making one, and some guy wants to target you.
[14:24.000 --> 14:27.280]  They can now share it through their tool with everyone else.
[14:27.560 --> 14:30.060]  So GSA is the most popular one.
[14:31.140 --> 14:33.220]  It's a German group that does it.
[14:33.300 --> 14:37.080]  It's 147 bucks for the seat, updated frequently.
[14:37.980 --> 14:41.620]  DCAPTCHA is a human-solving service that integrates with GSA.
[14:42.020 --> 14:44.400]  It's $2 per 1,000 images.
[14:44.780 --> 14:51.100]  And then CAPTCHA-Sniper is the third one, just an alternative to GSA if that doesn't float your boat.
[14:52.020 --> 14:53.000]  97 bucks.
[14:54.160 --> 14:58.000]  So here's an example of a challenge being ripped apart, 1 through 10.
[14:58.460 --> 15:02.620]  So number 1 shows you the basics of what the challenge looks like.
[15:03.380 --> 15:07.020]  Then you can see where we begin the color modification in number 2.
[15:07.720 --> 15:10.040]  It gets stripped down to black and white, right?
[15:10.260 --> 15:14.540]  Then we have some grayscaling functions here, averaging, min-maxing, things like that.
[15:15.680 --> 15:19.380]  Which helps, you know, filter out some more of the background noise.
[15:19.620 --> 15:26.060]  Until you see with, you know, number 4 where we can do some smoothing and sharpening on the letters.
[15:27.080 --> 15:33.480]  Then we end up applying the grayscale bucket here to clean up the letters, set the cutoff in 6.
[15:34.660 --> 15:38.600]  And before you know it, you know, we'll gloss over the rest.
[15:38.760 --> 15:42.820]  Chopping, you know, the number of passes you want to make on a particular segmentation.
[15:44.300 --> 15:46.900]  And before you know it, you've got the characters.
[15:46.900 --> 15:51.040]  And this took less than a second to perform.
[15:51.360 --> 15:59.320]  So TesterCaptist was a tool originally released by McAfee Security that lets you play around with this manually, right?
[15:59.480 --> 16:01.200]  So normally this is a fully automated thing.
[16:01.360 --> 16:04.400]  This lets you sort of see the steps and tweak them out.
[16:05.200 --> 16:07.800]  If you Google around for this, I'm sure you can dig it up.
[16:08.900 --> 16:10.540]  Here's a screenshot of GSA.
[16:10.940 --> 16:14.740]  So this is sort of the one that black cats run at scale, right?
[16:14.740 --> 16:24.320]  So they have all the... in the CAPTCHA type box, you can see on the left-hand side, they have a big list of known challenges in the wild that have been broken.
[16:24.700 --> 16:27.140]  And you can apply them in accordingly.
[16:29.240 --> 16:31.120]  You can set it up as a web server.
[16:31.120 --> 16:35.580]  So you can do farming attacks and program in all that stuff.
[16:35.900 --> 16:38.780]  Make sure you've got your death by CAPTCHA account in there.
[16:38.980 --> 16:41.380]  And it'll just make your life that much easier, right?
[16:41.380 --> 16:45.000]  So, you know, automated breakers are great.
[16:45.220 --> 16:53.700]  But from a defense perspective, if you know how they're breaking your challenge, you can make a couple of simple tweaks and break the automated tool.
[16:53.900 --> 16:59.720]  And then you send the attacker back to the drawing board to come up with something new, right?
[16:59.840 --> 17:01.720]  So it's a constant arms race.
[17:01.880 --> 17:05.020]  There's no real, you know, end-all be-all.
[17:05.220 --> 17:06.980]  It's a constant game of one-upsmanship.
[17:07.820 --> 17:11.520]  So here's an example of Alchemy in Action.
[17:11.800 --> 17:13.460]  They give you this picture of a cat.
[17:13.760 --> 17:20.160]  You can see here in the code where it gives you a text string that, hey, this is a cat.
[17:20.320 --> 17:30.760]  And it gives you a confidence score as a percentage of 100%, where it's 98.3% sure that this is a picture of a cat, right?
[17:31.620 --> 17:33.100]  And that's pretty creepy.
[17:33.280 --> 17:45.280]  Because now, if you have an image challenge, where you ask them to perform a recognition task, we now have an automated tool that can perform the task and provide you a text string.
[17:46.040 --> 17:47.040]  Pretty creepy, right?
[17:47.200 --> 17:49.220]  So if they ask, you know, hey, type this in.
[17:49.500 --> 17:50.400]  You're gonna get nailed.
[17:50.660 --> 17:56.100]  Just to show you how robust it is, this is an example of a horribly polluted river that's orange.
[17:57.060 --> 18:09.700]  But it's still able to detect that those people were kayaking in the river and was able to say, hey, this is a body of water, even though it was a different color than water would normally be.
[18:11.820 --> 18:14.240]  So text captures are basically dead.
[18:14.620 --> 18:18.360]  We've seen Google's recapture move to an image-based service.
[18:19.580 --> 18:25.840]  And deep learning models have effectively deleted text-based implementations.
[18:26.020 --> 18:30.060]  Now, that's not to say you're not gonna see text-based implementations around on the web.
[18:30.200 --> 18:31.980]  Because, let's face it, they're scalable.
[18:32.180 --> 18:32.740]  They exist.
[18:32.940 --> 18:33.820]  They're already deployed.
[18:34.060 --> 18:38.680]  They're good enough at stopping skids from running wild on your web page.
[18:39.420 --> 18:44.100]  The fancy attackers, they're gonna be able to bring more heat on your challenge.
[18:44.480 --> 18:45.940]  Those are the guys you gotta watch for.
[18:45.940 --> 18:48.620]  And you, as a service administrator, can watch.
[18:48.780 --> 18:54.220]  And if you notice an uptick in bogus account registrations, maybe it's time to reevaluate your CAPTCHA.
[18:55.940 --> 19:00.820]  So, to the gentleman's point earlier, we will talk about current best of breeds, right?
[19:00.940 --> 19:07.880]  So now we're seeing migrations away from those three traditional ones to something called a behavior-based model.
[19:08.140 --> 19:12.820]  So behavior-based models ask the user, hey, you know, what are you doing?
[19:14.100 --> 19:16.420]  You know, is this guy clicking on things?
[19:16.560 --> 19:19.980]  Is he clicking on things faster than a human would be able to?
[19:20.200 --> 19:25.860]  Is he populating every single form, space, text box on the page?
[19:25.980 --> 19:26.880]  Even hidden ones?
[19:28.040 --> 19:40.000]  You know, those are behaviors that bots typically show can be targeted and identified and stopped accordingly by behavior-based CAPTCHAs.
[19:40.240 --> 19:43.300]  Does the bot know to click this box that says, I'm not a robot?
[19:43.780 --> 19:44.400]  Right.
[19:44.640 --> 19:46.820]  That's an example of a behavior-based model.
[19:47.500 --> 19:50.620]  So risk-based models are a little bit fancier.
[19:50.620 --> 20:04.120]  So what Google has been doing with the risk-based model is, based on how much they think you're a bot before you even perform the challenge, the difficulty of the challenge is directly related to a number of points that they measure.
[20:04.460 --> 20:16.280]  And when we say number of points that they measure, they mean your browser user agent, your cookie history, are you logged into a Google account, do they have a history of data in this Google account, right?
[20:16.280 --> 20:22.280]  The more points of data they have on you, being a legitimate human, the easier of a challenge you're going to get.
[20:22.780 --> 20:34.700]  So, there's a great paper published at Black Hat 2016 Asia that showed some guys doing some testing of the risk-based model with custom-crafted user agents.
[20:35.400 --> 20:37.700]  Look into that if you want to know more about it.
[20:37.780 --> 20:38.920]  Highly recommended stuff.
[20:39.720 --> 20:57.760]  But the long and short of it is, you can go all the way from solving these complex challenges that we see here on the right, where they want you to identify bodies of water, all the way down to Google already knows for a fact you're a human because you're logged into your Gmail and you just click the box and you don't even need to solve a challenge.
[20:58.320 --> 21:08.080]  Now, they still offer the old text-based model as something called a legacy CAPTCHA, because there is some difficulty in solving these image-based ones.
[21:09.200 --> 21:13.920]  People have difficulty, sometimes the images are too blurry, they crop them, whatever it may be.
[21:15.120 --> 21:21.880]  Multi-layer challenges ask you to perform a task a number of times and update each time you perform a task.
[21:22.540 --> 21:31.000]  So sometimes, for example, in this one, if you click on a body of water, the image will fade out based on your response, either right or wrong, and a new image will come up.
[21:31.140 --> 21:35.120]  And they ask you to repeat this multiple times until you've solved it.
[21:35.320 --> 21:40.800]  Or they'll give you two different forms, where you solve this one and then after that, they'll hit you with a text-based one.
[21:40.800 --> 21:46.360]  So it just really depends on how much they trust you as a human or not.
[21:47.320 --> 21:49.060]  So now comes the fun part.
[21:49.420 --> 21:55.220]  Fire up your phones, your laptops, whatever, and jump over to our website.
[21:57.580 --> 22:05.620]  RBSCAPTCHALAB.com All right, so if you guys want to try this, go ahead.
[22:05.680 --> 22:07.840]  We already pulled up the results for now.
[22:09.180 --> 22:11.720]  But basically, this is the capture that we built.
[22:12.220 --> 22:13.340]  It's pretty straightforward.
[22:14.040 --> 22:15.640]  Here's the image that's been modified.
[22:16.160 --> 22:17.700]  Here's your set of emoticons.
[22:17.960 --> 22:19.140]  You just kind of have to guess.
[22:23.410 --> 22:24.310]  That was wrong.
[22:25.590 --> 22:26.050]  Right?
[22:26.830 --> 22:27.750]  This guy looks neutral.
[22:28.830 --> 22:28.930]  Yeah.
[22:31.990 --> 22:33.110]  So that one was right.
[22:33.510 --> 22:35.770]  So basically, we just fed it a bunch of images.
[22:35.770 --> 22:37.830]  And we'll get to how this all works in a minute here.
[22:37.830 --> 22:43.430]  But present an image, give it a bunch of emoticons, try it out.
[22:43.910 --> 22:44.050]  All right.
[22:44.190 --> 22:50.050]  So the goal of this is match the emoticon to the expression on the face.
[22:50.490 --> 22:51.390]  That's the challenge.
[22:51.610 --> 22:51.990]  Okay?
[22:54.850 --> 22:56.330]  So here's some of the results.
[22:56.490 --> 22:58.230]  Let's look at the results page real quick.
[23:00.590 --> 23:01.070]  All right.
[23:01.210 --> 23:03.110]  So basically, we have our five emotions here.
[23:04.010 --> 23:07.330]  And we tell you how many times they were guessed correct and how many times they were guessed incorrect.
[23:07.330 --> 23:09.330]  So you can go into neutral here, for example.
[23:09.690 --> 23:12.610]  And it'll tell you 19 times somebody guessed neutral.
[23:12.790 --> 23:14.130]  They were right 16 times.
[23:14.390 --> 23:17.410]  So three times somebody guessed neutral for an image that wasn't neutral.
[23:17.990 --> 23:20.310]  And it'll tell you what the incorrect guesses were.
[23:20.810 --> 23:21.590]  Surprise was one.
[23:21.730 --> 23:22.630]  Happiness was one.
[23:23.170 --> 23:35.050]  And then it'll show you all the images, the whole filter chain that we applied to each image, and all the emotions that were possible account of how many times each one was guessed.
[23:38.230 --> 23:43.470]  So if you guys want to try that out, we'll look at the results at the end of the speech here.
[23:55.000 --> 23:55.440]  Okay.
[23:55.820 --> 24:03.100]  So our hard AI problem, try saying that three times fast, is human emotion recognition.
[24:03.420 --> 24:04.420]  So what is that?
[24:04.520 --> 24:07.440]  It's contextual information contained in an image, right?
[24:07.660 --> 24:15.080]  So when you look at a face, right, being able to read the emotion on the face is contextual, right?
[24:15.240 --> 24:19.620]  So great, you can detect a face, but do you know what the face is expressing, right?
[24:20.180 --> 24:23.240]  Is it impossible for a computer to perform this task?
[24:23.420 --> 24:24.320]  Absolutely not.
[24:24.560 --> 24:27.500]  Otherwise, we wouldn't be able to automate this in a meaningful way.
[24:27.680 --> 24:40.520]  And we actually, in fact, use computers to do the original analysis of the facial expression and then apply filters on top of it to where and feed it back through the computers to where they can't recognize it anymore.
[24:40.880 --> 24:45.520]  So it starts with computers telling you what emotion is in the image.
[24:46.160 --> 24:48.860]  And then trying to break the computer, right?
[24:48.860 --> 24:48.880]  Okay.
[24:49.400 --> 24:52.360]  So it's not a trivial challenge.
[24:52.820 --> 25:03.760]  We have Microsoft to thank for this gem in their surveillance through Xbox and just the sheer scale of web services they operate.
[25:05.440 --> 25:08.560]  Success is highly dependent upon specific criteria, right?
[25:08.680 --> 25:10.240]  So we can't just take any old image.
[25:10.620 --> 25:17.420]  The image has to be high quality of a certain size, properties, composition, things like that.
[25:17.420 --> 25:25.420]  So there are definitely tolerances to the detection algorithms for emotion and we plan on exploiting those in a meaningful way.
[25:26.340 --> 25:30.880]  So we're going to churn and burn through these really quick for the sake of time.
[25:31.100 --> 25:36.660]  These are facial cues for measurement just so you have a reference point of what the algorithm is looking at.
[25:36.900 --> 25:39.060]  So this is a neutral expression, right?
[25:39.380 --> 25:42.240]  No real relaxed facial muscles.
[25:43.180 --> 25:44.220]  Eyes are open.
[25:44.460 --> 25:45.260]  No furrowed brow.
[25:45.560 --> 25:46.300]  No furrowed nose.
[25:46.560 --> 25:48.120]  Lips are straight.
[25:48.780 --> 25:49.300]  Right?
[25:49.480 --> 25:49.900]  Anger.
[25:50.140 --> 25:51.060]  You can see the points.
[25:51.540 --> 25:54.440]  These are the types of things the algorithm is looking for, right?
[25:54.560 --> 25:55.720]  Eyebrows down and together.
[25:56.060 --> 25:57.200]  Narrowing of the lips.
[25:57.460 --> 25:58.140]  Things like that.
[25:58.420 --> 25:58.520]  Okay?
[26:00.220 --> 26:02.000]  We'll go through these pretty quick.
[26:02.280 --> 26:02.840]  Contempt.
[26:03.900 --> 26:04.940]  Corner lip.
[26:05.640 --> 26:06.280]  Surprise.
[26:06.800 --> 26:08.020]  You know, eyebrows raised.
[26:08.280 --> 26:09.180]  Mouth open.
[26:09.940 --> 26:10.580]  Happiness.
[26:11.140 --> 26:12.000]  You know, crow's feet.
[26:12.200 --> 26:12.860]  Pushed up cheeks.
[26:13.180 --> 26:14.080]  Lips pointing up.
[26:15.000 --> 26:15.640]  Sadness.
[26:15.960 --> 26:17.420]  You know, drooping upper eyelids.
[26:17.660 --> 26:18.420]  Lost in focus.
[26:18.980 --> 26:19.500]  Frowning.
[26:19.580 --> 26:20.440]  Frowning mouth.
[26:20.440 --> 26:21.600]  Mouth pointing down.
[26:22.360 --> 26:23.040]  Fear.
[26:23.300 --> 26:24.860]  You know, you got your eyebrows up.
[26:25.200 --> 26:26.380]  Raised upper eyelids.
[26:27.520 --> 26:29.020]  Lips parsed.
[26:29.620 --> 26:30.100]  Disgust.
[26:30.580 --> 26:31.520]  Nose wrinkled.
[26:31.820 --> 26:32.720]  Upper lip pulled up.
[26:33.280 --> 26:36.580]  So what those are is eight universal emotions.
[26:36.840 --> 26:39.480]  Those emotions are conveyed across cultures.
[26:39.640 --> 26:40.640]  No problem.
[26:40.800 --> 26:44.480]  Any human can ostensibly recognize those eight emotions.
[26:45.340 --> 26:47.960]  So the way we generate our challenge is the following.
[26:48.140 --> 26:53.220]  So we use an image scraper to gather data off a web image search.
[26:53.520 --> 26:55.320]  So that was an important challenge to us.
[26:55.440 --> 27:02.660]  We wanted to make sure that we could use existing tag data and then protect it from certain types of attacks to handle that.
[27:03.380 --> 27:07.620]  So we use the Emotion API from Microsoft to perform the facial recognition.
[27:08.160 --> 27:10.780]  So that means, A, identify a face in the image.
[27:10.920 --> 27:13.260]  And then, B, recognize the emotion on the face.
[27:13.840 --> 27:15.140]  Then we save it to our database.
[27:15.500 --> 27:19.800]  We run filters on it until we get no results from the Emotion API engine.
[27:20.120 --> 27:25.260]  Then we ask the user to demonstrate their humanity by matching the emoticon to the face.
[27:25.380 --> 27:27.880]  And then we evaluate the response as a pass or fail.
[27:29.280 --> 27:29.960]  All right.
[27:30.180 --> 27:32.640]  So now I'll talk a little bit about what we built.
[27:32.640 --> 27:38.360]  So basically, Dave came to me, designed the whole setup, and I built it and implemented it.
[27:38.600 --> 27:40.700]  I threw it up on the Internet so you guys could use it.
[27:41.680 --> 27:47.120]  So basically, we have an open-source Python image scraper that uses Google image search.
[27:47.300 --> 27:48.380]  So this is interesting.
[27:48.500 --> 27:50.980]  We started out with, where are we going to get images from, right?
[27:51.060 --> 27:51.800]  That's problem one.
[27:52.020 --> 27:55.520]  We can sit here and hand curate them all, but that's not really scalable.
[27:55.760 --> 27:58.580]  We need to just pull them off in some automated process.
[27:59.160 --> 28:01.840]  So we tried using Google's image search API.
[28:02.240 --> 28:03.600]  That didn't work out well at all.
[28:04.220 --> 28:08.840]  The results were completely different than when you go to images.google.com, type something in.
[28:10.160 --> 28:20.720]  I probably could have spent a bunch of time tweaking it out and figuring out why, but instead I just hit GitHub, typed in Google images, and boom, Python open-source scraper does it all for you.
[28:21.040 --> 28:22.800]  We'll look at that in the next slide here.
[28:23.700 --> 28:28.040]  So then we've got a big bank of images now that we've ripped off of Google images.
[28:29.020 --> 28:36.720]  We feed them all through Microsoft's project, Oxford API, which at the moment you can get a free API key.
[28:36.860 --> 28:37.940]  They have rate limits on it.
[28:38.020 --> 28:51.560]  So you got to go real slow, handle images, and they'll come back, identify the face in it, tell you all the different emotions and what they believe, the rating of confidence for each emotion inside of that face.
[28:51.760 --> 28:59.060]  So you can actually handle images with, you know, eight different people's faces, and it'll draw a box around each face and tell you what emotion is in each face.
[28:59.300 --> 28:59.740]  Pretty cool.
[29:00.720 --> 29:04.760]  We took those emotions, so now we know what emotion is in an image.
[29:04.960 --> 29:06.980]  We apply a bunch of GIMP filters.
[29:07.600 --> 29:11.960]  So GIMP is awesome, open-source, free, runs on a headless server.
[29:12.800 --> 29:21.620]  Apply filters to it one at a time and shoot it back through the Oxford Emotion API until it comes back as we can't even detect a face in here.
[29:21.820 --> 29:22.500]  And then we're good.
[29:23.440 --> 29:28.440]  And then we use Django to do all that and then present it to the users as a challenge.
[29:31.080 --> 29:33.520]  All right, so here's the whole Python scraper.
[29:34.020 --> 29:35.020]  It's real short.
[29:35.200 --> 29:36.340]  It's like 15 lines of code.
[29:37.800 --> 29:43.360]  So the Python API is actually called Google.
[29:44.120 --> 29:45.460]  Really easy to find on GitHub.
[29:46.260 --> 29:47.380]  And it's awesome.
[29:47.540 --> 29:49.700]  It actually goes and launches.
[29:49.700 --> 30:00.260]  If you do it on like a desktop in Linux, it'll actually launch a Firefox window, type your image search into Google Images, rip all the results down, and then close Firefox.
[30:00.940 --> 30:08.060]  So that kind of poses a problem when you try to do it on like a CentOS box that you pay somebody to host out on the Internet because there's no GUI.
[30:08.880 --> 30:16.520]  So we had to use this Pi virtual display here, which is really cool.
[30:16.920 --> 30:21.220]  You just tell it, hey, open up a display, visible equals zero.
[30:21.220 --> 30:22.840]  So we don't even have a GUI.
[30:23.580 --> 30:25.660]  And our resolution is 800 by 600.
[30:26.120 --> 30:34.100]  And then inside of that, you can pop a Firefox window and then run your Google image search here.
[30:34.460 --> 30:40.320]  And the coolest part is that you have this options.image type, and you can set it to type face.
[30:40.820 --> 30:43.160]  So basically, you can search for anything you want.
[30:43.260 --> 30:48.940]  Like you can search for rock or like Mustang or chair, and it'll only return images with faces in them.
[30:49.040 --> 30:51.060]  So it really doesn't matter what you search for.
[30:51.200 --> 31:01.720]  You can throw garbage at it, and you're just going to get facial images all day long because Google has already gone through their massive image collection and figured out which ones have faces for you.
[31:02.500 --> 31:03.860]  So that's pretty sweet.
[31:04.100 --> 31:06.440]  And then we just save them all to the web server.
[31:06.780 --> 31:08.400]  So that whole thing happens right here.
[31:11.110 --> 31:13.570]  All right, so Microsoft Cognitive Services.
[31:13.850 --> 31:15.390]  This is pretty crazy.
[31:15.830 --> 31:18.090]  Like I had no idea that it was this deep.
[31:18.390 --> 31:25.630]  They have a ridiculous amount of computers that know a lot of human things.
[31:25.890 --> 31:29.370]  So computer vision, emotion, face, video.
[31:29.770 --> 31:31.190]  Like they can do video analysis.
[31:31.190 --> 31:34.350]  You can feed it a video, and it'll tell you all kinds of things about it.
[31:34.730 --> 31:35.450]  I mean languages.
[31:35.810 --> 31:38.010]  So it doesn't matter what language it's in.
[31:38.230 --> 31:39.870]  You can hand it all kinds of stuff.
[31:40.370 --> 31:41.250]  Academic knowledge.
[31:41.690 --> 31:42.790]  You know, Bing web search.
[31:43.110 --> 31:44.770]  All kinds of crazy stuff.
[31:47.230 --> 31:49.910]  So here's the MS Emotion API.
[31:50.550 --> 31:51.970]  And it's a REST API.
[31:52.190 --> 31:53.130]  So real simple.
[31:53.250 --> 31:57.110]  You post an image to a URL along with your API key.
[31:57.730 --> 32:02.930]  And it'll detect up to eight different emotions in human faces and provide the bounding box.
[32:03.090 --> 32:04.450]  The responses are all in JSON.
[32:04.710 --> 32:05.470]  They look like this.
[32:05.670 --> 32:07.730]  So it'll tell you here's the face box.
[32:07.850 --> 32:10.130]  It'll give you this point and tell you your width and height.
[32:10.710 --> 32:11.510]  Here's your face.
[32:11.510 --> 32:15.350]  So for an image that has multiple faces, it'll draw a box for each one.
[32:15.710 --> 32:21.130]  And then it tells you all the scores from each emotion, how confident it is as a percentage.
[32:23.530 --> 32:24.910]  Pretty easy to work with.
[32:25.410 --> 32:29.050]  You can hand it up to 64 people in a single image.
[32:29.290 --> 32:32.890]  So that's a pretty ridiculous amount of processing for a computer to be able to do.
[32:33.130 --> 32:37.130]  Just take a single image and be able to identify so many people in it.
[32:37.950 --> 32:39.490]  All kinds of image formats.
[32:39.650 --> 32:41.430]  All your standard image formats.
[32:41.650 --> 32:43.150]  Anything less than 4 megs.
[32:43.210 --> 32:44.930]  You can't hand it massive images.
[32:45.330 --> 32:50.450]  But most images on the Internet, I would imagine, are less than 4 megs.
[32:50.910 --> 32:54.030]  Detectable face size between 36 and 36 pixels.
[32:54.290 --> 32:56.190]  So that's really tiny, right?
[32:56.450 --> 32:58.890]  All the way up to 4096 pixels.
[32:59.210 --> 33:00.890]  So that's a little too high definition.
[33:01.130 --> 33:02.890]  I don't want you to see my face in that much detail.
[33:03.090 --> 33:03.730]  It's ridiculous.
[33:05.090 --> 33:09.230]  The faces are ranked by face rectangle size in descending order.
[33:09.410 --> 33:11.550]  So it starts with the biggest face, goes down to the smallest.
[33:12.570 --> 33:15.490]  And frontal and near faces give you the best results.
[33:15.710 --> 33:17.410]  So side profiles are a little rough.
[33:17.730 --> 33:21.690]  But they'll still try and tell you what emotion is in like a side profile.
[33:23.910 --> 33:28.790]  So here's just like a quick example of the points that they look at for when they're trying.
[33:28.990 --> 33:34.950]  Remember those earlier slides where we saw where people were looking at, you know, the stuff.
[33:35.110 --> 33:45.650]  These are the points where they measure the movement on these and then you can generate a probability based on where these points are moved as to which emotion it's being displayed.
[33:47.510 --> 33:54.970]  All right, so like I said, we start by we've got an image source now, a bunch of collection of images.
[33:55.290 --> 34:01.530]  We shoot them off to the Microsoft emotion API and let them tell us where's the face, what's it displaying.
[34:02.390 --> 34:08.550]  And then once we get it back, we create that that's called the original image and we have an answer to it.
[34:08.610 --> 34:10.850]  We already know what emotion is displayed in that image.
[34:11.030 --> 34:16.030]  So our proof of concept thus far only deals with images showing a single face.
[34:16.510 --> 34:18.710]  We're going to expand it out, but it's not there yet.
[34:20.070 --> 34:26.990]  So then we start using GIMP and applying these filter chains one at a time and shipping it back to the API and saying, what do you see now?
[34:27.130 --> 34:27.670]  What do you see now?
[34:27.810 --> 34:29.490]  Eventually, it'll come back and say nothing.
[34:30.030 --> 34:33.290]  That's when we save it and say, all right, this is ready to show out.
[34:35.250 --> 34:38.370]  So it's no longer recognized by the emotion API.
[34:38.730 --> 34:43.010]  And then the user is asked to provide the emotion as the challenge response.
[34:43.210 --> 34:44.850]  So here's the image that's been modified.
[34:44.850 --> 34:47.550]  Can you guess which emoticon matches?
[34:47.990 --> 34:48.750]  Pretty straightforward.
[34:49.150 --> 34:52.250]  So here's our GIMP filter in Django.
[34:52.450 --> 34:53.430]  Two lines of code.
[34:53.650 --> 34:55.110]  Very simple, right?
[34:55.550 --> 34:57.190]  Function called apply GIMP filter.
[34:57.630 --> 35:00.350]  Basically, all it does is it runs GIMP console.
[35:00.810 --> 35:08.430]  So it runs in a headless CentOS box out on the Internet, applies a GIMP filter to an image that's on the file system.
[35:09.290 --> 35:11.050]  And you can change the options.
[35:11.050 --> 35:14.790]  So you can decide how intense you want these filters to be.
[35:14.990 --> 35:16.350]  We just randomize it all.
[35:16.530 --> 35:20.010]  So pop a random filter on there, try it again through the API.
[35:20.390 --> 35:25.030]  So one important point is ordinality is important in filter application.
[35:25.050 --> 35:34.930]  So because some filters can be destructive and subtractive and things like that, they play a role in defeating challenges that need extra image data.
[35:35.170 --> 35:41.110]  So if a particular CV algorithm needs something, right, we're taking that data away.
[35:41.270 --> 35:49.770]  So as we start destroying the image, right, it becomes progressively more difficult because there's just straight out less information.
[35:49.770 --> 35:55.690]  And we've added additional garbage information that makes it nearly impossible for these things to read.
[35:55.910 --> 35:56.030]  Yes?
[35:58.790 --> 35:59.190]  Yep.
[35:59.410 --> 36:01.350]  So here's an example of the distortion chain.
[36:01.710 --> 36:04.550]  You start with the regular image, you end up with something like this.
[36:04.770 --> 36:10.010]  You just keep applying filters over and over until that API can't deal with it anymore.
[36:10.630 --> 36:13.550]  And the cool thing about that is it becomes completely scalable, right?
[36:13.670 --> 36:21.590]  As soon as Microsoft, you know they can just sit there and flip a switch and detect a little more, deal with a little more filters on top of it.
[36:21.750 --> 36:23.910]  And all we have to do is just apply a few more.
[36:24.050 --> 36:25.490]  So it's that cat and mouse game.
[36:25.810 --> 36:28.770]  But in this case, all we have to do is stack more filters on it.
[36:28.930 --> 36:33.090]  As long as people can still deal with it, you're fine, right?
[36:35.070 --> 36:35.570]  All right.
[36:35.730 --> 36:37.750]  So stopping the emotion API, this is what happens.
[36:37.870 --> 36:39.350]  You get zero face detected.
[36:40.670 --> 36:43.910]  So we ask it over and over after each time we apply a filter.
[36:44.130 --> 36:45.190]  Eventually we get to zero.
[36:45.190 --> 36:45.790]  Okay.
[36:45.970 --> 36:47.870]  So this piece here is interesting.
[36:48.190 --> 36:52.150]  So if you look at on the left, this is a Google reverse image search.
[36:52.310 --> 36:56.030]  So when we feed it the unaltered image, it does a couple of things for us.
[36:56.390 --> 37:06.190]  It tells us the image size, finds the image in other sizes beyond that particular length and width, and it also gives us a text string, dental smile, right?
[37:06.410 --> 37:14.710]  So a clever attacker can use metadata on this image to figure out, hey, this is probably a happiness image because of the keyword smile.
[37:15.190 --> 37:20.110]  So when we noise the hell out of it here in the right side, now look what happens.
[37:20.290 --> 37:22.550]  The visually similar images are garbage.
[37:22.810 --> 37:25.830]  They're all related to the grid pattern we added to the image.
[37:26.010 --> 37:30.610]  There's no longer a text string and it can't find any other images that it matches, right?
[37:30.750 --> 37:31.850]  This is very important.
[37:32.070 --> 37:37.010]  Now we don't have this security guarantee in place yet because our filter chain is completely random.
[37:37.010 --> 37:44.090]  But when we finally do apply ordinality to it, it's going to be able to prevent reverse image search from nailing us to the wall, right?
[37:44.250 --> 37:50.130]  Because if we're drawing our images from this pool, we need to make sure that these tools can't be used against us, right?
[37:50.730 --> 37:52.290]  Yeah, so all these are all faces.
[37:52.590 --> 37:57.070]  This over here looks like carpets and sweatshirts and all kinds of random stuff, right?
[37:59.450 --> 38:05.970]  All right, so version 1.0, we started with 80 motions, all eight that the API can deal with.
[38:05.970 --> 38:07.910]  A few of them are experimental.
[38:09.090 --> 38:11.330]  There's no guarantee on the reverse image search.
[38:11.510 --> 38:12.270]  We'll get to that later.
[38:13.070 --> 38:15.150]  It's designed for usability, not security.
[38:15.150 --> 38:29.390]  We're getting to security, but because this is for Dave to get a PhD, we have to keep all of our variables constant and modify one at a time so that we can measure what kind of change a single variable produces.
[38:32.810 --> 38:37.930]  So we gathered responses from a bunch of people and just threw it up there, said, try this out.
[38:40.370 --> 38:41.270]  Here's the matrix.
[38:41.570 --> 38:43.630]  You guys can find the slides online later.
[38:44.970 --> 38:46.710]  Basically, here's what comes out of it.
[38:46.970 --> 38:54.190]  So when we show people neutral images, the first time when there was eight choices, 96% of the time they got it right.
[38:54.490 --> 39:00.090]  When we showed people disgust images, 47% of the time they got it right.
[39:00.350 --> 39:04.850]  So disgust, like more than half the time, they couldn't even guess what image that was.
[39:05.650 --> 39:11.010]  So two interesting points are contempt and disgust are experimental emotions in the API.
[39:11.030 --> 39:13.050]  They're not fully implemented yet.
[39:13.050 --> 39:14.210]  So keep that in mind.
[39:16.390 --> 39:21.350]  And then this is all of the... so this is guest-based results.
[39:21.690 --> 39:25.550]  So when people guessed happiness, 83% of the time they were right.
[39:25.730 --> 39:29.030]  When they guessed disgust, 45% of the times they were right.
[39:29.390 --> 39:34.470]  So 55% of the time that people clicked that disgust face, they were wrong.
[39:34.810 --> 39:38.930]  So disgust is obviously a good candidate for just being chopped off.
[39:41.670 --> 39:46.590]  So then for version 2.0, we dropped three emotions and tried it again.
[39:46.770 --> 39:47.950]  And that's what you guys see now.
[39:49.750 --> 39:52.470]  And this time, way better, right?
[39:53.170 --> 39:56.890]  97%, 95%, 94%, 94%, 81%.
[39:56.890 --> 40:01.010]  So sadness is still a little bit rough, but way more accurate, right?
[40:01.090 --> 40:02.970]  People can handle this a whole lot better.
[40:06.180 --> 40:11.200]  Okay, so let's take a look at our design and make sure that it actually does what it says it does.
[40:11.500 --> 40:13.380]  So can you recognize the faces?
[40:13.640 --> 40:15.660]  Well, I'm sure you can all be the judges of that.
[40:16.340 --> 40:21.780]  The problem becomes is as we keep increasing our security, it could be that humans can no longer use it, right?
[40:21.880 --> 40:23.840]  The warping and distortion has gone too far.
[40:23.980 --> 40:24.900]  It's no good, right?
[40:25.200 --> 40:29.600]  Since this is an image recognition capture, we do not have an option for blind users.
[40:29.780 --> 40:31.320]  So that is exclusionary.
[40:31.320 --> 40:34.360]  And unfortunately, we haven't found a way around it yet.
[40:35.380 --> 40:36.900]  Good news is it is scalable.
[40:37.360 --> 40:38.740]  So these APIs are in place.
[40:38.880 --> 40:40.100]  We have image scrapers.
[40:40.440 --> 40:41.380]  We can do that.
[40:41.740 --> 40:44.300]  We've thought about scraping social media or hashtags.
[40:44.740 --> 40:49.800]  You know, we can get live faces in there or recent faces that haven't been indexed anywhere else.
[40:49.920 --> 40:51.260]  Yeah, so let me talk about that real quick.
[40:51.380 --> 40:52.740]  That's kind of where I see this going.
[40:52.760 --> 40:56.300]  And that's one of the things I think is probably the most awesome piece of this project.
[40:56.520 --> 41:05.020]  If we go scrape hashtag smile or hashtag happy on Instagram, all of a sudden, we have this live feed of images that are brand new.
[41:05.160 --> 41:06.840]  There's no metadata about them.
[41:06.940 --> 41:11.100]  They don't work in reverse image search because they've never existed on the Internet before.
[41:11.320 --> 41:22.060]  All of a sudden, you can take these live feeds of images, run them through an emotion API that's going to tell you already what emotions in it, filter channel, and then pop them out there.
[41:22.280 --> 41:28.220]  So you can literally produce these in real time with images that aren't vulnerable to a lot of this stuff.
[41:29.680 --> 41:35.260]  So right now, we're working on making sure that they're resistant to reverse image search and computer vision attacks.
[41:36.340 --> 41:39.020]  There is a variety in the method of challenge expression.
[41:39.280 --> 41:41.640]  So we do have, you know, all these emotions.
[41:41.860 --> 41:53.160]  We've been looking at, you know, the confusion matrix to see which emotions are easily confused by people so that when you're offered challenges, you get the best blend that will give you the highest possible chance to be accurate.
[41:55.400 --> 42:01.000]  Now, any of you are image processing specialists, you know, you work in the spatial domain, the frequency domain.
[42:01.320 --> 42:03.500]  Can you filter out my distortions?
[42:03.640 --> 42:04.760]  Can you come wreck my day?
[42:05.000 --> 42:07.760]  That's where I want you guys as hackers to challenge me.
[42:07.860 --> 42:08.860]  Don't hack the web server.
[42:08.960 --> 42:09.800]  We don't care about that.
[42:10.020 --> 42:24.240]  If you are an image processing specialist and you can remove those distortions to the point that you can now get the emotion API to re-pick up the face or you can get a hit with metadata on reverse image search, that's what we're interested in.
[42:24.800 --> 42:26.460]  And I'll put up the source on GitHub.
[42:26.460 --> 42:30.900]  So if you want to help the other side and actually build it further, you're welcome to that as well.
[42:33.420 --> 42:36.620]  So we've already pretty much talked about these in detail.
[42:38.120 --> 42:39.600]  So we'll end with this.
[42:39.840 --> 42:45.460]  So Bender says, prove that you're not a robot by injuring a human through interaction, allowing a human to come to harm.
[42:48.440 --> 42:48.860]  Questions?
[42:50.640 --> 42:51.900]  You want to step up to the mic?
[42:52.860 --> 43:02.380]  As a person on the autism spectrum, not only does it affect people who are blind, but also people who cannot maybe process emotion as well.
[43:02.640 --> 43:14.180]  So when you see the face, you may not be able to understand which face is actually being displayed, which might result in probably, I think it was less than, I think, probably 30 or 25 percent of the time that would be even accurate.
[43:15.000 --> 43:19.040]  So do you have any answers for that or any alternatives?
[43:20.640 --> 43:35.160]  I would hope that we could do an outreach program to the autism awareness community and perhaps maybe use this as a tool to enhance emotion detection based on where you fall on the spectrum.
[43:35.680 --> 43:40.660]  That may be a little bit far-fetched, but it would definitely be something we'd like to look into.
[43:40.940 --> 43:44.540]  But as of now, unfortunately, the prime challenge is emotional recognition.
[43:45.480 --> 43:48.500]  So yeah, we completely recognize the shortcomings of it, right?
[43:48.600 --> 43:50.040]  We can't solve all the problems.
[43:50.200 --> 43:54.920]  Our goal is to solve the big one and then we can move on to all the fringe cases.
[43:54.920 --> 44:02.300]  So I found one small little loophole in the logic of using Instagram.
[44:02.620 --> 44:02.880]  Absolutely.
[44:03.360 --> 44:04.540]  Or even Twitter, for that matter.
[44:05.100 --> 44:08.760]  You're using people's faces without their consent.
[44:09.520 --> 44:10.940]  That's kind of bordering on...
[44:10.940 --> 44:16.240]  If they put them on Instagram and it's public, I mean, that's the Internet, man.
[44:16.300 --> 44:18.760]  Yeah, but that's kind of... That's the world we live in, bro.
[44:18.760 --> 44:19.640]  It's 2016.
[44:20.080 --> 44:22.540]  I understand that, but you're in a hacker conference.
[44:22.740 --> 44:26.260]  There's a button on your Instagram that's private, right?
[44:26.660 --> 44:29.320]  If you don't want to share it with the world, don't share it with the world.
[44:29.460 --> 44:31.460]  It's real easy and they give you that button.
[44:31.680 --> 44:33.300]  That's not a problem we're trying to solve.
[44:36.020 --> 44:36.460]  Sorry.
[44:38.280 --> 44:39.400]  I have a question.
[44:40.300 --> 44:44.640]  Are these images being run through some filters for people with colorblindness?
[44:44.780 --> 44:50.240]  Because I used an app real quick and they all check out pretty well for people who are colorblind.
[44:51.880 --> 44:55.740]  I'm afraid I must admit that was not intentional, but I am glad to hear that.
[44:56.940 --> 45:03.640]  You know, I think we would have to look at filtering specifically for the different types of colorblindness.
[45:04.740 --> 45:08.580]  It's something we can look into in the future for sure in further usability studies.
[45:10.480 --> 45:12.860]  I just want to say I love the idea.
[45:13.120 --> 45:16.120]  And I'm just curious if you've seen the Twilio programming video.
[45:17.520 --> 45:18.660]  No, we haven't seen that.
[45:18.740 --> 45:19.340]  What's that all about?
[45:20.160 --> 45:22.040]  You guys are... just look it up.
[45:22.580 --> 45:23.340]  You'll love it.
[45:23.780 --> 45:24.100]  Will do.
[45:24.360 --> 45:24.680]  Thank you.
[45:27.240 --> 45:27.680]  Okay.
[45:27.840 --> 45:30.200]  Last but not least, we'll just throw up the resource slide.
[45:30.600 --> 45:34.680]  There's a couple of white papers to read that are pivotal in the capture community.
[45:34.900 --> 45:36.020]  Highly recommended stuff.
[45:36.760 --> 45:41.020]  Dr. Motoyama, Dr. Yan, Dr. Burstein.
[45:41.940 --> 45:42.740]  Check them out.
[45:43.340 --> 45:48.760]  And then last but not least, the links to the new image annotation stuff.
[45:49.400 --> 45:50.280]  HackedExistence.com.
[45:50.400 --> 45:51.580]  All this stuff will be up there soon.
[45:51.700 --> 45:52.100]  Check it out.
[45:52.320 --> 45:53.360]  Thank you guys all for coming.
[45:54.740 --> 45:55.900]  Is there time for one more?
[45:56.140 --> 45:57.020]  Yeah, we got one more.
[45:57.360 --> 45:57.840]  What's up?
[45:58.420 --> 45:58.680]  Okay.
[45:58.860 --> 46:00.200]  Just one more thought.
[46:01.600 --> 46:20.760]  If the way that images are selected is sort of predictable, then you might be able to try to match the challenge with a limited pool of images, then give it an original, send it off to an IPI, and get the original emotion.
[46:21.200 --> 46:21.680]  Absolutely.
[46:21.820 --> 46:26.700]  That's the problem that we run into when we scrape Google images, is that all those images already exist.
[46:26.820 --> 46:30.020]  And if we search smile, you know, it's going to be obvious.
[46:30.620 --> 46:30.800]  Right.
[46:30.940 --> 46:34.380]  You know, we get top 100, you can do a match to top 100 or something like that.
[46:34.380 --> 46:39.020]  The cool thing about this Python library is Google's already figured out that images have faces.
[46:39.100 --> 46:44.900]  So you can search things like rock or sign or red, and it will return images that have faces.
[46:44.900 --> 46:46.900]  So it's a lot harder to figure that out backwards.
[46:47.480 --> 46:54.940]  But our goal for solving that is pulling stuff from the fire hose of Instagram and Twitter and images that haven't been out there before.
[46:55.320 --> 46:55.420]  So.
[46:57.240 --> 46:57.900]  All right.
[46:58.120 --> 46:58.520]  Thanks, everyone.
[46:58.720 --> 46:59.240]  Appreciate it.