Slashdot Mirror

There was a captcha a while ago that pulled pictures and "hottness" information from hotornot.com, then asked the user to select three of the 9 people that were "hott". link

While this approach probably wouldn't be very appropriate for "serious" companies to use (think IBM, microsoft, usbank, etc.) as protection from bots, I feel like it is a step in the right direction. There are things that humans are really good at and captcha builders need to start using them. For instance: show somebody 5 pictures of similarly sized and colored dogs, and ask them which one is a Golden Retriever, or show them 5 pictures of cars (like 4 ford Tauruses and 1 ferrari) and ask them to identify which one is the most expensive. or 5 pictures of people and ask which one is the oldest, 4 mopeds and 1 ducatti and which one is the fastest.

I could keep going, but the point is that we have evolved to be good at determining things that computers still have trouble with (like attractiveness).

I like this better:

http://www.hotcaptcha.com/

Now they'll be able to Pwn all those sites protected by Hot CAPTCHAhttp://www.hotcaptcha.com/...

It's called HotCaptcha

It's not quite as cool as this

I think I actually prefer the hot or not type auth. http://www.hotcaptcha.com/ But then again some peoples idea of hot or not can be very different.

Your captcha can be defeated by a simple parser + google. Just see if "food+pink" has more hit than "food+hamburger".

Also you would need a small army of people to write the question in the first place (actually you could try to generate category/item couples from a statistical analysis of wikipedia).

Now that I think of it... it's just too easy to beat your captcha randomly (1/4 chances is not that bad for a script).

On a funny note... captcha similar in spirit to the one you propose is http://www.hotcaptcha.com/ based on hotornot. At least it's worth a laugh :)

Here's the link: http://www.hotcaptcha.com/ it's using the HotOrNot API
It's actually quite fun to do.

This class of CAPTCHA is not always going to work first time, every time. It depends upon the subjective opinion or skill of the user. In my view, the ultimate CAPTCHA has been released:

www.hotcaptcha.com

You know it makes sense!

hotcaptcha, using the HOTorNOT API...

You've got two constraints. One is that you have to be able to compose an arbitrarily large numbers of capchas algorithmically. For example, that example you just used is human-composed. If its the only CAPTCHA you have, the following program gets me a job at Google: gawk 'BEGIN{print "b"}' . If you have 100 CAPTCHAS, I only need to add a switch statement and some elbow grease and then I get to break your CAPTCHA a trillion times.

The other contraint is that you have to have your problem be trivially solvable by humans. I know plenty of people who cannot solve the CAPTCHA you have given: one obvious example would be, umm, all of my coworkers, because I live in Japan and "sub sandwitch" is not generally on the Japanese English curriculum. Similarly, you could any number of parsing problems which are very difficult for machines ("Here are 10 pictures chosen from HotOrNot. Click the three hot chicks.") but which may also be difficult for some users, such as Slashdotters who have never met a girl before.

By the way, you can find an implementation of that CAPTCHA at http://www.hotcaptcha.com/