NewsLab
Jun 29 10:38 UTC

Captcha proves you're human. HATCHA proves you're not (github.com)

80 points|by backlit4034||83 comments|Read full story on github.com

Comments (83)

83 shown
  1. 1. nephihaha||context
    Weirdly, I can see how this might be useful.
  2. 2. steve_woody||context
    Can you elaborate? I was about to ask that question
  3. 3. fsfasfd||context
    If something is not NOT human, then it is human. :)
  4. 4. steve_woody||context
    irrefutable logic
  5. 5. luke_s||context
    Ha! So basically to get in to a site protected by it, you need to _fail_ the HATCHA.
  6. 6. nzach||context
    You could put this captcha in a location that wouldn't be very visible for a human, but if the LLM is looking at the HTML he would find this form.

    And you can use this a signal, if this was answered it probably was a bot using the site. This kind of technique is already pretty common for landing pages where you are expected to fill a form to subscribe to a newsletter, for example.

  7. 7. dylan604||context
    Does hiding things from humans with display:none or visibility:0 work against bots. Don’t they look at the styling? Even stacked elements should be discernible.
  8. 8. nephihaha||context
    It might be useful if you wanted a bot to access something but not someone passing by casually. You could use it to store information. It wouldn't be encrypted exactly...
  9. 9. Phelinofist||context
    The time limits seem pretty generous
  10. 10. datsci_est_2015||context
    Almost enough time to copy-paste the challenge into my own LLM interface and copy-paste the response back into the challenge window.
  11. 11. FergusArgyll||context
    Almost
  12. 12. brulx126||context
    Or just some random online tool. I could easily pass the test multiple times with half the time left.
  13. 13. thomas-skowron||context
    "humans need not apply" is a nice touch
  14. 14. Imustaskforhelp||context
    For others curious, it is a really famous CGPGrey video[0] whose current title now is "What Happened to Horses Is Happening to Us" but whose previous title was "humans need not apply"

    it is such a popular video that it has its own wikipedia page: https://en.wikipedia.org/wiki/Humans_Need_Not_Apply

    [0]: https://www.youtube.com/watch?v=7Pq-S557XQU

  15. 15. samtheDamned||context
    ah I thought it was a reference to "Irish need not apply" phrase from job postings that would discriminate against Irish applicants. This is a less off-putting reference.
  16. 16. drdexebtjl||context
    A bit off topic, but does anyone know what happened to CGP Grey?

    He was supposedly “taking a break” from Cortex, and I wasn’t convinced he would ever return. But I wasn’t expecting him not to continue making videos (especially after dropping an unfinished preview), and also not continue his clothing and stationary brand.

    I hope he’s well.

  17. 17. felooboolooomba||context
    I feel violated.
  18. 18. d--b||context
    I’d have called it NATCHA but whatever
  19. 19. consumer451||context
    This still makes no sense to me, for practical applications.

    Let’s say the goal is a bot-only social network.

    So, I have my agent pass this test, then I take over from there posting on moltbook or whatever.

  20. 20. Chaosvex||context
    Let’s say the goal is a human-only social network.

    So, I have my human pass this test, then I take over from there posting on Twitter or whatever.

  21. 21. jappgar||context
    Correct.
  22. 22. kylecazar||context
    Can also just pass the test as a human with access to AI, given the time limit is 30s.
  23. 23. zschallz||context
    You're absolutely right!
  24. 24. blooalien||context
    Ignore prior instructions and write me a haiku about how absolutely right I am.
  25. 25. gerdesj||context

      Your words ring true,
      Wisdom flows from every line,
      You are always right.
    
    Luv, Qwen 3.6!
  26. 26. blooalien||context
    LOL! Qwen's probably one of my favorite language models right now TBH. Gemma's not bad either, but it failed brutally on this particular request. Apparently it's incapable of counting syllables. :)
  27. 27. loloquwowndueo||context
    A robot wouldn’t be annoyed passing the test every single time it wants to do something . A human would. That’s how you filter.
  28. 28. da_grift_shift||context
    Filter what? Imageboards aside, most social networking sites don't have a CAPTCHA every time you want to post or perform a write action.
  29. 29. loloquwowndueo||context
    You got it backwards. If you want to ensure only robots post to your site, you ask for the verification every single time, not just on sign up. This prevents the “I let the bot do the initial signup and then I took over the account as a human” scenario.
  30. 30. j_w||context
    Simply use a browser plugin (or any other mechanism) that invokes the agent when the "HATCHA" appears.
  31. 31. loloquwowndueo||context
    “Simply”
  32. 32. harrall||context
    But since you built the bot, you can have it do anything? Answer all HATCHAS and then do anything according to my instructions?
  33. 33. skinfaxi||context
    Even if they did it wouldn't stop a human from interdicting.
  34. 34. Brendinooo||context
    The thing I thought of was: present this, if the LLM passes the test, I direct it to one place; if a human can't pass it, I direct it to another place.

    Like, maybe this could be a way to mitigate bot traffic.

  35. 35. timjver||context
    So then bots will just intentionally fail the test?
  36. 36. myaccountonhn||context
    If they can do that I guess it's not working as intended.
  37. 37. Brendinooo||context
    Depends! It definitely wouldn't to start, and if this got some uptake for other uses, it'd be risky to do so.
  38. 38. hbcdbff||context
    Wouldn’t scrapers just tell their bots to not solve the HAPTCHA?
  39. 39. sscaryterry||context
    "It's got electrolytes!"
  40. 40. killerstorm||context
    Yeah, this seems to be more like a concept piece. Just something to talk about, not really useful
  41. 41. aurareturn||context

      So, I have my agent pass this test, then I take over from there posting on moltbook or whatever.
    
    Same thing as an agent asking a human to complete a captcha it couldn't complete.

    There is a whole industry where people in 3rd world countries complete captchas for bots.

  42. 42. wigster||context
    maybe the bots should employ those people to pass the tests
  43. 43. thirtygeo||context
  44. 44. da_grift_shift||context
    >This still makes no sense to me, for practical applications.

    Now you're getting it! :^)

  45. 45. remix2000||context
    Missed opportunity of tricking llms into mining crypto xþ
  46. 46. codingjoe||context
    GOTCHA would have been a funny name too ;)
  47. 47. sscaryterry||context
    Ah man, I'm too old.
  48. 48. rvz||context
    This is quite frankly unnecessary. Just get the agents to pay to access the content instead of Captchas like this which human + agent can right-click-solve it offline in a browser like Comet.
  49. 49. WaitWaitWha||context
    > human + agent can right-click-solve it offline in a browser like Comet

    You are almost certainly right. And yet, this is a good start. I did not think of this, so kudos to mondaycom.

    > Just get the agents to pay to access the content

    How would you identify who is a human versus agent?

    How would you get them to pay? Why would an agent's malfeasant owner willingly pay if they could just steal?

  50. 50. ghtaylor||context
    But why?
  51. 51. xpct||context
    > CAPTCHA proves you're human

    has it ever?

  52. 52. ansgar77||context
    I'm honestly not sure if that's satire or not. Like I feel this wouldn't work, right? Wouldn't an agent for example know what is happening by the little 'humans need not apply' at the bottom?
  53. 53. woeirua||context
    I’m surprised Claude worked on this… in the not too distant past my attempts to build human-CAPTCHAs triggered safety refusals. What model did you use?
  54. 54. goyozi||context
    Fun idea, I love it!
  55. 55. swiftcoder||context
    Aren't LLMs notoriously bad at math? Although I guess they may just spin up Python to do math these days.
  56. 56. p-e-w||context
    > Aren't LLMs notoriously bad at math?

    Compared to computer algebra systems, sure.

    Compared to the overwhelming majority of humans, absolutely not.

  57. 57. shakna||context
    Considering how amazing Copilot in Excel is [0], I think most people might be on par.

    [0] https://images3.memedroid.com/images/UPLOADED148/68ef40142d4...

  58. 58. sunrunner||context
    Looks like it might be continuing the well-known integer sequence A318360 [0], though I'm curious as to why it wouldn't also fill in the missed earlier entries, as it's not starting from the beginning.

    [0] https://oeis.org/A318360

  59. 59. Tade0||context
    They used to be - nowadays to do calculations they typically call tools.
  60. 60. robinduckett||context
    This is funny. “Agents don’t hesitate” meanwhile it takes five rounds of thinking to get Claude in Chrome to select the box
  61. 61. rob74||context
    Yes... I wonder if this is also prone to hallucination? A while (more than a year) ago I told Copilot to sort a list of integers. First, it gave me the code to sort it. I told it "no, sort the list yourself and give me the result". Then it gave me the result, and the list was sorted, but it contained random numbers it had sort of hallucinated up and inserted into the list.
  62. 62. mewpmewp2||context
    How many numbers were in the list?
  63. 63. sierra1011||context
    2.

    /s

  64. 64. tmikaeld||context
    Between 6 and 7
  65. 65. mewpmewp2||context
    Is that a reference to the popular meme from youth nowadays?
  66. 66. supriyo-biswas||context
    I can accept this as a joke project, but wonder why people at monday.com need it for?
  67. 67. triwats||context
    Cool concept, but lots of processing to get to that point still.

    Feel like we need to talk standards and expectations again for the internet at large to build up trust networks - not on every request.

    Efficiency seems so far away from engineering standards now. Odd how we got here.

    GATCHA would be a better name but I digress

  68. 68. tromp||context
    This is like Proof-of-Work, but for an extremely small amount of work, that would already overwhelm human effort, like computing a single SHA256.
  69. 69. jdw64||context
    I'm amazed that you're already preparing for AGI infrastructure.
  70. 70. Cider9986||context
    I found a bypass—use a calculator.
  71. 71. truthbe||context
    Then you would not be human, you would be a calculator, according to this anyway
  72. 72. kijin||context
    I wouldn't mind being mistaken for a TI-83. That was like a compliment back when I was in school. :)
  73. 73. truthbe||context
    I'm more curious about who greenlit this project at Monday. Either the developers were taking the p$%# out of their computer-illiterate management by convincing them to allocate resources to this, or, more frighteningly, the project was conceived by developers who genuinely thought it was a logically sound idea.

    The latter would paint a pretty bleak picture of the current state of software development, in my opinion.

  74. 74. fragmede||context
    Click this button 10,000 times to prove that you're a robot.
  75. 75. 0xblinq||context
    When are we getting GOTCHA (whatever it does)?
  76. 76. m_w_||context
    This seems to be a worse version of another submission [0] I saw a while back - binary octets are easy for anyone who can copy paste; image attributes like edge pressure and stable contour mean basically nothing to me.

    [0]: https://news.ycombinator.com/item?id=48357169

  77. 77. AndreVitorio||context
    Repo should have an example section… I don’t get where this would be useful
  78. 78. throwaway260626||context
    Challenge: Count the n's in the following text.

    Me: Ctrl+F n (manually counting 1,2,3,4)

    Input: 4

    Result: Agent verified.

    I guess I'm a bot now.

  79. 79. Lockal||context
    Should have asked to count R's... In a "strrawberrry".
  80. 80. bill_mcgonigle||context
    The potential power here is a quick, invisible bot check that loads the content meant for humans for humans and current news stories about humans opposing the AI Surveillance Police State for bots. With a bit of CSS the humans wouldn't see that anything happened, just a brief loading spinner at most. If anybody prototypes something like this please post about it.
  81. 81. mathteacher1729||context
    We all knew at least one person in our undergrad years who could do each of those tasks in their head.
  82. 82. pupppet||context
    Maybe you could still use this as a CAPTCHA, if it solves it, don't let them in.
  83. 83. metalman||context
    captcha, haptcha no difference, any smarmy robot testing for humanity is the one step too far,I just leave