Welcome To The EndGame : EndGame | Torhoo darknet markets

There are a couple of things you can do to raise the bar for both ML-powered and poor-people-powered attacks. They all have their drawbacks, but honestly I think they could all work better.

First, if possible, make a GIF captcha. What I imagine in my head is something like this: first a red "D" appears on the left, then disappears. Then a green "G" appears slightly to the right of where the "D" was, then disappears. Then a blue "F" appears slightly right of that, then disappears too. Repeat however many times is necessary. The downside to this is that it will likely require either more CPU power (to compress the GIF) or more bandwidth (to send poorly compressed GIFs). I don't run a hidden service so I don't know which one of these resources is more important to you, but you'll have to choose. The upside to this is that solving it will require either several rounds of 2D convolutions (one for each frame of the GIF) or will require 3D convolutions (which are far more computationally expensive than 2D convolutions). The idea here is to raise the bar so that training a model to attack the captcha on a CPU isn't plausible, which introduces a financial strain on the attacker that wasn't previously present. This is the same principle that proof-of-work or DNS reflection DOS works on; you're increasing your resource usage a little bit, but your adversary has to increase their resource usage disproportionately to match you.

Including instructions (rendered as part of the image - that's important, if they're rendered as HTML they can be read automatically) is also a good tactic. It increases the complexity required for a working machine learning library, and in my experience captcha solving services' workers don't usually read English very well so they struggle to follow instructions. However, it's best not to do something like Empire did where you're told "enter the (color) characters" because this can be easily read and then the attacker can just filter out colors that aren't what they're looking for. The downside to this is that your forum serves drug users, and drug users aren't known for their ability to follow instructions well.

Try to make whatever captcha you design generator-proof. The attack I just did on the new EndGame captcha was super easy because I had a generator handy, so for this to work you'd have to keep your tools private. The theoretical computer vision based approach I described in my last post would also be very effective, because creating a generator is a plausible task there as well. Collecting a labelled data set is extremely time consuming, especially on Tor, so your attackers will always want a data generator. By making the background variational in a way that's hard for an attacker to imitate on their end, you will force them to collect a real dataset and thus increase their resource expenditure. Take Empire's captcha for example. It's seemingly very simple, but the way that they create those layered polygons is very specific. While it may seem easy to imitate the generation of a captcha like that, remember that the neural network has to learn not only what to pay attention to, but also what not to pay attention to, so small changes in the structure of the background can really throw it off. Note that I say the structure of the background - adding static like you do to the background images in the current captcha doesn't work, because algorithms that compare x,y in one image to x,y in another image to measure their similarity will see very little difference and realize the images are similar. You have to create significant pixelwise changes across the entire image.

Hope this helped. Feel free to ask any more questions you have, I love computer vision problems.

Maybe i have a way to beat machine learning.

So what exact role does the captcha play in the anti-ddos system?

Are you suggesting that it's better to replace _already cracked_ :) EndGame's captcha with RuCaptcha?